Configure 3CX Browser and PWA Permissions

Introduction

The 3CX Web Client and installed 3CX PWA use the same browser permission model for calling, video and incoming-call notifications. This document covers managed Windows PCs, Macs and Chromebooks, and applies whether users open 3CX in a browser tab or as an installed PWA.

These browser policies allow your 3CX PBX's FQDN (3CX or Custom) to access and use the microphone, camera and desktop notifications without prompting each user. Operating-system privacy controls must also allow the managed browser to use those features.

Why centralized permission management is needed

Installing the PWA and granting website permissions are separate tasks. An auto-deployed PWA can still prompt for microphone, camera or notification access unless the browser receives matching policies.

Centralized policies give every managed user the same starting configuration. It is particularly useful for shared computers, terminal servers and seasonal users whose browser permissions may be cleared after a long period of inactivity.

Choosing a deployment method

You can use Intune for managed Windows or macOS devices, Windows Group Policy for Active Directory-managed Windows computers, or Google Admin console for managed ChromeOS devices and cloud-managed Chrome browsers.

Each method delivers the same (chromium-based) permission policy IDs through the operating system's native management channel. When the browser reports the correct 3CX origin URL without errors, the Web Client and PWA can use microphone, camera and notifications without asking each user to approve them manually.

Prerequisites

Before starting, confirm that you have the prerequisites for every platform included in your deployment:

  • The public HTTPS origin URL used by your 3CX system (or systems). For a standard deployment, this is the PBX FQDN, such as https://3cx.example.com.
  • A pilot user, device group, organizational unit or Google Admin organizational unit for testing before broad deployment.
  • For Windows with Intune, admin rights to create and assign Settings Catalog configuration profiles.
  • For Windows with Group Policy, admin rights to create and link a GPO plus access to the domain Central Store or local PolicyDefinitions folders.
  • For macOS, enrolled and managed Macs plus access to Intune, Chrome Enterprise Store, or another MDM solution, depending on the browser.
  • For ChromeOS, enrolled and managed Chromebooks plus Google Admin console access, a target organizational unit or group, and the required Chrome management entitlement.
  • Microsoft Edge or Google Chrome installed and managed on the target devices, with operating system privacy controls permitting generic microphone, camera and notification access.

The deployment configures these browser policies:

  • Microphone access without a permission prompt.
  • Camera access without a permission prompt.
  • Notifications allowed for the 3CX HTTPS URL.

Important: Use only the PBX HTTPS origin URL; do not grant these permissions to every website. Do not add a path such as /webclient because the policies will not match.

Required Downloads and Documentation

Use the resources below for 3CX product guidance and the management method that matches each platform. ADMX and ADML files apply to Windows only; macOS uses Settings Catalog or managed preference files, while Chromebooks use Google Admin policies.

3CX documentation

Windows downloads and deployment references

macOS deployment references

ChromeOS and Chromebook references

Deploy with Microsoft Intune on Windows

Intune is the recommended route for Entra-joined or Intune-enrolled Windows devices. Microsoft Edge policies are built into the Settings Catalog, so an Edge ADMX import is not required.

Create the configuration profile

In the Microsoft Intune admin center:

  • Go to Devices > Manage devices > Configuration.
  • Select Create > New policy.
  • Select Windows 10 and later as the platform.
  • Select Settings catalog as the profile type.
  • Enter a clear profile name, such as 3CX Browser and PWA Permissions.
  • Select Add settings.

Select the browser permission settings

In the Settings picker, search for each policy ID and select the device or user variant that matches the intended assignment scope. Keep microphone, camera and notification permissions in the same scope.

For Microsoft Edge, add these settings:

  • AudioCaptureAllowedUrls: Sites that can access audio capture devices without requesting permission.
  • VideoCaptureAllowedUrls: Sites that can access video capture devices without requesting permission.
  • NotificationsAllowedForUrls: Content settings > Allow notifications on specific sites.

For Google Chrome, search under Google > Google Chrome for the equivalent policy IDs:

  • URLs that will be granted access to audio capture devices without prompt.
  • URLs that will be granted access to video capture devices without prompt.
  • Allow notifications on specific sites.

If a required Chrome setting is unavailable in the catalog, import google.admx with its matching google.adml first, followed by chrome.admx and chrome.adml. Then create an Imported Administrative templates profile.

Enter the 3CX origin URL

Enable each selected policy and add the exact 3CX origin URL as a list entry. Use the same URL for microphone, camera and notifications.

Settings with "(User)" in the Intune name apply in a user-level scope. Entries without that label apply in a device-level scope. Use one scope that matches the profile assignment; do not configure competing values in both scopes.

Assign and create the profile

Complete the profile wizard:

  • Add scope tags if your organization uses them.
  • On Assignments, select a pilot user or device group (the example below uses All devices; a pilot group is safer for initial validation).
  • Review the selected settings and assignments.
  • Select Create.

Restart requirement: Policies may not come into effect until the Windows PC is restarted.

Deploy with Windows Group Policy

Use Windows Group Policy for Active Directory domain environments or for a standalone proof of concept through the Local Group Policy Editor.

Install the browser administrative templates

  • For Edge:
  • This downloads a .cab file named MicrosoftEdgePolicyTemplates.cab.
  • Extract the contents of the .cab file.
  • Navigate inside the extracted folder to windows\admx.
  • ADMX files: Copy msedge.admx (and msedgeupdate.admx) to:
  • Local PC: C:\Windows\PolicyDefinitions
  • Domain Environment: \\<YourDomain>\SYSVOL\<YourDomain>\Policies\PolicyDefinitions
  • ADML files: Open your language subfolder (e.g., en-US) inside windows\admx, and copy the .adml files to the matching language subfolder in your PolicyDefinitions folder (e.g., C:\Windows\PolicyDefinitions\en-US).
  • For Chrome:
  • ADMX files: Copy chrome.admx (and google.admx if present)
  • ADML files: Go inside your language folder inside windows\admx (e.g., en-US) and copy the .adml files inside it into the matching language folder in your destination path
  • Open the Group Policy Management editor and confirm that the Microsoft Edge or Google Chrome categories are visible.

Keep the downloaded template versions aligned with the browser versions deployed in the organization so newer settings remain available.

Create and link the GPO

  • In an Active Directory Domain:
  • Create a GPO named "3CX Browser and PWA Permissions".
  • Edit User Configuration > Policies > Administrative Templates.
  • Open Microsoft Edge or Google > Google Chrome, depending on the managed browser.
  • Link the GPO to an organizational unit containing the intended users.
  • For a Local PC:
  • Edit the settings in the Local Group Policy Editor.

Computer Configuration can be used for device-wide enforcement. Do not configure competing values in user and computer scopes.

Configure Microsoft Edge

  • Under User Configuration > Administrative Templates
  • Click on Microsoft Edge
  • On the right panel:
  • Select Enable Sites that can access audio capture devices without requesting permission and add the 3CX origin URL.
  • Select Enable Sites that can access video capture devices without requesting permission and add the same URL.
  • Expand Content settings, enable Allow notifications on specific sites and add the same origin URL.

Configure Google Chrome

  • Under User Configuration > Administrative Templates
  • Click on Google > Google Chrome
  • On the right panel:
  • Select Enable URLs that will be granted access to audio capture devices without prompt and add the 3CX origin URL.
  • Select Enable URLs that will be granted access to video capture devices without prompt and add the same origin URL.
  • Expand Content settings, enable Allow notifications on these sites and add the same origin URL.

Apply Group Policy normally or run the following on the pilot computer:

gpupdate /force

Restart Windows before testing to ensure the new policies come into effect.

Manage macOS and ChromeOS Devices

The same three browser policies are available on macOS and ChromeOS, but ADMX files are only used for Windows. macOS uses Settings Catalog or managed preference profiles, while ChromeOS uses Google Admin console policies.

macOS with Microsoft Edge

For Intune-enrolled Macs, create a macOS Settings Catalog profile and configure the Microsoft Edge entries for AudioCaptureAllowedUrls, VideoCaptureAllowedUrls and NotificationsAllowedForUrls.

  • Go to Devices > macOS > Configuration > Create > New policy.
  • Select macOS as the platform and Settings catalog as the profile type.
  • Search under Microsoft Edge for the three policy IDs.
  • Enable each policy and add the exact 3CX origin URL.
  • Assign the profile to a pilot group, synchronize the Mac and verify the result at edge://policy.

Do not deploy Windows ADMX files to macOS. Current Microsoft Edge versions can be managed through the Intune Settings Catalog. A preference file using the com.microsoft.Edge domain is an alternative when a required setting is not exposed in the catalog.

Browser policy removes the site-level prompt, but it does not override macOS Privacy & Security controls. Confirm that Microsoft Edge is allowed to use the microphone, camera and notifications on the Mac.

macOS with Google Chrome

Manage Chrome on macOS with Chrome Enterprise Core cloud policies or an MDM-delivered configuration profile based on the com.google.Chrome managed preferences. Create a plist file named com.google.Chrome and deploy it.

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

  <dict>

    <key>AudioCaptureAllowedUrls</key>

    <array>

      <string>https://mypbx.3cx-example.com</string>

    </array>

    <key>VideoCaptureAllowedUrls</key>

    <array>

      <string>https://mypbx.3cx-example.com</string>

    </array>

    <key>NotificationsAllowedForUrls</key>

    <array>

      <string>https://mypbx.3cx-example.com</string>

    </array>

  </dict>

</plist>

  • Set AudioCaptureAllowedUrls to an array containing the 3CX HTTPS URL.
  • Set VideoCaptureAllowedUrls to the same URL.
  • Set NotificationsAllowedForUrls to the same URL.
  • Deploy the configuration profile with Intune's macOS preference file template or another MDM.
  • Verify the applied values at chrome://policy.

The Chrome Enterprise bundle includes the macOS plist and manifest examples. macOS Privacy & Security permission for Google Chrome still applies independently of the website policy.

ChromeOS and Chromebooks

For managed Chromebooks, configure the browser policies in the Google Admin console. ChromeOS does not use ADMX files, and the Intune Chrome Enterprise connector is intended for inventory and remote actions rather than browser policy delivery.

  • Sign in to the Google Admin console.
  • Go to Devices > Chrome > Settings > Users & browsers.
  • Select the organizational unit or group that contains the intended users.
  • Find Audio input allowed URLs and add the 3CX origin URL.
  • Find Video input allowed URLs and add the same URL.
  • Find Allow these sites to show notifications, also documented as NotificationsAllowedForUrls, and add the same URL.
  • Save the policy and verify it on a managed Chromebook at chrome://policy.

These policies apply to Chrome browser sessions and installed PWAs because both use the same Chrome permission model.

Use the Correct 3CX Origin URL

The microphone and camera lists match the security origin (base 3CX URL) requesting access. The scheme, hostname and any non-default port must match the address used by the 3CX Web Client or PWA.

  • Use HTTPS, not HTTP.
  • Include 5001 or another port only when users actually open 3CX on that port.
  • Add each PBX URL separately when one policy serves multiple 3CX systems.
  • Do not use * for microphone or camera access; Chromium browsers do not support that wildcard in these allowlists.
  • Do not include /webclient, a PWA manifest path or another page path.

Verify the Policy End to End

A successful Intune or Group Policy status is only the first checkpoint. Confirm the browser received the policies, then test the 3CX functions that depend on them.

Confirm the browser received the policy

  • On an Intune device, trigger a device sync (typically by rebooting) and confirm that the configuration profile reports success.
  • Open edge://policy or chrome://policy in the managed browser.
  • Select Reload policies.
  • Confirm AudioCaptureAllowedUrls, VideoCaptureAllowedUrls and NotificationsAllowedForUrls contain the expected 3CX origin URL and report no policy error.

For Group Policy, gpresult can confirm that the intended GPO applied. The browser policy page remains the authoritative check for what Edge or Chrome is enforcing.

Test the Web Client and PWA

  • Open the 3CX Web Client in a clean browser profile. If the PWA is deployed, repeat the test from the installed PWA.
  • Place or answer an audio call and confirm that no microphone permission prompt appears.
  • Start a video call and confirm that the camera is available without a browser prompt (possible exception: multiple cameras on the same machine).
  • Trigger an incoming call or another supported notification and confirm that your client displays it.

Testing with a clean profile distinguishes a managed policy result from a permission that a user granted earlier.

Troubleshooting

  • The policy appears in Intune but not in the browser: confirm the assignment group, device sync, selected user or device scope, and restart the PC if it was active when the policy was created.
  • The browser shows the policy but 3CX still prompts: compare the exact Web Client or PWA address with the configured origin, including the scheme and port.
  • Microphone or camera still fails: check Windows privacy settings and confirm that desktop applications may access the device.
  • Notifications are allowed but not visible: check Windows Notifications, Focus or Do Not Disturb, and whether Edge or Chrome can run in the background.
  • A policy is ignored or shows an error: check for another Intune profile, local policy or domain GPO configuring the same policy ID.
  • Only some users work: verify whether the profile was assigned to devices while the settings use user scope, or the reverse.

See Also

Last Updated

This document was last updated 19 Aug 2026

https://www.3cx.com/docs/chromium-permisions-autodeployment/