Chrome/Edge extension allowlist policy

Overview

Malicious extensions steal cookies and session tokens. Allowlisting reduces risk; balance against user demand.

Build the catalog

1. Export current extensions in use (browser management reports or RMM inventory).
2. Approve by business need; reject duplicates and deprecated extensions.
3. Map extension IDs for Chromium policies.

Deployment

• Intune Administrative Templates for Edge/Chrome extension control.
• Block install from Web Store except allowlist; consider force-install of standard set (password manager, SSO helper).

Ongoing governance

• Monthly request queue for new extensions—security reviews phishing-prone categories (coupon, PDF converters).
• Remove extensions when vendor sunsets or CVE published.

User communication

Explain that allowlisting prevents shadow extensions that bypass MDM visibility.

Pitfalls

Overly strict policy driving personal device workarounds—pair with viable approved tools.