Allowing users to request the installation of browser extensions for Microsoft Edge

This week is also about Microsoft Edge. More specifically, about managing browser extensions for Microsoft Edge. That has been a subject before, but in that case it was focused on fully managing Microsoft Edge browser extensions on Windows devices. In that case, it was a pretty strict configuration focussed on creating an allow list for Microsoft Edge browser extensions. There are, however, easier methods for allowing users to request the installation of extensions for Microsoft Edge. Within the Microsoft Edge management service there is ability to block the installation of extensions by default, while allowing user to request the installation of any blocked extension. Once the installation is requested, the IT administrator has to approve the installation by allowing the requested extension. With that, IT administrators can still provide the user with some flexibility around extensions, while staying in control. That control is important as nowadays browser extensions provide a security risk by gaining access to browser activity. That potentially allows stealing sensitive data, injecting malware, tracking for adware, hijacking sessions, and more. This post will provide a closer look at getting control on Microsoft Edge browser extensions.

Allowing users to request Microsoft Edge browser extensions

When looking at the configuration of blocking the installation of Microsoft Edge browser extensions, the configuration is actually pretty straightforward. That process is documented in this earlier blog post about managing Microsoft Edge browser extensions on Windows devices. That configuration is mainly focused on using Microsoft Intune for the configuration. For allowing users to request the installation of browser extensions, by using default functionality, the configuration is actually only available via the Microsoft Edge management service. The configuration is available via the Managed extensions tab on a policy in the Microsoft Edge management service. That off course contains a combination of policies created in the management service and policies created in Microsoft Intune. The experience, however, has been that managing browser extensions only really works on policies that are created directly in the management service. The following steps walk through the creation of a policy that blocks all the extensions by default and allows users to request the installation of blocked extensions.

1. Open the Microsoft 365 admin center portal and navigate to Setting > Microsoft Edge
2. On the Microsoft Edge for Business page, navigate to the Configuration policies tab and click Create policy
3. On the Basics page, provide at least a unique name to distinguish it from similar profiles, select Windows, select Cloud as the policy type, and click Next
4. On the Settings page, add the ExtensionInstallBlocklist setting with the following configuration and click Next

• Specify * as value for the setting Control which extensions cannot be installed to block all extensions
• Select Windows as the platform to which the policy applies

5. On the Extensions page, as shown below in Figure 1, configure the following settings and click Next

• Select Extension (1) with the setting Allow these types of apps and extensions
• Select Block external extensions from being installed (2) with the setting External extensions
• Select Allow users to request blocked extensions (3) with the setting Extension requests
• Select Block all unmanaged extensions by default (4) with the setting Unmanaged extensions
• Configure the remaining settings to Not configured

6. On the Assignments page, add the required group assignment and click Next
7. On the Finish page, review the configuration and click Review and create

After creating the new cloud policy in the Microsoft Edge management service, that new policy can be used for the configuration to allow requesting the installation of Microsoft Edge browser extensions. That requires allowing Microsoft Edge to send data about blocked extensions to the Microsoft Edge management service. The following steps walk through the required steps.

1. Open the Microsoft 365 admin center portal and navigate to Setting > Microsoft Edge
2. On the Microsoft Edge for Business page, navigate to the Configuration policies tab and select the just created policy
3. Navigate to the Managed extensions tab of the just created policy and select the Requests section
4. In the Requests section, click Manage request settings
5. On the Manage request settings blade, as shown below in Figure 2, select Enabled, specify notification information and click Save

Requesting the installation of Microsoft Edge browser extensions

When the configuration for allowing users to request the installation of Microsoft Edge browser extensions is in place, it is actually pretty straightforward to experience the behavior. That experience starts with requesting a browser extension. When the user wants to install new browser extensions, the user now receives a prompt to send a request to the IT administrator, as shown below in Figure 3. That prompt is the same for all blocked browser extensions.

Once the request has been posted the IT administrator will see that information in the Monitoring dashboard of the Microsoft Edge management service, as the number of Requested extensions will simply increase. On top of that, the email configuration will make sure that the IT administrator will receive a daily overview of the requested extensions via the email. To actually allow or block the installation of the requested browser extension, the IT administrator must navigate to Managed extensions > Requests on the created policy. That should provide an overview of all the requested browser extensions. The IT administrator can now simply select the browser extension and choose to either allow or block the installation, as shown below in Figure 4.

When the installation of the browser extension is allowed, the user will receive a notification on the next synchronization of the policy. That notification tells the user about the approval and clicking on that notification brings the user directly to the installation page of the browser extension. Now the user can actually click Get > Add extension for the installation.

More information

For more information about managing Microsoft Edge browser extensions, refer to the following docs.

• Browser extensions assessment – Microsoft Defender Vulnerability Management | Microsoft Learn
• Manage Microsoft Edge extensions in the enterprise | Microsoft Learn
• Extensions management | Microsoft Learn
• Deploy Microsoft Edge policy using ADMX template in Microsoft Intune | Microsoft Learn