⚙️🪟🧑💼CP - Google Chrome - Allowed Extensions
The guest list at the door. Chrome blocks every extension by default, and this policy names the handful you actually trust to walk in.
What this policy is about 🧩
A browser extension runs inside every page your users visit, reads what they type, and updates itself from someone else's servers. Left open, Chrome will install literally anything from the Web Store. This policy flips that around: an allow list that names the extensions you have approved, and nothing else gets to load.
The extensions you list are customer-specific. A typical entry is Microsoft Defender Browser Protection (bkbeeeffjjeopflfhgeknacdieedcoml); the rest is whatever that tenant has genuinely vetted.
This is the checkbox everyone gets wrong. Naming approved extensions does nothing unless something is blocking the rest first. The allow list only exempts IDs from a block, so it needs a companion policy that blocks everything (Configure extension installation blocklist set to *). Without that block-all, every extension is already allowed and your carefully curated list is pure decoration.
Why this matters 🕵️
Extensions are the browser's supply chain. A popular add-on gets sold to a new "owner", ships a silent update, and now it is exfiltrating form data from ten thousand machines that never clicked anything. You did not install malware; you installed a trustworthy extension that later turned.
An allow list closes that door. Users keep the tools they need, the block-all policy turns away everything else, and a compromised random extension never gets to run because it was never on the list to begin with.
🛠️ Configuration
Where: Intune admin center → Devices → Configuration → Create → Windows → Settings catalog → Google \ Google Chrome \ Extensions.
| Setting | Value |
|---|---|
| Configure extension installation allow list (User) | Enabled |
| Extension IDs to exempt from the blocklist (User) | Your approved IDs, per tenant (e.g. bkbeeeffjjeopflfhgeknacdieedcoml for Microsoft Defender Browser Protection) |
| Assignment, include | All users |
| Assignment, exclude | None (standard exclusions only) |
The exempted IDs are a per-environment value, not a blueprint constant. Ship a hardcoded list to every customer and you have either blocked a tool someone needed or waved through one they never approved.
Caveats ⚠️
It does nothing without the block-all companion. Pair this with a policy that sets the extension blocklist to *. On its own, an allow list is a bouncer guarding an open field.
The list is customer-specific. Treat the approved IDs as a per-tenant variable and review them on a schedule. Extensions change hands; an ID you trusted last year is not automatically the same code today.
User scope means per-user, not per-device. This applies in the user context, so it follows the signed-in user, not the machine. A shared device inherits whoever is logged in.
License and reversibility. Included in Business Premium. Clean-revert: unassign and Chrome falls back to its default (which, without the block-all, means everything is allowed again).
🔗 Related
- ⚙️🪟💻CP - Google Chrome - Security Baseline: sets the block-all (
*) that this allow list exempts extensions from. Without it, this policy does nothing. - ⚙️🪟💻CP - Google Chrome - Forced Extensions: the other half, the extensions you install for the user instead of merely permitting.
These aren't the extensions you're looking for. Name the few you trust, block the rest, and the Web Store stops being an open door. 🧩