Why a “handy” extension brings risk
Extensions run in the browser with permissions you would probably not grant a standalone program. They can read page content, watch forms and sometimes see files or downloads. A malicious or compromised extension is a popular way to steal credentials or sessions, precisely because staff install them themselves and IT often only finds out when something goes wrong. Even “good” extensions can invade privacy or suddenly change owner. So an extension belongs on the same list as other software: approved, kept up to date, or not allowed.
What to map first
Ask, or use management tools to see, which extensions are on the work laptops. Group them roughly:
- Necessary for work: for example an approved password manager or a line-of-business tool that genuinely belongs in the browser.
- Handy but replaceable: screen capture, PDF editors or note tools that also exist as a desktop app or in Microsoft 365.
- Unknown or too powerful: extensions with vague names, few reviews, or rights to read everything on every site without a clear reason.
Agree with a few power users what they really need. Often three or four extensions are enough and the rest was “tried once”.
Policy: allow, block or store-only
In Microsoft Edge and Google Chrome you can lock this down via Intune or group policy. A common SME approach:
- Allow only approved extensions (allowlist): the clearest option. Anything not on the list is blocked or removed.
- Blocklist for known risks: faster to start, but you stay behind the facts.
- Install only from the official store, no sideloading: a baseline rule, not enough on its own.
Tie this to the same idea as local admin rights on laptops: anyone who can install everything locally can bypass the policy easily. And as with blocking USB storage via Intune, document exceptions rather than “everyone may everything except…”.
Permissions and updates: what to watch
For each candidate extension, look at the permissions it asks for. “Read and change data on all websites” is heavy; ask whether the tool can do with less, or whether a Microsoft 365 alternative exists. Prefer extensions from known publishers with recent updates. Put in the policy that outdated or disabled extensions are cleaned up. Record who requested an exception and until when, so the allowlist does not grow in silence.
Rollout without Monday-morning chaos
Announce the policy briefly: which extensions stay, which go, and where colleagues can request an exception. Roll out via Intune first to a test group, then to the rest. After a week, check for broken workflows and whether new add-ons have crept in. Combine this with normal patch management; see also Windows updates and patch management, because an updated browser without grip on extensions only solves half the problem.
How Floor ICT handles this
Floor ICT inventories which extensions are present, agrees a short allowlist with you and sets the policy in Edge and Chrome via Intune. We test with a small group, remove unwanted add-ons and set up a simple request path for exceptions. Periodically we check whether the list still fits, so browser extensions do not remain a blind spot next to MFA, BitLocker and the rest of your workplace management.