To allow only approved extensions in Microsoft Edge, set the ExtensionInstallBlocklist policy to a single asterisk, then list each approved extension ID in the ExtensionInstallAllowlist policy. Everything else is blocked, and approved items install normally. Microsoft documents both policies in its Edge extension management guide.
The two policies in plain words
A blocklist says what users cannot install. An allowlist carves exceptions out of it. Used together, a wildcard blocklist plus a short allowlist gives you a default deny posture for browser add-ons.
| Policy | What it does | Typical value |
|---|---|---|
| ExtensionInstallBlocklist | Extensions that cannot be installed | An asterisk to block all |
| ExtensionInstallAllowlist | Extensions allowed despite the blocklist | One extension ID per row |
| ExtensionInstallForcelist | Extensions installed silently | ID plus update URL |
Microsoft states that typing an asterisk into the blocklist policy prevents any extension from being installed, and that you can pair it with the allow policy so only certain extensions install.
Steps in Group Policy
- Open the group policy management editor and go to Administrative Templates, then Microsoft Edge, then Extensions.
- Open "Control which extensions cannot be installed", select Enabled, click Show, and enter an asterisk.
- Open "Allow specific extensions to be installed", select Enabled, click Show, and add one extension ID per row.
- Apply the policy and confirm on a test laptop by opening the Edge Add-ons site and trying to install something not on the list.
Microsoft adds a tip for finding IDs: open the extension on the Edge Add-ons website and read the ID at the end of the URL in the address bar.
What happens to extensions people already have
This is the part that surprises teams. Microsoft notes you can add an already installed extension to the blocklist. That disables it and prevents the user from re-enabling it, but it does not uninstall it. Plan for leftover data on disk, and check the extension list on a sample laptop after rollout rather than assuming it is gone.
Force-installing a required extension
If you need an extension on every machine, use ExtensionInstallForcelist. The extension installs silently, and the user cannot uninstall or disable it. Microsoft also says this setting overrides any enabled blocklist policy, so a force-installed extension still installs when the wildcard blocklist is on.
For an extension hosted in the Chrome Web Store, the entry is the extension ID, a semicolon, and the update URL. For a self-hosted extension, use the same extension ID and update URL pattern, where the update URL points to an update manifest XML file.
A sensible order of work
Start by listing what is installed today, so the allowlist reflects real use. Decide a small set of approved extensions with an owner for each. Then apply the wildcard block to a pilot group before everyone. Developers tend to rely on a handful of tools, and a pilot surfaces them fast. Give people a way to request an addition so the policy does not push them toward workarounds.
Safeguard note
Safeguard offers a Chrome and Edge extension and an asset discovery capability, and you can try a free scan at gold.safeguard.sh/scan. Your browser policy is still set in Edge management, not in Safeguard.
Quick check
Does the wildcard blocklist remove extensions already installed?
No. Microsoft says a blocked extension that is already installed is disabled, and users cannot re-enable it, but it is not uninstalled.
Can the allowlist and the force list both be used?
Yes. The force list installs required extensions silently, and Microsoft says it overrides an enabled blocklist.
Sources
Last reviewed: 19 October 2026.
