Can you block an entire extension store in Microsoft Edge?

Yes. In Microsoft Edge, the ExtensionSettings policy can block every extension from a given store by blocking that store's update URL. Microsoft's example blocks the Chrome Web Store this way, and notes that the allow and force install policies can still bring in specific extensions.

Why block a store

Some organizations want developers to use only one store, or only internal builds. Blocking a store by its update URL is a broad rule that does not require you to list every ID. It pairs naturally with an allowlist for the few extensions you do accept from that store.

The JSON

Microsoft documents this pattern in its extension management guide. The key is the word update_url, a colon and the store address, and the value sets installation_mode to blocked.

{
  "update_url:https://clients2.google.com/service/update2/crx": {
    "installation_mode": "blocked"
  }
}

That address is the Chrome Web Store update URL used in Microsoft's example. In group policy you enter the value in the setting named Configure extension management settings, compressed to a single JSON string.

What still works

Microsoft states that you can still use ExtensionInstallForcelist and ExtensionInstallAllowlist to allow or force install specific extensions even if the store is blocked using this JSON. That makes the pattern useful: block the store, then admit the few items you reviewed.

Where it goes wrong

1. Typing the URL differently. The match is on the update URL, so copy it exactly from the documentation.
2. Broken JSON. A stray character stops the whole setting from working. Validate before deploying.
3. Assuming it removes installed items. A block affects installs, and Microsoft notes that blocking an already installed extension disables it rather than uninstalling it.
4. Forgetting self-hosted extensions. Internal extensions use their own update manifest location, so they are not covered by a rule on another store.
5. Not testing. Try an install from the blocked store, from an allowed store and via the force list.

Combine with permission blocks

Microsoft also documents blocked_permissions and runtime_blocked_hosts in the same policy. A store block decides where extensions come from. Permission blocks decide what the ones you do admit can do. See our post on Chrome runtime blocked hosts and blocked permissions, which uses the same field names.

Rollout advice

Pilot first, and make sure developers have a request path. The rollout guide has five stages. For the simple allowlist route, see allowing only approved extensions in Edge.

Safeguard note

Safeguard offers a Chrome and Edge extension, and a free scan at gold.safeguard.sh/scan. Store blocking is configured in Edge management.

Quick check

Sources

• Use group policies to manage Microsoft Edge extensions, Microsoft Learn

Last reviewed: 19 October 2026.