Yes. Microsoft's Edge documentation shows an ExtensionSettings rule that blocks an update URL, which blocks installs from that store, and notes that ExtensionInstallForceList and ExtensionInstallAllowList can still force or allow specific extensions even when the store is blocked. That lets you approve a short list and refuse everything else.
The pattern from Microsoft's docs
Microsoft's guidance describes blocking by update URL with a JSON entry whose key starts with update_url: followed by the store address and whose value sets installation_mode to blocked. A note on the same page says you can still use the force list and the allow list to install or allow specific extensions even if the store is blocked using that JSON.
The Chromium schema has the same idea: a key pattern beginning update_url: maps to settings with an installation mode of blocked, allowed or removed, plus allowed and blocked permissions.
Why this is useful
Blocking all store installs is a fast route to a default-deny posture, but it is broad. If you also block the store you need another way to deliver approved extensions. The force list is that way. Remember Edge's own documentation says force-installed extensions install silently, cannot be uninstalled or disabled by users, and that the force setting overrides a blocklist that is enabled.
Steps
- List the extensions you have approved, with their IDs and the update URL each uses.
- Add the approved IDs to the force list or the allow list, as appropriate.
- Add the
update_url:rule that blocks the store you want to close. - Pilot on a small group and confirm three things: the forced extension appears, an unapproved store extension is refused, and your blocked message points to your request form.
- Document the decision and its owner.
Choosing force or allow
| Use | When |
|---|---|
| Force list | The extension must be present for everyone in scope |
| Allow list | The extension is optional but approved |
Our force or normal install guide walks through the choice. Note Edge uses separate allow and force lists, so the exact fields differ from Firefox's.
Risks to keep in view
- A store block hides discovery, not risk. Approved extensions can still change publisher or permissions.
- Update URLs matter. Edge's documentation says self-hosted extensions use the pattern of an ID, a semicolon and an update URL. Whoever controls that URL controls updates.
- Precedence. Microsoft notes
ExtensionSettingscan overwrite other policies including the install lists, so check for conflicts if behavior surprises you. See the precedence cheat sheet.
Testing checklist
- Install an approved extension on a clean profile and confirm it arrives.
- Try to install an unapproved extension from the store and confirm it is refused.
- Remove an approved entry in a test group and confirm behavior matches your expectation.
- Capture a screenshot of the policy page in the browser for your evidence file.
Keep these results with the change record, so a reviewer can see you checked the policy, not only wrote it.
Quick check
Do I have to block the whole store?
No. You can instead use a default block for all extensions plus an allow list. The store block is one way to reach default-deny.
Will force-installed extensions still install if the store is blocked?
Microsoft's documentation says yes, using the force and allow lists.
Sources
- Microsoft Learn: Manage Microsoft Edge extensions with policies
- Microsoft Learn: ExtensionSettings reference guide
- Chromium policy definition: ExtensionSettings
Last reviewed: 19 October 2026.
