Chrome ExtensionSettings: allowed, blocked, forced and removed

Chrome's ExtensionSettings policy sets one installation mode per extension: allowed, blocked, force_installed, normal_installed or removed. A star entry sets the default for everything else. The difference between the modes decides whether a policy only stops new installs or also cleans up old ones, so knowing each lets an administrator build an allowlist that holds.

The five modes

From Google's policy documentation:

• allowed: users can install the extension. This is the default when no mode is set.
• blocked: users cannot install it.
• force_installed: installs automatically, and users cannot remove it. It needs an update_url.
• normal_installed: installs automatically, but users can disable it. It also needs an update_url.
• removed (Chrome 75 and later): users cannot install it, and Chrome removes it if it was already there.

The difference between blocked and removed matters in a cleanup. Blocking prevents new installs. Removing gets rid of copies that people already have.

The default entry

A star key sets the default policy for any extension that has no entry of its own. Google notes that allowed_types and install_sources can only be set in the default configuration. It also says you cannot use the star with force_installed or normal_installed, because Chrome needs a specific extension ID to install.

An allowlist pattern therefore looks like this in outline: default to blocked, then add allowed or forced entries for each approved extension.

{
  "*": { "installation_mode": "blocked" },
  "EXTENSION_ID_HERE": { "installation_mode": "allowed" }
}

Precedence

Google states that ExtensionSettings overrides the older extension related policies when both are set. If you have legacy allow and block lists in place, review them so you are not guessing which one wins.

Choosing between modes

• Use force_installed for tools every user must have, like a company password manager, and accept that users cannot remove it.
• Use normal_installed when you want to seed a recommended tool but leave choice to the user.
• Use removed during incident response, to pull a bad extension from every managed browser.
• Use blocked as the default for sensitive groups, with a short approved list.

Pair modes with a review process

An allowlist is only as good as the process behind it. Decide who approves, what you check (permissions, publisher, reviews, update history), and when you re-review. The extension policy template and the company-wide block guide can help.

Common mistakes

Two mistakes show up often. Admins set the default to blocked and forget to add the password manager or security tools they need, which breaks work on day one. Others use force_installed for convenience and then cannot let users remove a tool that turned out to be noisy. Pilot first.

Quick check

Sources

• Configure ExtensionSettings policy

Last reviewed: 19 October 2026.