Allowlists match on identifiers, not display names. In Edge, the extension ID is at the end of the extension's page URL on the Edge Add-ons site. In VS Code, an extension ID has a period, in publisher dot name form. Firefox policies key entries by the extension ID too, such as an email style ID.
Why IDs, not names
Names can be copied. Two extensions can have near identical titles and icons, and a lookalike can sit beside the real one. An ID is the stable handle that policy uses, so an allowlist written from names alone invites mistakes. Write IDs, and verify them against the store page or the extension's own manifest.
Where to find each one
| Product | Where the identifier appears | Format |
|---|---|---|
| Edge | End of the URL on the Edge Add-ons page | Long string of letters |
| VS Code extension | Extension details page and policy keys | publisher.name, with a period |
| VS Code publisher | Policy key without a period | publisher |
| Firefox | Key in ExtensionSettings | Often an email style string |
Microsoft's documentation gives the Edge tip directly: if you cannot find the app ID, open the extension on the Edge Add-ons website and look at the end of the URL in the address bar.
VS Code's policy documentation explains the other format. A key without a period is treated as a publisher ID, and a key with a period is an extension ID. That one character decides whether you allow a whole publisher or a single extension.
Mozilla's reference describes ExtensionSettings as a map from extension ID to settings, and notes that extensions on addons.mozilla.org can be installed by ID.
A recording template
Keep a register with one row per approved extension. Useful columns:
- Product and store
- Extension ID and publisher ID
- Display name at time of approval
- Permissions reviewed, with the date
- Owner and approver
- Reason it is needed
- Next review date
An ID with no owner and no reason is a candidate for removal. Our owner register template has a ready structure.
Common mistakes
- Copying a name into a policy. Use the ID.
- Allowing a publisher when you meant one extension. A key without a period allows everything from that publisher.
- Confusing store IDs across browsers. The same tool may have different identifiers in different stores. Record each.
- Skipping verification. Confirm the ID matches the publisher you intended before you deploy.
Check it after deployment
On a test profile, try to install the item you allowed and one similarly named item you did not. If both install, your policy matches on something broader than you intended.
A note on inventory
Policy only covers what you know about. Before locking down, inventory what is already installed. See audit installed editor extensions across a team and browser extensions in your asset inventory.
Safeguard note
Safeguard's asset discovery can help build the inventory, and a free scan is at gold.safeguard.sh/scan. Extension IDs themselves come from each store or product.
Quick check
Does a VS Code policy key with no period allow one extension?
No. A key without a period is a publisher ID and applies to all of that publisher's extensions.
Where do I find an Edge extension ID?
Microsoft says to open it on the Edge Add-ons website and read the ID at the end of the URL.
Sources
- Use group policies to manage Microsoft Edge extensions, Microsoft Learn
- Allowed extensions in VS Code, enterprise documentation
- ExtensionSettings policy, Firefox administrator reference
Last reviewed: 19 October 2026.
