Use force_installed for an extension your security or compliance process requires to be present and active, because users cannot remove it. Use normal_installed when you want to provide a tool by default but let people disable it. Both need an update or install location, and neither works with the wildcard in Chrome.
The definitions
Chrome and Firefox share the same pair of names. Google's help says force_installed installs automatically and users cannot remove it, while normal_installed installs automatically and users can disable it. Mozilla's reference gives the same description.
Edge reaches the same result through the ExtensionInstallForcelist policy. Microsoft says the extension installs silently and the user cannot uninstall or disable it.
How to choose
Ask what happens if the user turns it off.
| If the extension is | Choose |
|---|---|
| Needed for a control you must evidence | Force install |
| A convenience tool you want everyone to start with | Normal install |
| Still under evaluation | Neither, use a pilot group allow |
| Known to conflict with developer tooling | Normal install, so people can opt out |
Force install is strong. It also removes user choice, so it can break workflows and generate help desk tickets. Reserve it for a short list.
What each mode needs
Google's help says both installed modes require an update_url and cannot be used with the asterisk. For Chrome Web Store extensions, it gives the update URL as https://clients2.google.com/service/update2/crx.
Mozilla's reference says an install_url is required unless the extension is hosted on addons.mozilla.org or has an update_url, with later Firefox versions relaxing this for addons.mozilla.org. Read the reference for your Firefox version.
For Edge, a Chrome Web Store hosted extension uses the extension ID, a semicolon and the update URL. A self-hosted one uses the same pattern with a link to an update manifest file.
Hidden costs of forcing
Forced extensions update on the vendor's schedule unless you control the update path, so you inherit their release quality. Chrome offers a minimum_version_required field that disables extensions older than a version you set, including forced ones, and override_update_url to control where later updates come from. Read our post on where force-installed extensions get updates for the trade offs.
Also remember that a forced extension is an extension with the same permissions it asked for. Review it like any other, using the steps in auditing Chrome extension permissions in five minutes.
Toolbar pinning in Chrome
Chrome has a toolbar_pin field with values default_unpinned (the default), default_pinned and force_pinned. If users need a forced extension to stay visible, force_pinned keeps it on the toolbar.
Safeguard note
Safeguard's Chrome and Edge extension is available if you want it on developer machines, and you can run a free scan at gold.safeguard.sh/scan. Whether to force install it is your call in your browser management.
Quick check
Can users remove a normal_installed extension?
They cannot remove the policy, but Google's help says they can disable it. A force_installed extension cannot be removed by the user.
Can I force-install with the wildcard in Chrome?
No. Both installed modes require an update_url and cannot be used with the asterisk.
Sources
- Manage Chrome extensions, Chrome Enterprise help
- Use group policies to manage Microsoft Edge extensions, Microsoft Learn
- ExtensionSettings policy, Firefox administrator reference
Last reviewed: 19 October 2026.
