Use force-installed for extensions every person in scope must have and must not remove, such as a required company tool. Use normal-installed for helpful extensions you want present by default but that users may turn off. Both install automatically. The difference is whether the user keeps a switch.
What the modes are
Chrome's ExtensionSettings schema lists five installation modes: blocked, allowed, force_installed, normal_installed and removed. Mozilla documents four for Firefox: allowed, blocked, force_installed and normal_installed. In Firefox's words, force_installed installs automatically and "users can't remove it", while normal_installed installs automatically and users "can disable it".
The Chromium force-install policy definition adds details for the forced case: silent install, no uninstall or turn-off through the browser interface, and implicit permission grants.
The decision rule
Ask three questions in order:
- Does the business break if this extension is missing? If yes, consider force-installed.
- Would a disabled copy create a security or compliance gap? If yes, force it. If a person turning it off only costs them convenience, do not.
- Is the publisher one you would trust with silent access on every machine? If not, do not force it, however useful it is.
| Situation | Suggested mode |
|---|---|
| Required SSO or device-posture helper | force_installed |
| Company password manager | usually force_installed, per your policy |
| Productivity helper most people like | normal_installed |
| Niche tool for one team | allowed, scoped to that team |
| Known bad or unreviewed | blocked |
Costs of forcing too much
Forced installs have a cost beyond permissions. Each one is something you now maintain: you track publisher changes, watch updates and answer for it in an audit. A long force list becomes a long review list. People also lose the ability to remove an extension that is misbehaving, so your help desk needs a fast route for complaints.
Normal-installed removes some of that burden. People see the extension, can switch it off if it causes trouble, and you still get a default. If your goal is a good starting setup rather than a hard requirement, this is the lighter choice.
Scope the target
Policies can often be applied to groups or organizational units. Apply forced extensions only to the groups that need them. Engineering may need a debugging tool that finance should never receive.
For what a forced install grants beyond a normal one, read what force-installing grants an extension.
Review cadence
| Mode | Review |
|---|---|
| force_installed | Every quarter, plus whenever the publisher or permissions change |
| normal_installed | Every six months |
| allowed | During inventory reviews |
Examples from real teams
A finance team might force a required SSO helper and leave everything else blocked. An engineering team might normal-install a JSON viewer and a dependency checker, and allow others on request. In both cases the list is short, each entry has an owner, and people know where to ask for more. The point is to match the mode to the consequence of the extension being absent, not to its popularity.
When unsure, start with normal-installed and move to force-installed only if you can name the incident that would follow from a user turning it off.
Quick check
Is normal-installed safer than force-installed?
Not by itself, since both install the extension without a prompt. It gives users the option to disable it, which limits some operational impact but not the install itself.
Which browsers offer both modes?
The Chrome ExtensionSettings schema and Mozilla's Firefox documentation both list force_installed and normal_installed.
Sources
- Chromium policy definition: ExtensionSettings
- Chromium policy definition: ExtensionInstallForcelist
- Firefox Enterprise Admin docs: ExtensionSettings
Last reviewed: 19 October 2026.
