Block Extension Installation in Microsoft Edge

You can block the installation of extensions in Microsoft Edge using Group Policy or the registry, which prevents users from adding new extensions while still allowing existing ones to function. This guide explains the policy settings, step-by-step configuration for Windows Pro/Enterprise and Home editions, and answers common questions about managing Edge extensions.

Why Block Extensions in Edge?

Extensions add functionality to Edge, but they also introduce risks. Malicious or poorly coded extensions can track browsing activity, inject ads, steal credentials, or slow down the browser. In corporate or school environments, administrators often block extension installation to enforce security policies, reduce help-desk calls, and keep browsing consistent. Even at home, a parent might want to prevent children from installing extensions that bypass content filters or access inappropriate material.

Blocking installation does not remove already-installed extensions. It only stops new ones from being added. If you need to remove existing extensions, you must do that separately, either manually or via policy.

How Microsoft Edge Extension Policies Work

Microsoft Edge (Chromium-based) supports a set of Group Policy administrative templates. The relevant policies are under Computer Configuration > Administrative Templates > Microsoft Edge > Extensions. The two most important settings are:

• Control which extensions are installed silently – lets you force-install extensions by ID.
• Configure extension installation allow list – defines a list of extension IDs that users are allowed to install. If you set this to a specific list, only those extensions can be installed.
• Configure extension installation block list – defines extension IDs that users cannot install. A block list is less restrictive than an allow list.

To completely block all new installations, you set the allow list to a single value: * (asterisk). This wildcard means “allow only extensions on this list,” and since the list contains only the wildcard, no extension matches it, so nothing can be installed.

Step-by-Step: Block via Group Policy (Windows Pro/Enterprise)

For Windows 10/11 Pro, Enterprise, or Education, the cleanest method is Local Group Policy Editor.

1. Press Win + R, type gpedit.msc, and press Enter.
2. Navigate to Computer Configuration > Administrative Templates > Microsoft Edge > Extensions.
3. Double-click Configure extension installation allow list.
4. Select Enabled.
5. Click Show… under Options.
6. In the Value column, type * (asterisk) and click OK.
7. Click OK to close the policy window.
8. Restart Microsoft Edge (or run gpupdate /force in Command Prompt).

Now users will see the “Installed” toggle greyed out in edge://extensions, and any attempt to install from the Edge Add-ons store will show a message like “Your organization turned off the ability to install extensions.”

Blocking Extensions on Windows Home (Registry Method)

Windows Home does not include the Group Policy Editor, but you can achieve the same result by editing the registry directly. The policy is stored under a specific registry key.

1. Press Win + R, type regedit, and press Enter.
2. Navigate to:
   HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallAllowlist
3. If the Edge or ExtensionInstallAllowlist keys do not exist, right-click the parent key, choose New > Key, and name it accordingly.
4. Inside ExtensionInstallAllowlist, right-click and select New > String Value.
5. Name it 1 (the value name is just a sequence number).
6. Double-click it and set the value data to *.
7. Click OK and close the Registry Editor.
8. Restart Edge.

Be careful with the registry: a wrong edit can break other settings. Export the key before making changes if you want a backup.

Using the Block List Instead (Less Restrictive)

If you only want to stop specific known-bad extensions, use the Configure extension installation block list policy. Add the extension IDs you want to block. Users can still install any other extension. This is useful when you trust most extensions but want to prevent a few problematic ones.

To find an extension’s ID, visit the Edge Add-ons page for that extension, look at the URL – the ID is the long string of lowercase letters and numbers at the end. Alternatively, after installing it, go to edge://extensions and enable “Developer mode” to see the ID.

What Happens to Existing Extensions?

Setting the allow list to * does not uninstall or disable extensions that are already installed. It only prevents new installations. If you want to remove existing extensions, you have two options:

• Manually remove them via edge://extensions on each device.
• Use the Configure extension installation block list policy to block the IDs of the installed extensions. When a blocked extension is already installed, Edge will automatically disable it on the next restart.

If you need to force-remove extensions, you can also use the “Control which extensions are installed silently” policy with a list that does not include the unwanted ones – but this is more complex and typically used for managed deployments.

Frequently Asked Questions

Can I still install extensions if I’m an administrator?

Yes, but only if you temporarily change the policy back. The policy applies to all users, including admins. To install an extension, you would need to remove the * from the allow list (or delete the registry value), install the extension, then re-add the block. This is why many organizations use a separate browser profile for admin tasks.

Does this block extensions on mobile versions of Edge?

No. The Group Policy and registry methods work only on Windows (and macOS with the plist equivalent). Edge on Android and iOS does not support extensions at all, so there is nothing to block. On other desktop platforms like Linux, you can use the same policy via the Edge policy file, but the steps differ.

What if I see “Your organization turned off the ability to install extensions” but I never set a policy?

This message appears when any policy is active. It could be from a previous registry edit, a leftover group policy from an old IT setup, or a third-party management tool. Check the registry key mentioned above, and if it exists, delete the ExtensionInstallAllowlist key (or remove the * value) to restore normal installation.

Will this affect Edge WebView2 apps?

No. WebView2 is a separate runtime used by apps to embed web content. The extension policies for the Edge browser do not apply to WebView2. If you need to control extensions in WebView2, you would use the WebView2-specific settings, which are different.

Can I block only certain extensions for some users?

Yes, if you use Active Directory domain group policy, you can apply a policy to specific OUs (organizational units) rather than the whole domain. For local policies, you cannot target individual users – the policy applies to everyone who logs into that Windows machine.

How do I unblock extensions later?

Simply reverse the steps: in Group Policy, set the allow list to “Not Configured” or delete the registry key. After restarting Edge, users can install extensions again. If you used a block list, remove the IDs from that list.

Related

• Fix iPhone Can’t Make Calls on iOS 11 Public Beta
• Transfer Books from iPhone/iPad to Computer Without iTunes
• USB Restricted Mode: Enable It to Protect Your Data