Endpoint protection and patching

Are unnecessary or unauthorized browser extensions blocked?

An extension runs inside the browser with access to the pages the user is authenticated to. It is software installation without an installer, and most controls in the endpoint block miss it entirely.

Partly verifiable from your tenant

What the carrier is actually asking

The carrier is asking whether users can install arbitrary browser extensions, and whether anything restricts which ones are permitted. This question is a recent addition to application forms and it exists because extension-based credential and session theft became common.

Why it is underwritten

A malicious extension can read page content, capture form input, and access session tokens for every site the user visits, including the identity provider. It bypasses disk-level controls entirely, and it survives password rotation because it steals sessions rather than credentials. Application control on the operating system does not see it.

Where the answer lives in Microsoft 365, Entra ID, and Azure

Extension policy is enforced through browser management, which is delivered by endpoint policy and is visible in device management.

PlatformWhere the setting livesWhat has to be true
Microsoft 365Browser policy in Intune: extension allow-list or block-list settingsAn allow-list rather than a block-list, since blocking known-bad extensions is an endless and losing exercise
Microsoft 365Enterprise browser management and profile enforcementCorporate profiles enforced, so policy applies rather than being avoidable by using a second browser
Microsoft 365Which browsers are permitted on the fleetUnmanaged browsers blocked or managed, because an extension policy on one browser does not constrain another
Entra IDToken protection and sign-in frequency in Conditional AccessSession binding and shorter sign-in lifetimes limit the value of a stolen session token
Entra IDApplication consent and admin consent workflowThe adjacent risk: a user granting an application broad delegated permissions, which is the same attack through a different door
The related exposure is application consent

Extension control and application consent control are the same problem in different surfaces: a user granting broad, persistent access to their session or their data. If you are addressing extensions, restrict user consent to applications at the same time. Carriers do not usually ask about the second one, and it produces the same class of loss.

What a defensible yes requires

  • Extension installation is governed by an allow-list rather than user discretion.
  • The policy applies to every browser permitted on the fleet, not only the primary one.
  • A request path exists for legitimate extensions, with a review before approval.
  • Session tokens are protected through binding and reasonable sign-in frequency.
  • User consent to third-party applications is restricted, with an admin consent workflow.

How this answer goes wrong

Policy is applied to the managed browser and users install a second browser, which the extension policy does not touch and which happily signs into the same corporate applications. The other failure is a block-list of known-bad extensions, which is permanently behind and gives a false sense of control.

Frequently asked

Is this really an insurance question now?

It has appeared on several forms in the last two renewal cycles, driven by claims involving session theft. Expect it to become standard.

Allow-list or block-list?

Allow-list. A block-list requires knowing what is bad in advance, which is the assumption that fails for every new extension.

Does this apply to personal devices?

You cannot manage extensions on an unmanaged device, which is an argument for browser-based access with download restrictions rather than full client access from those devices.

What does token protection add?

It binds the session to the device, so a stolen token is not usable elsewhere. It reduces the value of exactly the theft a malicious extension performs.

Related questions

Stop answering this from memory

Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.

Assess your posture