Are unnecessary or unauthorized browser extensions blocked?
An extension runs inside the browser with access to the pages the user is authenticated to. It is software installation without an installer, and most controls in the endpoint block miss it entirely.
What the carrier is actually asking
The carrier is asking whether users can install arbitrary browser extensions, and whether anything restricts which ones are permitted. This question is a recent addition to application forms and it exists because extension-based credential and session theft became common.
Why it is underwritten
A malicious extension can read page content, capture form input, and access session tokens for every site the user visits, including the identity provider. It bypasses disk-level controls entirely, and it survives password rotation because it steals sessions rather than credentials. Application control on the operating system does not see it.
Where the answer lives in Microsoft 365, Entra ID, and Azure
Extension policy is enforced through browser management, which is delivered by endpoint policy and is visible in device management.
| Platform | Where the setting lives | What has to be true |
|---|---|---|
| Microsoft 365 | Browser policy in Intune: extension allow-list or block-list settings | An allow-list rather than a block-list, since blocking known-bad extensions is an endless and losing exercise |
| Microsoft 365 | Enterprise browser management and profile enforcement | Corporate profiles enforced, so policy applies rather than being avoidable by using a second browser |
| Microsoft 365 | Which browsers are permitted on the fleet | Unmanaged browsers blocked or managed, because an extension policy on one browser does not constrain another |
| Entra ID | Token protection and sign-in frequency in Conditional Access | Session binding and shorter sign-in lifetimes limit the value of a stolen session token |
| Entra ID | Application consent and admin consent workflow | The adjacent risk: a user granting an application broad delegated permissions, which is the same attack through a different door |
Extension control and application consent control are the same problem in different surfaces: a user granting broad, persistent access to their session or their data. If you are addressing extensions, restrict user consent to applications at the same time. Carriers do not usually ask about the second one, and it produces the same class of loss.
What a defensible yes requires
- Extension installation is governed by an allow-list rather than user discretion.
- The policy applies to every browser permitted on the fleet, not only the primary one.
- A request path exists for legitimate extensions, with a review before approval.
- Session tokens are protected through binding and reasonable sign-in frequency.
- User consent to third-party applications is restricted, with an admin consent workflow.
How this answer goes wrong
Policy is applied to the managed browser and users install a second browser, which the extension policy does not touch and which happily signs into the same corporate applications. The other failure is a block-list of known-bad extensions, which is permanently behind and gives a false sense of control.
Frequently asked
Is this really an insurance question now?
It has appeared on several forms in the last two renewal cycles, driven by claims involving session theft. Expect it to become standard.
Allow-list or block-list?
Allow-list. A block-list requires knowing what is bad in advance, which is the assumption that fails for every new extension.
Does this apply to personal devices?
You cannot manage extensions on an unmanaged device, which is an argument for browser-based access with download restrictions rather than full client access from those devices.
What does token protection add?
It binds the session to the device, so a stolen token is not usable elsewhere. It reduces the value of exactly the theft a malicious extension performs.
Related questions
Stop answering this from memory
Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.
Assess your posture