--- title: "Are unnecessary or unauthorized browser extensions blocked?" url: https://insuranceposture.com/questions/endpoint-and-patching/unnecessary-unauthorized-browser-extensions-blocked category: "Endpoint protection and patching" canonical_key: q_edr_012 evidence_state: partial updated: 2026-08-24 --- # Are unnecessary or unauthorized browser extensions blocked? URL: https://insuranceposture.com/questions/endpoint-and-patching/unnecessary-unauthorized-browser-extensions-blocked Section: Endpoint protection and patching Evidence state: Partly verifiable from your tenant An extension runs inside the browser with access to the pages the user is authenticated to. It is software installation without an installer, and most controls in the endpoint block miss it entirely. ## What the carrier is actually asking The carrier is asking whether users can install arbitrary browser extensions, and whether anything restricts which ones are permitted. This question is a recent addition to application forms and it exists because extension-based credential and session theft became common. ## Why it is underwritten A malicious extension can read page content, capture form input, and access session tokens for every site the user visits, including the identity provider. It bypasses disk-level controls entirely, and it survives password rotation because it steals sessions rather than credentials. Application control on the operating system does not see it. ## Where the answer lives in Microsoft 365, Entra ID, and Azure Extension policy is enforced through browser management, which is delivered by endpoint policy and is visible in device management. | Platform | Where the setting lives | What has to be true | | --- | --- | --- | | Microsoft 365 | Browser policy in Intune: extension allow-list or block-list settings | An allow-list rather than a block-list, since blocking known-bad extensions is an endless and losing exercise | | Microsoft 365 | Enterprise browser management and profile enforcement | Corporate profiles enforced, so policy applies rather than being avoidable by using a second browser | | Microsoft 365 | Which browsers are permitted on the fleet | Unmanaged browsers blocked or managed, because an extension policy on one browser does not constrain another | | Entra ID | Token protection and sign-in frequency in Conditional Access | Session binding and shorter sign-in lifetimes limit the value of a stolen session token | | Entra ID | Application consent and admin consent workflow | The adjacent risk: a user granting an application broad delegated permissions, which is the same attack through a different door | **The related exposure is application consent** Extension control and application consent control are the same problem in different surfaces: a user granting broad, persistent access to their session or their data. If you are addressing extensions, restrict user consent to applications at the same time. Carriers do not usually ask about the second one, and it produces the same class of loss. ## What a defensible yes requires - Extension installation is governed by an allow-list rather than user discretion. - The policy applies to every browser permitted on the fleet, not only the primary one. - A request path exists for legitimate extensions, with a review before approval. - Session tokens are protected through binding and reasonable sign-in frequency. - User consent to third-party applications is restricted, with an admin consent workflow. ## How this answer goes wrong Policy is applied to the managed browser and users install a second browser, which the extension policy does not touch and which happily signs into the same corporate applications. The other failure is a block-list of known-bad extensions, which is permanently behind and gives a false sense of control. ## If this answer turns out to be wrong Agent coverage, patch state, and end-of-life software are the answers that move fastest without anyone deciding to move them, so this block is where an accurate answer most often ages into an inaccurate one before the policy expires. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [why an accurate answer ages, and when the policy makes that matter](https://insuranceposture.com/glossary/point-in-time-underwriting). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary). ## Frequently asked ### Is this really an insurance question now? It has appeared on several forms in the last two renewal cycles, driven by claims involving session theft. Expect it to become standard. ### Allow-list or block-list? Allow-list. A block-list requires knowing what is bad in advance, which is the assumption that fails for every new extension. ### Does this apply to personal devices? You cannot manage extensions on an unmanaged device, which is an argument for browser-based access with download restrictions rather than full client access from those devices. ### What does token protection add? It binds the session to the device, so a stolen token is not usable elsewhere. It reduces the value of exactly the theft a malicious extension performs. ## Related questions - [Is software installation automatically controlled and unauthorized software blocked?](https://insuranceposture.com/questions/endpoint-and-patching/software-installation-automatically-controlled-unauthorized-software-blocked) - [Are users able to access email through a non-corporate (BYOD/personal) device?](https://insuranceposture.com/questions/access-control/users-able-access-email-through-non-corporate-device) - [Does the Applicant have a report-phishing email add-in enabled for all email users?](https://insuranceposture.com/questions/email-security/applicant-report-phishing-email-add-enabled-email-users) - [Is web gateway technology used to monitor and filter malicious or suspicious URLs?](https://insuranceposture.com/questions/network-and-logging/web-gateway-technology-monitor-filter-malicious-suspicious-urls) --- Insurance Posture by SecValley. https://insuranceposture.com The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished. SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact. Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.