How to Completely Disable ‘Extension Installations’ via Group Policy in Microsoft Edge

Browser extensions are small software programs that customize the browsing experience, but in an enterprise environment, they represent a colossal security and compliance risk. Extensions run with elevated privileges within the browser sandbox and can often read, modify, and exfiltrate all data on every website a user visits—including proprietary internal dashboards, financial portals, and classified web applications. If users are permitted to arbitrarily install extensions from the Microsoft Edge Add-ons store or the Chrome Web Store, the organization is exposed to severe risks of data harvesting, malicious payload delivery, and regulatory violations (such as HIPAA or GDPR).

This guide explains how to completely disable ‘Extension Installations’ via Group Policy in Microsoft Edge, enforcing a strict zero-trust model where all unauthorized add-ons are cryptographically blocked from being installed.

Disable Extension Installations via Group Policy

To enforce a strict block that disables the installation of any extension globally across the browser, we must deploy an administrative template and utilize the extension blocklist feature. Note that this requires Windows 11 Pro, Enterprise, or Education editions.

1. Log into Windows 11 with an Administrator account.
2. Press the Windows Key + R to open the Run dialogue box.
3. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.
4. In the left-hand navigation pane, strictly follow this exact path:

   Computer Configuration > Administrative Templates > Microsoft Edge > Extensions

5. In the right-hand pane, locate the policy named Control which extensions cannot be installed.
6. Double-click the policy to open its configuration window.
7. Select the radio button next to Enabled.
8. Under the “Options” section, click the Show… button next to “Extension IDs”.
9. In the “Value” field, type a single asterisk (*). (This asterisk is a wildcard that instructs the browser to block all extension IDs from being installed, effectively neutralizing the entire extension framework).
10. Click OK on the input dialogue, then click Apply and OK on the policy window.

Verify the Configuration Lockdown

Group Policy changes require the browser to read the registry upon its next launch. Close all active instances of Microsoft Edge. If you wish to force the policy update immediately across the OS, open Command Prompt as Administrator and run gpupdate /force.

To verify the restriction is active, open Microsoft Edge and navigate to the Edge Add-ons store or the Chrome Web Store. Attempt to install any extension. The “Get” or “Add to Edge” button will be greyed out, or the browser will explicitly inform you that the installation is blocked by your administrator. The browser is now cryptographically bound to reject all external code modifications, ensuring that the endpoint remains a sterile, zero-trust browsing environment.