How to Completely Disable ‘Extensions’ (Add-ons) via Group Policy in Microsoft Edge

Browser extensions are powerful tools that add new features to Microsoft Edge, such as password managers, ad blockers, and grammar checkers. However, in enterprise and educational environments, allowing users to install unverified third-party extensions is a massive security and compliance risk. Malicious extensions can easily harvest browsing history, intercept passwords, inject advertisements, or act as a vector for malware. To maintain a sterile and predictable browsing environment, IT administrators must completely lock down the browser and prevent the installation of all extensions.

This guide explains how to completely disable the ability to install Extensions (Add-ons) system-wide in Microsoft Edge using Group Policy.

Disable Extensions via Group Policy

To enforce a strict block that prevents users from accessing the Edge Add-ons store or installing extensions from the Chrome Web Store, we must deploy an administrative template. Note that this requires Windows 11 Pro, Enterprise, or Education editions.

1. Log into Windows 11 with an Administrator account.
2. Press the Windows Key + R to open the Run dialogue box.
3. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.
4. In the left-hand navigation pane, navigate precisely to this path:

   Computer Configuration > Administrative Templates > Microsoft Edge > Extensions

5. In the right-hand pane, locate the policy named Control which extensions cannot be installed.
6. Double-click the policy to open its configuration window.
7. Select the radio button next to Enabled.
8. Under the “Options” section, click the Show… button next to “Extension IDs”.
9. In the “Value” field of the new window, type an asterisk ( * ). This acts as a wildcard, blocking all possible extension IDs.
10. Click OK to close the list, then click Apply and OK on the main policy window.

Verify the Lockdown

Group Policy changes require the browser to read the registry upon its next launch. Close all running instances of Microsoft Edge.

To verify the restriction is active, reopen Microsoft Edge and navigate to the Edge Add-ons store (or the Chrome Web Store). Find any extension and click “Get” or “Add to Chrome.” The browser will immediately intercept the installation, displaying an error message that the extension is blocked by your administrator. Any pre-existing extensions that were installed prior to applying this policy will also be forcibly disabled and greyed out in the edge://extensions menu. Your browser is now completely locked down against third-party code injection.