Browser Extension Inventories

Before you can review or enforce browser extension policies, Privilege Manager must discover what extensions are installed across your managed Windows and macOS workstation. Privilege Manager provides a pre-staged Browser Extension Inventory Policy for this purpose. The policy is installed disabled by default; you enable it, optionally adjust its schedule, and confirm its target computer group. Once the policy is active, the Privilege Manager agent on each endpoint scans browser extension data and reports the results to the server.

What the Agent Scans

When the Browser Extension Inventory Policy is active on a Windows or macOS workstation, the Privilege Manager agent enumerates extensions from the following browsers:

• Google Chrome – All user profiles on the workstation
• Microsoft Edge – All user profiles on the workstation
• Mozilla Firefox – All user profiles on the workstation
• Safari – Only users with an active session when inventory runs

The browser does not need to be running at the time of the scan.

What the Agent Collects

Field	Chrome / Edge / Firefox	Safari
Extension name	yes	Falls back to Bundle ID if not readable
Store ID	yes	Bundle ID is used instead
Version	yes	yes
Author	yes	no
Description	yes	no
Permissions	yes	no
Enable/disabled state	yes	no
Install source	yes	no
Browser and profile	yes	no

Step 1: Enable the Pre-Staged Browser Extension Inventory Policy

Privilege Manager provides separate pre-staged Browser Extension Inventory Policies for Windows and macOS workstations. Each policy is disabled by default so that administrators can review its targeting and schedule before agents begin reporting. You do not create a new policy; you enable the one that already exists.

1. Navigate to Computer Groups in the left navigation panel.
2. Expand the Windows Computers or MacOS Computers computer group, then select Scheduled Jobs.
3. Locate the policy named Browser Extension Inventory Policy in the list.
4. Open the policy and set Enabled to On (the pre-staged state is Off).
5. Click Save.

The pre-staged policy is marked with the NoModify, NoDelete, and NoReplication attributes, which prevent accidental deletion or structural changes. Enabling, disabling, adjusting triggers, and changing the target group are all still permitted.

Step 2: Adjust the Scan Schedule (Optional)

Out of the box, the Browser Extension Inventory Policy runs on two triggers:

• Weekly trigger: Wednesday at 11:00 AM local workstation time, with a random delay of up to three hours to stagger agent load. This applies one week apart.
• On-agent-registration trigger: Runs once when an agent first registers with the server and receives the policy, so newly onboarded workstations are inventoried without waiting for the next weekly window.

These defaults are intended to give you fleet-wide coverage once per week without all agents scanning simultaneously. For most environments, no schedule changes are needed.

If you need to change when scans run, edit the triggers on the policy using the standard scheduled-job trigger editor. All schedule control is through the triggers collection on the policy.

Tightening the schedule by running the inventory daily instead of weekly or reducing the random delay to zero increases the load the policy places on workstations and on the server. A weekly cadence is sufficient for most environments because extension inventory changes are typically low frequency events. Only tighten the schedule if your security posture requires faster detection of newly installed extensions.

Step 3: Target the Policy to a Computer Group

The pre-staged policies target the Windows or MacOS Computers computer groups by default. If that target is appropriate for your environment, no changes are needed and you can skip this step. Otherwise, adjust the targeted groups as follows:

1. On the policy detail page, locate the Computer Groups Targeted section.
2. Click Edit to modify the list of targeted computer groups.
3. Select the computer groups that should receive the inventory policy.
4. Click Save.

You can target the same policy to multiple computer groups. For example, a single policy can target both a general group and a narrower group to give uniform inventory coverage across your fleet.

Step 4: Deploy and Wait for Agents to Report

Once the policy is enabled and targeted, the Privilege Manager agent on each workstation in the targeted computer group will receive the policy on its next policy update cycle. The agent then performs an initial scan of all browser profiles on the machine because either the on-agent-registration trigger fires for newly onboarded endpoints or because an existing agent picks up the policy change and queues the next run according to the weekly trigger.

The time between enabling the policy and first results appearing in reports depends on:

• Agent update interval: How frequently agents check for new policies. This is configured in the agent configuration settings for the computer group.
• Number of endpoints: Larger environments take longer for all agents to check in and report.
• Number of browser profiles: Machines with many user profiles take slightly longer to scan.

In most environments, you can expect initial results to begin appearing within one to two agent update cycles after enabling the policy.

Step 5: View Inventory Results

Once agents have reported extension data, you can start reviewing the results.

For next steps, see Browser Extension Reports, Classification, and Risk Scoring.