Building Browser Extension Policies for Safari

After discovering and reviewing browser extensions through the inventory process, administrators can create enforcement policies to control which extensions are permitted on managed endpoints. This guide walks through the complete process of creating, configuring, and verifying enforcement policies for Safari.

Privilege Manager can help control Safari browser extensions on macOS, but Safari works differently from Chrome, Edge, and Firefox. Read this page before you create a Safari extension policy so you know what Privilege Manager can and cannot do.

Important: Full, enforced control of Safari extensions on macOS is only available to a Mobile Device Management (MDM) solution through a configuration profile. Privilege Manager is an endpoint privilege and application control solution, not an MDM, so Safari extension control is best effort and has the limitations described on this page.

Safari Extension Control Capabilities

Privilege Manager can block a Safari extension from being enabled. It cannot force an extension to stay enabled or re-enable one; Apple reserves that for MDM.

A Safari extension block policy can:

Stop a user from turning on a blocked extension. If a message action is used, the user sees a denial message, and the agent unchecks the extension in Safari Settings automatically.
Turn off an extension that was already enabled before the policy was applied. The next time Safari opens, the policy takes effect and the extension is unchecked.

How Safari Differs From Other Browsers

Behavior	Chrome / Edge / Firefox	Safari
How extension are enforced	Privilege Manager writes browser managed settings that the browser reads when it starts	The agent turns the extension off in Safari Settings while Safari is running
When enforcement applies	After the browser restarts	While Safari is open (a live block, plus a sweep shortly after Safari launches)
Enabled / disabled state in inventory	Reported	Not reported (Safari keeps this state in a protected location the agent cannot read)
Scope	Per browser profile	The currently logged-in user only
Policy type	Browser Extension Enforcement Policy (allow list / deny list)	Safari Extension Block Policy (deny only)

Blocked Safari Extensions

Privilege Manager blocks a Safari extension in one of two ways, and only extensions that have a block policy are ever touched. Any extension without a policy is left alone.

When the extension runs. Some extensions start a background process when they are used. As soon as that happens, the agent blocks it and, if the policy uses a message action, shows the denial message window.
A sweep right after Safari opens. A few seconds after Safari launches, the agent reviews the installed extensions and turns off any that a policy blocks (including extensions that never run a process of their own).

Some extensions never run a process, for example content blockers such as uBlock Origin Lite. Because they never run, the live block never sees them; the post-launch sweep is what turns them off. For these extensions you will not see a denial message window. Instead, the extension is quietly unchecked a few seconds after Safari opens.

Prerequisites

Safari extension enforcement relies on macOS permissions that the Privilege Manager agent already needs for its other features:

Accessibility: required so the agent can uncheck the extension in Safari Settings. If Accessibility has not been granted, a silent deny still prevents the extension from loading, but the checkbox stays checked because the agent cannot update it. A message action will keep reappearing until the permission is granted and the checkbox can be unchecked.
Full Disk Access and the approved system extension: the agent’s standard macOS requirements.

The sweep runs when the agent starts (if Safari is already running) and a few seconds after each Safari launch. On a fresh manual install these permissions are usually not granted yet, so the sweep cannot uncheck anything until Accessibility (along with Full Disk Access and the approved system extension) has been granted. Once the permissions are in place, enforcement takes effect at the next Safari launch. Deployments that grant these permissions up front through MDM work from the first launch. Refer to the macOS MDM Profiles page for the recommended PPPC profile.

Creating a Safari Extension Block Policy

Safari policies live in the same Browser Extension Policies section as the other browsers, but use a dedicated Safari template.

Go to Browser Extension Policies and select Create Policy.
Choose the Safari Extension Block Policy Template (macOS).
Choose how the block behaves: Silently deny or Notify and block.
Target the extension(s) you want to block (see below).
Assign the policy to the macOS computer group you want it to apply to, then save and enable the policy.

Targeting a Safari Extension

A Safari extension is an .appex bundle inside its parent app. To block one, you create an Application Bundle Filter that matches the extension’s bundle identifier and bundle name. To find the values:

In Finder, locate the app that provides the extension (for example, in Applications).
Right-click the app and choose Show Package Contents, then open Contents > PlugIns. The extension is the .appex file here.
Right-click the .appex file, choose Show Package Contents, and open Contents > Info.plist.
Use the bundle identifier and bundle name from Info.plist in the Application Bundle Filter on your policy.

Known Limitations

Enforcement is best effort and reversible. A user can turn a blocked extension back on. For an extension that runs a process, Privilege Manager blocks it again the moment it next runs. For an extension that does not run a process (such as a content blocker), it is re-disabled by the sweep the next time Safari launches, so it can stay on for the rest of the current Safari session. Privilege Manager cannot prevent a user from re-enabling an extension in between these points.
Logged-in user only. Enforcement applies to the extensions of the user currently signed in to the Mac.
Safari inventory is more limited. Safari extensions appear in the same Browser Extension Inventory reports as the other browsers, with their name, Store ID (bundle identifier), version, and computer or user counts. However, Risk Score, Risk Level, AI Classification, Author, and Manifest Version are not computed for Safari extensions, and their enabled / disabled state is not available to the agent, so those columns are blank for Safari rows.
Validated on English-language Macs. If Safari’s language is set to something else, the automatic unchecking may not work in this release.