Browser-Specific Behavior

Browser Extension Manager supports extension inventory and enforcement across Chrome, Edge, and Firefox on Windows and macOS, but each browser handles managed extensions differently. This page documents the browser differences that administrators need to understand when building and deploying enforcement policies.

      Managed Settings Mechanism
Browser Inventory Enforcement
Windows macOS
Google Chrome yes yes ExtensionSettings registry policy Managed Preferences plist
Microsoft Edge yes yes ExtensionSettings registry policy Managed Preferences plist
Mozilla Firefox yes yes Enterprise policies (JSON) Enterprise Policies plist

Chrome and Edge

Chrome and Edge share the same Chromium engine and use the same managed extension mechanism. The agent writes enforcement settings to the ExtensionSettings policy. On Windows endpoints, both browsers read this policy from the Windows registry; on macOS endpoints, from managed preferences plist files.

Enforcement Behavior

When a Deny List policy is applied, the agent sets the installation_mode for each blocked extension to removed. This instructs the browser to:

  1. Immediately uninstall the extension if it is currently installed.
  2. Prevent the user from reinstalling the extension from the browser's extension store.
  3. Display a notice that the extension has been removed by enterprise policy if the user attempts to install it.

When an Allow List policy is applied, extensions not on the list are also set to installation_mode removed, achieving the same uninstall behavior.

User-Visible Indicators

Users see the following indicators when enforcement is active:

  • The browser's extensions page (chrome://extensions or edge://extensions) displays a Managed by your organization banner at the top of the page or near managed extensions.

  • Blocked extensions that the user previously had installed disappear from the extensions page.

  • Attempting to install a blocked extension from the web store shows a message indicating that the extension is blocked by the organization's administrator.

Extension ID Format

Chrome and Edge extensions use a 32-character lowercase alphabetic ID derived from the extension's public key. For example:

  • cjpalhdlnbpafiamejdnhcphjbkeiagm (uBlock Origin on Chrome)

  • odfafepnkmbhccpbejgmiehpchacaeak (uBlock Origin on Edge)

Chrome and Edge assign different store IDs to the same extension. An enforcement policy must include both IDs to block or allow an extension across both browsers. Check the inventory report; it lists each browser variant as a separate row, and that report is the source of truth for per-browser store IDs when you are populating a policy.

Firefox

Firefox uses its own extension platform and a separate managed settings mechanism. While the end result (extension removal) is the same, the technical implementation differs from Chromium-based browsers.

Enforcement Behavior

When a Deny List policy is applied, the agent writes a Firefox enterprise policy that sets the installation_mode for each blocked extension to blocked. Despite the different keyword (blocked vs. removed in Chromium), the outcome is the same:

  1. The extension is uninstalled if currently installed.

  2. The user cannot reinstall the extension.

  3. Firefox displays a notification that the extension has been blocked by the system administrator.

User-Visible Indicators

  • The Firefox Add-ons Manager (about:addons) shows a Your browser is being managed by your organization message when enterprise policies are active.

  • Blocked extensions are removed from the Add-ons Manager.

  • Attempting to install a blocked extension displays a message that the extension has been blocked.

Extension ID Format

Firefox extension IDs use either an email-style format or a GUID format, depending on how the extension developer defined it. For example:

  • uBlock0@raymondhill.net (uBlock Origin on Firefox)

  • {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} (Adblock Plus on Firefox)

These IDs look very different from Chrome/Edge IDs. When adding Firefox extensions to a policy, use the exact ID as shown in the Firefox Add-ons store or in the inventory report.

Comparison Table

The following table summarizes the key differences across the supported browsers.

Capability Chrome Edge Firefox
Extension discovery yes yes yes
Risk scoring yes yes yes
AI detection yes yes yes
Enforcement (Allow List / Deny List) yes yes yes
Enforcement keyword removed removed blocked
Managed settings mechanism ExtensionSettings ExtensionSettings Enterprise policies
"Managed by organization" banner yes yes yes
Extension ID format 32-char alpha 32-char alpha Email or GUID
Same extension, same ID across stores? no no no

Extension IDs Across Browsers

A common point of confusion is that the same extension has a different identifier in each browser store. This is because each store assigns IDs independently. There is no universal extension ID.

For example, a single well-known ad blocker may have three completely different IDs:

Browser Extension Store ID
Chrome uBlock Origin cjpalhdlnbpafiamejdnhcphjbkeiagm
Edge uBlock Origin odfafepnkmbhccpbejgmiehpchacaeak
Firefox uBlock Origin

uBlock0@raymondhill.net

When building enforcement policies, always verify that you have the correct store ID for each browser. The inventory report shows the store ID alongside the browser name for each discovered extension. Add each browser variant to the policy as a separate entry.

Agent Behavior

The agent handles all browser-specific translation. Administrators create a single enforcement policy with a list of extensions. For each enforcement cycle, the agent builds one managed-settings JSON payload per supported browser (Chrome, Edge, Firefox) based on the policy's mode and its extension entries for that browser's store. How that payload is delivered depends on the endpoint platform.

Windows

On Windows endpoints, the agent:

  1. Writes each payload to the corresponding browser's policy location under HKLM:\SOFTWARE\Policies, unconditionally — the agent does not check whether a given browser is installed first:

    • Chrome: HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionSettings

    • Edge: HKLM:\SOFTWARE\Policies\Microsoft\Edge\ExtensionSettings

    • Firefox: HKLM:\SOFTWARE\Policies\Mozilla\Firefox\ExtensionSettings

  2. On the next browser launch (or the next time the browser refreshes policy), each browser reads its managed settings from the registry and enforces the configuration.

macOS

On macOS endpoints, the agent:

  1. Writes each payload to the corresponding browser's managed preferences plist file, unconditionally — the agent does not check whether a given browser is installed first:

    • Chrome: /Library/Managed Preferences/com.google.Chrome.plist

    • Edge: /Library/Managed Preferences/com.microsoft.Edge.plist

    • Firefox: /Library/Managed Preferences/org.mozilla.firefox.plist

  2. Flushes the system preferences cache (cfprefsd) so browsers can pick up the updated policy without requiring a full restart.

  3. On the next browser launch (or the next time the browser refreshes policy), each browser reads its managed settings from the plist file and enforces the configuration.

Writing to all three locations, regardless of which browsers are present, keeps the agent logic simple and has no negative effect on uninstalled browsers. The settings sit idle until a browser is there to read them.

Because the settings are already in place, a browser installed after the policy has been deployed picks up the configuration the first time it launches. There is no need to redeploy or modify the policy after a new browser install.

Troubleshooting

Extension not being removed after policy activation

  1. Verify the store ID in the policy matches the store ID in the inventory report for that specific browser.

  2. Confirm the agent has completed at least one policy update cycle since the policy was activated.

  3. Check that the browser is one of the supported enforcement browsers (Chrome, Edge, or Firefox).

  4. On the endpoint, verify that the browser's managed settings are present. For example, check the registry for ExtensionSettings (Windows) or the managed preferences plist file (macOS).

"Managed by your organization" banner not appearing

The banner appears only after the agent has written managed settings to the browser's configuration. If the banner is absent:

  1. Confirm the policy is active and has been received by the agent.

  2. Restart the browser. Some browsers only read managed settings at startup.

  3. Verify that no conflicting group policy or MDM profile is overriding the settings.

User reports they cannot install an extension that should be allowed

In Allow List mode, any extension not explicitly on the list is blocked. Check whether the extension's store ID for the user's specific browser is included in the policy. Remember that Chrome and Edge use different store IDs for the same extension.