Force-install a Chrome or Edge extension with Intune or Group Policy
How to push a browser extension to a whole team with Microsoft Intune, Group Policy or the registry, pre-set its settings, and check it worked. Uses the free IOC Triage extension as the example.
When a whole SOC or IT team needs the same browser extension, asking everyone to install it from the store doesn't scale: some forget, some install a lookalike, and nobody knows which version is where. The fix is to force-install the extension through policy. It installs silently, updates itself from the store, and users can't remove or disable it.
The steps are the same for any extension in the Chrome Web Store. The examples use IOC Triage, whose ID is dncgneacahomieionjkaofmfnojlkfmc.
What you need before you start
- The extension ID. It's the 32-letter code at the end of the store address:
chromewebstore.google.com/detail/dncgneacahomieionjkaofmfnojlkfmc. - The update URL for the Chrome Web Store:
https://clients2.google.com/service/update2/crx. - Managed devices. Force-install policies apply to machines that are joined to Active Directory or Entra ID, or enrolled in Intune. A personal laptop ignores them.
Every method below sets the same value: the ID and the update URL joined by a semicolon.
dncgneacahomieionjkaofmfnojlkfmc;https://clients2.google.com/service/update2/crxMicrosoft Edge accepts the Chrome Web Store update URL too, so one value covers both browsers.
Option 1: Microsoft Intune (settings catalog)
- In the Intune admin center go to Devices > Configuration > Create > New policy, platform Windows 10 and later, profile type Settings catalog.
- Click Add settings and search for Configure the list of force-installed apps and extensions. Pick it under Google Chrome > Extensions.
- Turn it on and add the value above as one line.
- For Edge, search for Control which extensions are installed silently under Microsoft Edge > Extensions and add the same value.
- Assign the profile to a device group for the team, not to all devices.
Devices pick it up at the next Intune sync. To speed up a test machine, sync it from Settings > Accounts > Access work or school.
Option 2: Group Policy
- Import the browser's ADMX templates into your central store if they aren't there yet: the Chrome Enterprise policy templates from Google, and the Microsoft Edge policy templates from Microsoft.
- In a GPO linked to the team's computers, open Computer Configuration > Policies > Administrative Templates > Google > Google Chrome > Extensions > Configure the list of force-installed apps and extensions.
- Enable it, click Show and add the value.
- For Edge: Administrative Templates > Microsoft Edge > Extensions > Control which extensions are installed silently.
Run gpupdate /force on a test machine and restart the browser.
Option 3: The registry (one machine, or a script)
Useful for testing before you build a policy, or for an RMM script. Run in an elevated prompt:
reg add "HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist" /v 1 /t REG_SZ /d "dncgneacahomieionjkaofmfnojlkfmc;https://clients2.google.com/service/update2/crx" /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist" /v 1 /t REG_SZ /d "dncgneacahomieionjkaofmfnojlkfmc;https://clients2.google.com/service/update2/crx" /fThe value name is a number. If the key already has entries, use the next free number instead of overwriting 1; that's a common way to remove another team's extension by accident.
Check that it worked
- Open
chrome://policy(oredge://policy), click Reload policies and look forExtensionInstallForcelistwith status OK. - Open
chrome://extensions. The extension shows "Installed by your organization" and has no Remove button. - If the policy shows but the extension doesn't install, the device usually can't reach
clients2.google.comthrough the proxy. Allow it.
Pre-configure the extension's settings
Many extensions read settings from policy too. IOC Triage does: you can set your organisation's domains, the login pages its credential guard should learn, sites to always allow or block, and whether users may click past a warning. The values go under the extension's own policy key:
HKLM\SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\dncgneacahomieionjkaofmfnojlkfmc\policy
HKLM\SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\dncgneacahomieionjkaofmfnojlkfmc\policy| Setting | Type | What it does |
|---|---|---|
corporateDomains | List | Your own domains. Trusted everywhere, and the work password may be typed there. |
corporateLoginDomains | List | Login pages where the credential guard learns the work password, such as ADFS, Okta or a VPN portal. |
allowedDomains / blockedDomains | List | Never flagged / always blocked. |
allowUserBypass | Boolean (DWORD) | 0 stops users from clicking past a block page. |
credentialGuard, pageScanner, webmailScanner | Boolean (DWORD) | Turn each protection feature on (1) or off (0). |
warnThreshold / blockThreshold | Number (DWORD) | Risk scores, 0 to 100, at which a page is warned about or blocked. |
A list is a subkey with the setting's name, holding string values named 1, 2, 3 and so on, the same layout as the force-install list. A boolean or a number is a DWORD directly under policy. Push them with Group Policy Preferences registry items or the same script you use for the force-install key, then check chrome://policy: extension policies appear in their own section.
One click per user is still needed. IOC Triage's lookups work straight after install. Its browsing protection reads the pages people visit, so it starts only after each user clicks Agree and turn on on the welcome page and allows Chrome's prompt. Tell the team before you roll it out, so the prompt doesn't look suspicious.
FAQ
Can users remove a force-installed extension?
No. It has no Remove button, can't be turned off, and is reinstalled if the files are deleted. To remove it, take it out of the policy.
How do updates work?
The browser updates the extension from the Chrome Web Store on its normal schedule, usually within a few hours of a new version being published. You don't need to change the policy.
Does this work on Macs?
Yes, with a configuration profile. The policy names are the same (ExtensionInstallForcelist), delivered through Intune or your Mac management tool.
Can I allow only approved extensions?
Yes. Set ExtensionInstallBlocklist to * and list the approved IDs in ExtensionInstallAllowlist. Force-installed extensions are always allowed. Test it on a pilot group first, because it disables every extension that isn't on the list.
The M365 Posture Scanner signs in read-only and grades the tenant's MFA, admin roles, Conditional Access, app consents and email security, with a client-ready report.
IOC Triage is a free, open-source browser extension for SOC analysts: a verdict from 15 threat-intel sources for any IP, domain, URL or hash, plus phishing protection your admins can pre-configure.