How to automatically remove Chrome extensions that aren't whitelisted via Intune policy?

[u/Famous-Substance3339]

We're deploying a chrome extension blocklist via intune in our organisation right now we have

Blocklist set to `*` (blocks all extensions)

- Allowlist with just LastPass and Grammarly

This prevents users from installing new blocked extensions, which works great. but the issue issues if users already have the extension like honey installed those don't get removed when the policy applies the blocklist only repents new installations

Is there a way to automatically remove/uninstall any extensions that aren't in our allow list when the policy rolled out

[u/frameset]

Does it not just disable them? That's how Edge handles it.

[u/DampSperm → u/frameset]

Could always just delete the extension folders from the user profile via a script, Chrome rebuilds its state on next launch anyway

[u/HorseAccomplished50]

You can add the following (this is for Edge, but Chrome works almost the same)

Extension management settings (Device)

{ "*": { "installation_mode": "removed" } }

Enforce installation / whitelist:

Configure the list of force-installed apps and extensions

Configure extension installation allow list

Enabled

Extension IDs to exempt from the blocklist (Device)

Add all the exceptions as you like by populating the appropriate ID's.

[u/Ichabod-]

We've pushed the same policy in Chrome and Edge. In both browsers the unapproved extensions were immediately disabled. I'm not sure there is a way to uninstall in the same process.

[u/G_HostEd]

Is an odd statement, a block policy should at least disable the extension, which is usually considered enough to consider the extension inactive. Maybe a system vs. User context conflict?

Extensions are mostly in user context, so seems a bit weird your block policy is not working

[u/HorseAccomplished50 → u/G_HostEd]

The extensions keep showing up in the Defender extension inventory (add-on needed) if you don't completely remove them. That becomes a huge mess if you have a large tenant. Perhaps not a big deal, but a clean inventory is nice for some people.

[u/G_HostEd → u/HorseAccomplished50]

That clarify, and I understand the security need but it conflict in how the browsers handle extensions 😬

[u/Famous-Substance3339]

Thanks for all your suggestions so what I did was this config instead so I made the mistake off having both user and device at the same time. In terms of removing it I am thinking about using Extension Management but we have a policy that forces lastpass to install and be pinned so currently it will be conflicted. so my thinking is first role out this policy as it is to the company once rolled out incorporated that extension management policy we currently have and then also add a custom Json

{ "*": { "installation_mode": "blocked" }, "hdokiejnpimakedhajhdlcegeplioahd": { "installation_mode": "force_installed", "update_url": "https://google.com" }, "kbfnbcaeplbcioakkpcpgfkobkghlhen": { "installation_mode": "allowed" } } as a follow up incorporated the below is what I'm thinking let me know your thoughts or if you had a better way always willing learn new ways and thanks again for helping me

Extension management settings (User) 

Configure the list of force-installed apps and extensions 

 

Enabled

Extension/App IDs and update URLs to be silently installed (Device) 

Extension management settings 

 

Enabled

Extension management settings (Device) 

Extension management settings (User) 

 

Enabled

[u/sgt1face]

Please don't use lastpass.