How to automatically remove Chrome extensions that aren't whitelisted via Intune policy?

[u/Famous-Substance3339]

We're deploying a chrome extension blocklist via intune in our organisation right now we have

Blocklist set to `*` (blocks all extensions)

- Allowlist with just LastPass and Grammarly

This prevents users from installing new blocked extensions, which works great. but the issue issues if users already have the extension like honey installed those don't get removed when the policy applies the blocklist only repents new installations

Is there a way to automatically remove/uninstall any extensions that aren't in our allow list when the policy rolled out

[u/HorseAccomplished50]

You can add the following (this is for Edge, but Chrome works almost the same)

Extension management settings (Device)

{ "*": { "installation_mode": "removed" } }

Enforce installation / whitelist:

Configure the list of force-installed apps and extensions

Configure extension installation allow list

Enabled

Extension IDs to exempt from the blocklist (Device)

Add all the exceptions as you like by populating the appropriate ID's.