Preventing Chrome and Edge extensions

[athomashayter]

Hello All,

I have been getting a lot of tickets relating to 'kids playing games in lessons' from staff using the IT Suites (why they arent issuing detentions etc for this I dont know..), so far I have managed quite successfully to block the various websites and keywords however now they have cottoned on that they can use browser extensions to get around this and play games.

In Google Admin I have set Devices>Chrome>apps & Extensions>users and browsers> 'Allow/Block mode - Block all apps, admin manages allowlist' and Devices>Chrome>Reports>Apps and Extensions usage - blocking apps here as well. This doesnt seem to be having the desired effect of blocking extensions or preventing access to extensions already installed. I have blocked the URLs for the chrome webstore as well. Any thoughts on why this isnt working? Or advice on how to get rid of user installed extensions?

Equally they are doing the same on Edge browser - is there a GPO or such that can be used to prevent browser extentions or the like?

 

Any and all advice welcome!

 

Kind regards,

Adam

[DaveTheTech]

Hi,

User Config > Admin Templates > MS Edge > Extensions

Allow specific IDs to be installed = abc213 - this is the ID for our web filters extension

 

Control which extensions should be revented = *

 

Its the second you need. If there are any installed, it will block them.

I presume that identical GPOs exist for Chrome

[athomashayter]

Perfect, thank you. Just found the Google one for this as well - exactly the same GPO set up as for Edge

[jthompson]

For Chrome you can also get a GPO option to make it managed by your Workspace tenancy, so that policies set in the cloud take precedence over local policies. That then gives you one place to be managing Chrome rather than two.

 

Can't remember the terminology off the top of my head, but happy to dig it up if you're interested.

 

We're mainly Chrome here, so managed extension allowlist in Google Admin, but just block all extensions in Edge via GPO.