Forum Discussion
Edge >=150 blocks ALL extensions on *.cloud.microsoft (regression from 149) - no policy override
Starting with Edge 150, a hardcoded extension blocklist applies to *.cloud.microsoft (M365 Copilot and Microsoft 365 app surfaces). Extensions no longer run on these pages. This is a regression - on Edge 149 and earlier it worked fine on the same pages.
The block affects all extensions, not a specific category, and it is not overridable via ExtensionSettings (runtime_allowed_hosts), ExtensionInstallForcelist, or any other policy we have tested. It hits both regular user-installed extensions and admin-approved, force-installed extensions on managed devices - so admins have no way to re-enable trusted extensions on these surfaces either.
Confirmed breakage so far:
- Password managers - verified with Bitwarden (users end up copy/pasting credentials out of the manager on Copilot pages, a real security regression)
- Corporate training / user-adoption extensions
- Accessibility extensions relied on by employees
Ask to the Edge team: restore the pre-150 behavior, or ship an override so extensions can run on *.cloud.microsoft pages (for example, honor runtime_allowed_hosts / the force-install list on these surfaces). If this is by design, please document it clearly so users and admins stop chasing a config that cannot work.
Environment: Edge Stable >=150 (works on 149 and earlier), Windows, both unmanaged and MDM-managed (Intune/GPO). Reproducible on a clean profile with a single extension.
Are other users / admins / extension vendors seeing the same thing after updating to 150? Please add your affected extension below so Microsoft can gauge the blast radius.
10 Replies
From CrowdStrike Falcon Extension, we've found the following:
The Microsoft Edge browser has a security restriction (some introduced in version 143.0+, more in 150+) that prevents browser extensions from running on certain Microsoft website(s). Since Falcon functionality includes extension-based functionality, they will not apply to pages that the browser vendor (Microsoft) has prevented extensions from running in.
The restrictions apply to the following websites:
- m365.cloud.microsoft
- edgeservices.bing.com
- copilot.microsoft.com
- explore.microsoft.com
- www.microsoft365.com
Related to https://github.com/microsoft/MicrosoftEdge-Extensions/issues/644 Bug - Edge Addons] All extensions are blocked on *.cloud.microsoft starting in Edge ≥150 with no override
No enterprise policy override: Unlike runtime_blocked_hosts in the ExtensionSettings policy (which admins can configure), these hardcoded restrictions cannot be overridden not even by runtime_allowed_hosts or force-installed extensions.
No official Edge release notes entry documents the specific domain list impacted by this
Kelly_Y any updates on this? Workarounds? Is blocking extensions the intended behavior by Microsoft or is this truly a bug/issue?
- Kelly_Y
Microsoft
ryanbuening-celina - The fix should be in the latest Beta version 151.0.4129.35 and it is expected to be in Stable 151 when it is released next week. Please test using Beta if possible and let us know if you are still reproducing the issue. Thanks!
I tested with Edge 151 Beta `151.0.4129.35` fixed the issue on m365.cloud.microsoft and forms.cloud.microsoft but the others in my list remain blocked:
edgeservices.bing.com
copilot.microsoft.com
explore.microsoft.com
www.microsoft365.com
- Kelly_Y
Hi Adèle and ryanbuening-celina - I reached out to the team and this is a known issue. It has been added to the Microsoft Edge known issues doc. We will continue to update this doc as details about the fix become available. Thanks!
-Kelly
All of my extensions are getting blocked as well on Edge version 150.0.4078.65 when accessing m365.cloud.microsoft.com. Extensions work on outlook.cloud.microsoft though.
Hi, this is a really good write-up, especially because you already tested the usual policy routes.
If `ExtensionSettings`, force-install, and a clean profile all behave the same way, I would treat this as either an intentional Edge service-side restriction or a regression in the Edge 150 policy handling for those Microsoft 365 surfaces. I do not think this is something an admin can cleanly fix with normal extension policy if Edge is blocking the host before the extension permission model is evaluated.
The most useful next step is to file it through Edge feedback or an enterprise support case with the Edge version, extension IDs, policy export, and a simple repro on `*.cloud.microsoft`. I would also test the same repro on Beta/Dev so you can tell Microsoft whether it is already fixed in a later channel. Short term, the only practical workaround may be documenting the affected extensions and keeping sensitive workflows out of those pages until Microsoft clarifies whether this is by design.
