GPO for "Allow extensions from other store"

[michaelketting]

You can manually enable the option to get extensions from other stores.
https://techcommunity.microsoft.com/t5/Discussions/Extensions-Chrome-or-Microsoft-Store/m-p/469515/h...

Is this feature configurable via a GPO?
https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-policies
I've looked through the list and tried to find information via a web search but didn't find anything about this particular option.

Thanks, Michael

[#2]

@michaelketting I was just about to ask the same question, as I can't find a GPO setting for this either, and we would also really like to see a GPO (and Intune setting) to enable this automatically for our users.  

We already have a list of whitelisted Chrome Extensions that we have approved, so we know users will be installing some.  

For us, this would be a "nice to have" to improve the user experience.  Thanks!

[#3]

Thanks @SteveSta and @michaelketting 

At the moment, we do not have this GPO. Thanks for highlighting this. We will review this request and get back to you. 

[#4]

I'm looking for the same. Having enforced extensions without being able enabling the store also would be pointless and is one of the reasons I hold of deploying it in our company.
Please provide a GPO (or registry).

[#5]

@michaelketting : For me that would be also a very good option. At the moment, i disabled all extensions with an exception to those, i allow. With that, installation from other store are not possible. I know, workaround, but for me, it works so far.

[#6]

@disler 

not so sure what kind of workaround works for you now?

As long as it isn't enabled manually, by the user,  no extensions will be available, including the forced ones. That's basically why that GPO is required.

[#7]

@janusro1 

Yikes, that's not something I even thought about or tested.  With Google Chrome, we do have a couple of forced extensions set up, and I know we will need to carry at least one over to New Edge once we deploy that.  If the forced extensions won't work without the user manually enabling extensions from other stores, that could be a show stopper for us when it comes to getting users to move from Chrome to New Edge.  Has anyone already tested this?  If not, I can later.

[#8 · Accepted solution]

@SteveSta 

Forced extensions work without to opt-in the toggle. I tried twice with new profiles from the chrome store. I used the same gpo settings from Chrome to Edge

[#9]

@Shaecky  you are correct. Using the GPO Setting "Control which extensions are installed silently" allows you to push Chrome extensions without needing the setting manually configured. 

[#10]

@janusro1 Force installed extensions do not require the setting "Allow extensions from other stores" hence having this policy is not a blocker for enterprise installed extensions.

Let me know if you have any further questions 

[#11]

@ashishpoddar 

good to know.

Any news on enabling the store in general by GPO?

[#12]

@ashishpoddar Thank you for providing this information.

Is there a way to self-host the extensions that i want to force-install? I want to implement an extension in an air-gapped network where the extension stores aren't available.

Unfortunately, the documentation is incomplete in that regard.

[#13]

Not yet, it is still not prioritized. Currently we are looking to sync this setting so that it works seamlessly against multiple devices. That feature should be launched along with Extensions sync. 

[#14]

@smokie128 We are yet to update our documentation for the same. However the Chromium guidelines apply.  Here are some high level pointers. 

• Create crx file of extension and host it to shared directory (manifest.json file of extension should not contain "key" attribute and should have update_url attribute pointing to correct place). The shared location should not require any authentication else force install will fail. 
• Creates updates.xml file with crx file hosted url, version and extension id. (Check this link for details: (https://developer.chrome.com/apps/autoupdate)
• Set up extensionInstallsources policy to whitelist hosted url. (https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-policies#extensions)
• Set up extenionInstallForcelist policy to forceinstall extension. (https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-policies#extensions)

Let me know if this works. 

[#15]

@giovannimyles @Shaecky 

Sorry to dig up an old thread but i'm not getting the same experience as you guys when trying to install a chrome extension using "Control which extensions are installed silently"

First, what i'm doing:

Grabbing the extension ID from the URL in the Chrome Web Store.

Opening the 'Control which extensions are installed silently' setting - this is enabled.

Entering the extension ID in the list of 'Extension/App IDs and update URLs to be silently installed.'

None of the other settings inside User Configuration\Administrative Templates\Microsoft Edge\Extensions are configured.

Am i missing something?

Edge Version: Stable 81.0.416.58 

[#16]

@elltommo Apologies for the delayed response. If you are still looking for an answer - here it is. 

Use the following format to add an extension to the list:

[extensionID];[updateURL]

• extensionID - the 32-letter string found on edge://extensions when in developer mode.

• updateURL (optional) is the address of the Update Manifest XML document for the app or extension. If you don't set the updateURL, it is assumed that the extension belongs to Microsoft Store. If you want to install an extension from the Chrome Web Store, please provide the Chrome Web Store update URL: https://clients2.google.com/service/update2/crx  

Example:

ndjpnladcallmjemlbaebfadecfhkepb;https://clients2.google.com/service/update2/crx 

[#17]

Any update on this or response from Microsoft? Also looking for a GPO to control this.

[#18]

@ashishpoddar 

I was able to get everything working as intended in this way.

Anyone else doing this should be aware that this changes the extension ID's, which can lead to problems with extensions that use Native Messaging (e.g. KeePassXC-Browser) - in this case you'd have to add the correct extension ID into the Native Messaging JSON file as an allowed source.

[#19]

@smokie128  Glad to know. 

I didnt understand what you mean by "Anyone else doing this should be aware that this changes the extension ID's"

[#20]

@kqf_chris It's in the backlog and prioritized for Edge 88.