Block Chrome extensions by Intune

Question

Hi!

I am working with the ADMX Chrome polices and, for exemple, "disable notifications" is working fine for all my users. In other hand I tried to deploy the "block extensions" and I always have errors when I try to assing the policies to my users. Anyone have any idea??

This is the two policies that I tried:

Name: ExtensionInstallBlacklist
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/Chrome~Policy~googlechrome~Extensions/ExtensionInstallBlacklist
Data type: String
Value: <enabled/> <data id="ExtensionInstallBlacklistDesc" value="1*"/>

Name: ExtensionInstallWhitelist
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/Chrome~Policy~googlechrome~Extensions/ExtensionInstallWhitelist
Data type: String
Value: <enabled/> <data id="ExtensionInstallWhitelistDesc" value="1ppnbnpeolgkicgegkbkbjmhlideopiji2bkbeeeffjjeopflfhgeknacdieedcoml3cfhdojbkjhnklbpkdaibdccddilifddb4hdokiejnpimakedhajhdlcegeplioahd"/>

The Chrome ADMX ingestion I uploaded is the 64 bits with that versions: <!--chrome version: 90.0.4430.0--> / <!--chrome version: 89.0.4389.90-->, both with the same result.

This is the ADMX part of extensions in that file:

<policy class="Both" displayName="$(string.ExtensionInstallBlacklist)" explainText="$(string.ExtensionInstallBlacklist_Explain)" key="Software\Policies\Google\Chrome" name="ExtensionInstallBlacklist" presentation="$(presentation.ExtensionInstallBlacklist)">
<parentCategory ref="DeprecatedPolicies"/>
<supportedOn ref="SUPPORTED_WIN7"/>
<elements>
<list id="ExtensionInstallBlacklistDesc" key="Software\Policies\Google\Chrome\ExtensionInstallBlacklist" valuePrefix=""/>
</elements>
</policy>
<policy class="Both" displayName="$(string.ExtensionInstallWhitelist)" explainText="$(string.ExtensionInstallWhitelist_Explain)" key="Software\Policies\Google\Chrome" name="ExtensionInstallWhitelist" presentation="$(presentation.ExtensionInstallWhitelist)">
<parentCategory ref="DeprecatedPolicies"/>
<supportedOn ref="SUPPORTED_WIN7"/>
<elements>
<list id="ExtensionInstallWhitelistDesc" key="Software\Policies\Google\Chrome\ExtensionInstallWhitelist" valuePrefix=""/>
</elements>
</policy>

Thanks!

Answer 1

Finally, is working fine with the policies updated, actually all extensions are disabled and users can't activate new ones, here the correct code:

Name: ExtensionInstallBlocklist
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/Chrome~Policy~googlechrome~Extensions/ExtensionInstallBlocklist
Data type: String
Value: <enabled/> <data id="ExtensionInstallBlocklistDesc" value="1*"/>

Name: ExtensionInstallAllowlist
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/Chrome~Policy~googlechrome~Extensions/ExtensionInstallAllowlist
Data type: String
Value: <enabled/> <data id="ExtensionInstallAllowlistDesc" value="1ppnbnpeolgkicgegkbkbjmhlideopiji2bkbeeeffjjeopflfhgeknacdieedcoml3cfhdojbkjhnklbpkdaibdccddilifddb4hdokiejnpimakedhajhdlcegeplioahd"/>

Answer 2

anonymous user Thanks for posting in our Q&A.

For this issue, I checked the "chrome.admx" file and I find that the ExtensionInstallBlacklist and ExtensionInstallWhitelist are under DeprecatedPolicies, not Extensions.

So I try to deploy "OMA-URI:./Device/Vendor/MSFT/Policy/Config/Chrome~Policy~googlechrome~DeprecatedPolicies/ExtensionInstallBlacklist" to my group. It is deployed successfully. However, because of the two are deprecated, it seems have some problem in use.

Given this situation, it is suggested to feedback in chrome. The "chrome.admx" file is provided by chrome and then intune will create custom profile according to the "chrome.admx" file.

Thanks for understanding and have a nice day.

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

Yes, I didn't see the depracated label. I checked the file again and I saw the another part of code that suposed has the new extensions policies:

 <policy class="Both" displayName="$(string.ExtensionInstallAllowlist)" explainText="$(string.ExtensionInstallAllowlist_Explain)" key="Software\Policies\Google\Chrome" name="ExtensionInstallAllowlist" presentation="$(presentation.ExtensionInstallAllowlist)">
      <parentCategory ref="Extensions"/>
      <supportedOn ref="SUPPORTED_WIN7"/>
      <elements>
        <list id="ExtensionInstallAllowlistDesc" key="Software\Policies\Google\Chrome\ExtensionInstallAllowlist" valuePrefix=""/>
      </elements>
    </policy>
    <policy class="Both" displayName="$(string.ExtensionInstallBlocklist)" explainText="$(string.ExtensionInstallBlocklist_Explain)" key="Software\Policies\Google\Chrome" name="ExtensionInstallBlocklist" presentation="$(presentation.ExtensionInstallBlocklist)">
      <parentCategory ref="Extensions"/>
      <supportedOn ref="SUPPORTED_WIN7"/>
      <elements>
        <list id="ExtensionInstallBlocklistDesc" key="Software\Policies\Google\Chrome\ExtensionInstallBlocklist" valuePrefix=""/>
      </elements>

I'm gonna check it and feeback here, however is there an alternative option to do it with Intune? thanks!

Answer 4

Hi anonymous user did you ever manage to resolve this. I've lost several hours of my life trying many variations for both
ExtensionInstallForcelistDesc
ExtensionInstallAllowlistDesc

Neither are working for me. Here's the formatting I've been trying. Any thoughts?

./Device/Vendor/MSFT/Policy/Config/Chrome~Policy~googlechrome~Extensions/ExtensionInstallForcelist
<data id="ExtensionInstallForcelistDesc" value="1bkbeeeffjjeopflfhgeknacdieedcoml;https://clients2.google.com/service/update2/crx2nngceckbapebfimnlniiiahkandclblb;https://clients2.google.com/service/update2/crx3ppnbnpeolgkicgegkbkbjmhlideopiji;https://clients2.google.com/service/update2/crx"/>

./Device/Vendor/MSFT/Policy/Config/Chrome~Policy~googlechrome~Extensions/ExtensionInstallAllowlist
<data id="ExtensionInstallAllowlistDesc" value="1bkbeeeffjjeopflfhgeknacdieedcoml2nngceckbapebfimnlniiiahkandclblb3ppnbnpeolgkicgegkbkbjmhlideopiji"/>

Answer 5

Hey all

I solved this using the following OMA-URL just replace the guid with your own extensions. I've put one in bold as an example.

./Device/Vendor/MSFT/Policy/Config/Chrome~Policy~googlechrome~Extensions/ExtensionInstallForcelist

<enabled/>
<data id="ExtensionInstallForcelistDesc" value="1bkbeeeffjjeopflfhgeknacdieedcoml;https://clients2.google.com/service/update2/crx2nngceckbapebfimnlniiiahkandclblb;https://clients2.google.com/service/update2/crx3ppnbnpeolgkicgegkbkbjmhlideopiji;https://clients2.google.com/service/update2/crx"/>