Allow Sideloading of extension
Verified with Windows 11 25H2 — updated on July 30, 2026
Supported on: Microsoft Edge on Windows 10, Version 1809 or later
Path in the GPO console
Computer Configuration\Administrative Templates\Windows Components\Microsoft Edge User Configuration\Administrative Templates\Windows Components\Microsoft Edge Description
Sideloading installs and runs unverified extensions in Microsoft Edge. With this policy, you can specify whether unverified extensions can be sideloaded in Microsoft Edge. If enabled or not configured, sideloading of unverified extensions in Microsoft Edge is allowed. If disabled, sideloading of unverified extensions in Microsoft Edge is not allowed. Extensions can be installed only through Microsoft store (including a store for business), enterprise storefront (such as Company Portal) or PowerShell (using Add-AppxPackage). When disabled, this policy does not prevent sideloading of extensions using Add-AppxPackage via PowerShell. To prevent this, in Group Policy Editor, enable Allows development of Windows Store apps and installing them from an integrated development environment (IDE), which is located at: Computer Configuration > Administrative Templates > Windows Components > App Package Deployment Supported versions: Microsoft Edge on Windows 10, version 1809 Default setting: Disabled or not configured Related policies: - Allows development of Windows Store apps and installing them from an integrated development environment (IDE) - Allow all trusted apps to install
Registry
Software\Policies\Microsoft\MicrosoftEdge\Extensions Software\Policies\Microsoft\MicrosoftEdge\Extensions Value name: AllowSideloadingOfExtensions
Enabled: AllowSideloadingOfExtensions = 1
Disabled: AllowSideloadingOfExtensions = 0
MDM / Intune (CSP)
./Device/Vendor/MSFT/Policy/Config/Browser/AllowSideloadingOfExtensions ./User/Vendor/MSFT/Policy/Config/Browser/AllowSideloadingOfExtensions Microsoft Learn documentation Mapping data: Microsoft Learn (CC BY 4.0)
CSP values
-
0- Prevented/Not allowed. Disabling doesn't prevent sideloading of extensions using Add-AppxPackage via Powershell. To prevent this, set the ApplicationManagement/AllowDeveloperUnlock policy to 1 (enabled). -
1 (Default)- Allowed.
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
Applying both scopes creates an ambiguous configuration (computer takes precedence over user). Only do this intentionally.
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Allow Sideloading of extension
; State: Enabled
; Scope: Computer (HKLM)
; Supported on: Microsoft Edge on Windows 10, Version 1809 or later
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\MicrosoftEdge\Extensions]
"AllowSideloadingOfExtensions"=dword:00000001More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Allow Sideloading of extension
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: Microsoft Edge on Windows 10, Version 1809 or later
$path = 'HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Extensions'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'AllowSideloadingOfExtensions' -Value 1 -Type DWordIntune XML
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/Browser/AllowSideloadingOfExtensions
Data type: String
Value:
<enabled/>Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Allow Sideloading of extension
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: Microsoft Edge on Windows 10, Version 1809 or later
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Extensions' -Name 'AllowSideloadingOfExtensions' -Expected 1 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Allow Sideloading of extension
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: Microsoft Edge on Windows 10, Version 1809 or later
$path = 'HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Extensions'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'AllowSideloadingOfExtensions' -Value 1 -Type DWordSCCM scripts
# Exported from gporais.com
# Policy: Allow Sideloading of extension
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: Microsoft Edge on Windows 10, Version 1809 or later
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Allow Sideloading of extension
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: Microsoft Edge on Windows 10, Version 1809 or later
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Extensions' -Name 'AllowSideloadingOfExtensions' -Expected 1 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Allow Sideloading of extension
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: Microsoft Edge on Windows 10, Version 1809 or later
$path = 'HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Extensions'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'AllowSideloadingOfExtensions' -Value 1 -Type DWordBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.