Prevent turning off required extensions
Verified with Windows 11 25H2 — updated on July 30, 2026
Supported on: Microsoft Edge on Windows 10, Version 1809 or later
Path in the GPO console
Computer Configuration\Administrative Templates\Windows Components\Microsoft Edge User Configuration\Administrative Templates\Windows Components\Microsoft Edge Description
You can define a list of extensions in Microsoft Edge that users cannot turn off. You must deploy extensions through any available enterprise deployment channel, such as Microsoft Intune. When you enable this policy, users cannot uninstall extensions from their computer, but they can configure options for extensions defined in this policy, such as allow for InPrivate browsing. Any additional permissions requested by future updates of the extension gets granted automatically. When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe;Microsoft.OfficeOnline_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and Office Online extension. When enabled, removing extensions from the list does not uninstall the extension from the user’s computer automatically. To uninstall the extension, use any available enterprise deployment channel. If you enable the Allow Developer Tools policy, then this policy does not prevent users from debugging and altering the logic on an extension. If disabled or not configured, extensions defined as part of this policy get ignored. Default setting: Disabled or not configured Related policies: Allow Developer Tools Related Documents: - Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/en-us/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn) - How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/en-us/intune/windows-store-for-business) - How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/en-us/intune/apps-deploy) - Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/en-us/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) - How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/en-us/intune/lob-apps-windows)
Registry
Software\Policies\Microsoft\MicrosoftEdge\Extensions Software\Policies\Microsoft\MicrosoftEdge\Extensions MDM / Intune (CSP)
./Device/Vendor/MSFT/Policy/Config/Browser/PreventTurningOffRequiredExtensions ./User/Vendor/MSFT/Policy/Config/Browser/PreventTurningOffRequiredExtensions Microsoft Learn documentation Mapping data: Microsoft Learn (CC BY 4.0)
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
Applying both scopes creates an ambiguous configuration (computer takes precedence over user). Only do this intentionally.
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Prevent turning off required extensions
; State: Enabled
; Scope: Computer (HKLM)
; Supported on: Microsoft Edge on Windows 10, Version 1809 or later
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\MicrosoftEdge\Extensions]
"PreventTurningOffRequiredExtensions"=""More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Prevent turning off required extensions
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: Microsoft Edge on Windows 10, Version 1809 or later
$path = 'HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Extensions'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'PreventTurningOffRequiredExtensions' -Value '' -Type StringIntune XML
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/Browser/PreventTurningOffRequiredExtensions
Data type: String
Value:
<enabled/>
<data id="PreventTurningOffRequiredExtensions_Prompt" value=""/>Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Prevent turning off required extensions
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: Microsoft Edge on Windows 10, Version 1809 or later
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Extensions' -Name 'PreventTurningOffRequiredExtensions' -Expected '' -Kind String)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Prevent turning off required extensions
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: Microsoft Edge on Windows 10, Version 1809 or later
$path = 'HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Extensions'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'PreventTurningOffRequiredExtensions' -Value '' -Type StringSCCM scripts
# Exported from gporais.com
# Policy: Prevent turning off required extensions
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: Microsoft Edge on Windows 10, Version 1809 or later
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Prevent turning off required extensions
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: Microsoft Edge on Windows 10, Version 1809 or later
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Extensions' -Name 'PreventTurningOffRequiredExtensions' -Expected '' -Kind String)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Prevent turning off required extensions
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: Microsoft Edge on Windows 10, Version 1809 or later
$path = 'HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Extensions'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'PreventTurningOffRequiredExtensions' -Value '' -Type StringBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.