iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To block external extensions in Google Chrome, use Google’s External extensions control on a managed browser. For a broader default-deny policy that also blocks Chrome Web Store extensions unless approved, configure ExtensionSettings with a blocked default and extension-ID exceptions. The right option depends on how Chrome is managed and the operating system.
What Google means by an “external extension”
Google defines an external extension as “any extension that is not installed from the Chrome Web Store.” Its External extensions control is intended to block installation of extensions from outside that store. Google lists the control for managed Chrome on Windows, macOS, and Linux, and for Android devices; the Android qualification is Chrome running on ChromeOS, not Android apps generally. Google’s policy overview describes the setting and its platform scope.
Choose the policy that matches your goal
| Approach | What it restricts | Exceptions and considerations |
|---|---|---|
| External extensions | Extensions installed from outside the Chrome Web Store. | Most direct match for blocking external extensions. Availability depends on the platform and management method; Google does not establish that it is available in every setup. |
ExtensionSettings default block |
All extension installations by default, including from the Chrome Web Store. | Set the * default installation mode to blocked, then set approved extension IDs to allowed. Google documents this policy and its interaction with older extension policies on Windows. ExtensionSettings policy reference |
These are related administration routes, not guaranteed equivalents in every managed environment. Use the dedicated setting when the requirement is specifically to stop extensions from outside the Web Store. Use default block with ID-based exceptions when the organization wants to control all installations.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteApply the restriction in managed Chrome
Before changing policy
- Identify whether the target is a managed browser or a managed user, and record the operating system.
- Determine whether policies are delivered through the Google Admin console or local enterprise policy such as Windows Group Policy.
- Check existing extension policies before adding a new one. On Windows, Google says
ExtensionSettingsoverrides several legacy extension policies, including install blocklist, force-install list, install sources, and allowlist settings. Google’s Windows policy guidance
Use Google Admin console
- In the Admin console, open the Apps & extensions area for managed Chrome.
- Select the organizational unit or group that should receive the restriction.
- Apply the External extensions control to block installation outside the Chrome Web Store. If the intended rule is default-deny, configure
ExtensionSettingsso*isblocked, then add anallowedrule for each approved extension ID. - Test the configuration on a small organizational unit before applying it broadly. Google’s Chrome policy management guidance covers scoping and policy verification.
Use Windows Group Policy
- Ensure the current Google Chrome policy templates are available to Group Policy.
- Open the Google Chrome Extensions section and locate Extension management settings.
- Enter compact JSON for the intended
ExtensionSettingsrules. For a default-deny setup, use*with installation modeblocked, then define approved extension IDs with installation modeallowed. - Apply the policy to a test group, reload policies, and verify the resulting value in Chrome before widening deployment. Google’s Windows instructions describe the policy format and precedence.
Policy interfaces can vary by management method and Chrome version. Follow the current Google guidance for the policy surface available to your organization rather than assuming every UI exposes identical controls.
#1 Best Overall
- FOR HOME, WORK, & SCHOOL – With an Intel processor, 14-inch display, custom-tuned stereo speakers, and long battery life, this Chromebook laptop lets you knock out any assignment or binge-watch your favorite shows.
- HD DISPLAY, PORTABLE DESIGN – See every bit of detail on this micro-edge, anti-glare, 14-inch HD (1366 x 768) display (1); easily take this thin and lightweight laptop PC from room to room, on trips, or in a backpack.
- ALL-DAY PERFORMANCE – Reliably tackle all your assignments at once with the quad-core, Intel Celeron N4120—the perfect processor for performance, power consumption, and value (2).
- 4K READY – Smoothly stream 4K content and play your favorite next-gen games with Intel UHD Graphics 600 (3) (4).
- MEMORY AND STORAGE – Enjoy a boost to your system’s performance with 4 GB of RAM while saving more of your favorite memories with 64 GB of reliable flash-based eMMC storage (5).
Verify that Chrome received the policy
- On a managed Chrome browser, open
chrome://policy. - Reload policies from the page, then find
ExtensionSettingsor the relevant external-extension policy. - Check the displayed status and value against the intended configuration. For a default-deny setup, confirm the wildcard rule is blocked and that approved extension IDs have the intended exception.
- Test the result with a user in the scoped group. Google recommends checking policy status and value after reloading policies. Policy rollout and verification guidance
Do not confuse installation blocking with related policies
install_sourceslimits which URLs can initiate installation. Google notes that both the CRX download location and the page referring to it must be allowed; it is not the same as blocking every outside-store extension.blocked_permissionsprevents extensions requesting specified permissions. It can also stop an already installed extension from loading if that extension requires a blocked permission.runtime_blocked_hostsrestricts an extension’s interaction with named websites. It does not prevent the extension from being installed or removed.
These controls and their distinct effects are documented in Google’s extension policy guidance and ExtensionSettings reference.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When an extension must be installed by policy
Blocking installations is different from force-installing an extension. With force-installation, users cannot disable or remove the extension. Google also warns that a force-installed extension receives access to information on the device, so review the extension before imposing it. When configuring a force-installed or normal-installed extension, specify its download location; Google identifies https://clients2.google.com/service/update2/crx for Chrome Web Store extensions. Google’s extension policy instructions
Rank #2
- TWEIGHT 2-in-1 DESIGN At just under 3 pounds, the Chromebook Plus is incredibly lightweight. You can easily fold it into tablet mode for comfortable viewing and browsing
- BUILT-IN PEN Experience the power of the incredibly precise built-in pen that never needs charging. It's always ready to write, sketch, edit, magnify and even take screenshots
- DUAL CAMERA Fold your laptop into tablet mode to capture clear shots and even zoom in for a closer look with the revolutionary 13MP world-facing camera with autofocus
- CHROME OS AND GOOGLE PLAY STORE Create, explore and browse on a bigger screen with the tools you use every day —all on the secure Chrome OS
- POWER AND PERFORMANCE Tackle anything with a long-lasting battery and Intel Celeron processor. Store more with 64GB of built-in memory and add up to 400GB with a microSD card.Bluetooth v4.0
What about a personal, unmanaged Chrome installation?
The documented controls above are enterprise policies for managed Chrome. Google’s reviewed documentation does not establish a universal centrally enforced procedure for an unmanaged personal installation. If Chrome is managed by an organization, ask its administrator which policy applies; otherwise, do not assume an enterprise setting can be applied through the same steps on a personal browser.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
