Prevent turning off required extensions (Windows 11 Group Policy)

What it does

You can define a list of extensions in Microsoft Edge that users cannot turn off. You must deploy extensions through any available enterprise deployment channel, such as Microsoft Intune. When you enable this policy, users cannot uninstall extensions from their computer, but they can configure options for extensions defined in this policy, such as allow for InPrivate browsing. Any additional permissions requested by future updates of the extension gets granted automatically. When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe;Microsoft.OfficeOnline_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and Office Online extension. When enabled, removing extensions from the list does not uninstall the extension from the user’s computer automatically. To uninstall the extension, use any available enterprise deployment channel. If you enable the Allow Developer Tools policy, then this policy does not prevent users from debugging and altering the logic on an extension. If disabled or not configured, extensions defined as part of this policy get ignored. Default setting: Disabled or not configured Related policies: Allow Developer Tools Related Documents: - Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/en-us/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn) - How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/en-us/intune/windows-store-for-business) - How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/en-us/intune/apps-deploy) - Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/en-us/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) - How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/en-us/intune/lob-apps-windows)

What it writes

Hive: HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER
Registry key: Software\Policies\Microsoft\MicrosoftEdge\Extensions

In Intune

Native Intune setting: Yes — Policy CSP

./Device/Vendor/MSFT/Policy/Config/Browser/PreventTurningOffRequiredExtensionsBrowser on Microsoft LearnSets the option “In the space below, enter extension package family names (PFNs) separated by semi-colons.”.Windows builds listed: 10.0.17763.
./User/Vendor/MSFT/Policy/Config/Browser/PreventTurningOffRequiredExtensionsBrowser on Microsoft LearnSets the option “In the space below, enter extension package family names (PFNs) separated by semi-colons.”.Windows builds listed: 10.0.17763.

From Microsoft's Policy CSP DDF files (DDF v2 Files, February 2026), read 18 Oct 2026.

Options

Option	Type	Registry value	Allowed values
In the space below, enter extension package family names (PFNs) separated by semi-colons.Required	Text	`PreventTurningOffRequiredExtensions`	Up to 2048 characters

Configure and deploy

Choose a state and the option values; the output below is generated from the template for exactly that.

Fix the highlighted options to generate output.

History 5 retained releases

22H2 · 1.015 Jul 2024
- Already present in the first release ChangeIntel keeps.

4 later releases left it unchanged.

Template

Internal name: PreventTurningOffRequiredExtensions
Namespace: Microsoft.Policies.MicrosoftEdge
Template file: MicrosoftEdge.admx
Release: Windows 11 25H2 · 1.0 · file set de4e49983ebd651f…

Definition, editor controls and support

Definition

<policy class="Both" displayName="$(string.PreventTurningOffRequiredExtensions)" explainText="$(string.PreventTurningOffRequiredExtensions_Explain)" key="Software\Policies\Microsoft\MicrosoftEdge\Extensions" name="PreventTurningOffRequiredExtensions" presentation="$(presentation.PreventTurningOffRequiredExtensions_Presentation)" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.MicrosoftEdge:MicrosoftEdge" />
      <supportedOn ref="Microsoft.Policies.MicrosoftEdge:SUPPORTED_INTERNET_BROWSER_RS5" />
      <elements>
        <text id="PreventTurningOffRequiredExtensions_Prompt" maxLength="2048" required="true" valueName="PreventTurningOffRequiredExtensions" />
      </elements>
    </policy>

Editor controls

<presentation id="PreventTurningOffRequiredExtensions_Presentation" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
          <textBox refId="PreventTurningOffRequiredExtensions_Prompt">
              <label>In the space below, enter extension package family names (PFNs) separated by semi-colons.</label>
          </textBox>
      </presentation>

Supported platforms and category

Microsoft.Policies.MicrosoftEdge:category:MicrosoftEdge
<category displayName="$(string.InternetBrowser_DisplayName)" explainText="$(string.InternetBrowser_ExplainCat)" name="MicrosoftEdge" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Windows:WindowsComponents" />
    </category>
Microsoft.Policies.MicrosoftEdge:definition:SUPPORTED_INTERNET_BROWSER_RS5
<definition displayName="$(string.SUPPORTED_INTERNET_BROWSER_RS5_DisplayName)" name="SUPPORTED_INTERNET_BROWSER_RS5" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <or>
          <range maxVersionIndex="1" minVersionIndex="1" ref="unresolved(products):MicrosoftEdge" />
        </or>
      </definition>
Microsoft.Policies.MicrosoftEdge:unresolved:unresolved(products):MicrosoftEdge
<unresolved reference="unresolved(products):MicrosoftEdge" />
Microsoft.Policies.Windows:category:WindowsComponents
<category displayName="$(string.WindowsComponents)" explainText="$(string.WindowsComponents_Help)" name="WindowsComponents" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
Microsoft.Policies.MicrosoftEdge:category:MicrosoftEdge
<category displayName="$(string.InternetBrowser_DisplayName)" explainText="$(string.InternetBrowser_ExplainCat)" name="MicrosoftEdge" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Windows:WindowsComponents" />
    </category>
<strings><string id="Microsoft.Policies.MicrosoftEdge:InternetBrowser_DisplayName">Microsoft Edge</string><string id="Microsoft.Policies.MicrosoftEdge:InternetBrowser_ExplainCat">Microsoft Edge Category</string></strings>
Microsoft.Policies.MicrosoftEdge:definition:SUPPORTED_INTERNET_BROWSER_RS5
<definition displayName="$(string.SUPPORTED_INTERNET_BROWSER_RS5_DisplayName)" name="SUPPORTED_INTERNET_BROWSER_RS5" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <or>
          <range maxVersionIndex="1" minVersionIndex="1" ref="unresolved(products):MicrosoftEdge" />
        </or>
      </definition>
<strings><string id="Microsoft.Policies.MicrosoftEdge:SUPPORTED_INTERNET_BROWSER_RS5_DisplayName">Microsoft Edge on Windows 10, Version 1809 or later</string></strings>
Microsoft.Policies.Windows:category:WindowsComponents
<category displayName="$(string.WindowsComponents)" explainText="$(string.WindowsComponents_Help)" name="WindowsComponents" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
<strings><string id="Microsoft.Policies.Windows:WindowsComponents">Windows Components</string><string id="Microsoft.Policies.Windows:WindowsComponents_Help">Contains settings for operating system components.</string></strings>