cwspy.com · July 16, 2026 · 7 min read
Chrome Extensions Under Enterprise Policy: What Changes for Developers
Not every install of your Chrome extension comes from someone finding it in the store. In managed environments — companies, schools, government — extensions are often pushed, allowed, or blocked centrally through Chrome's enterprise policy system, using the ExtensionInstallForcelist, ExtensionInstallAllowlist, and ExtensionInstallBlocklistpolicies. If you have ever seen a user report "installed by enterprise policy" next to your extension, or wondered why an install cannot be removed, this is why.
Can I remove an extension installed by enterprise policy?
Not from the browser itself — this is the most common support question the "installed by enterprise policy" label generates. The ExtensionInstallForcelist policy removes the uninstall option from chrome://extensionsentirely, and no user-facing toggle brings it back. Removal has to happen at the policy level, by whoever manages the organization's Google Admin console — not by the person using the browser. If you are that user and need the extension gone, the request goes to your IT department, not to Chrome's settings.
How enterprise-managed installs differ from a normal store install
| Aspect | Normal install | Enterprise-managed install |
|---|---|---|
| How it happens | User finds the listing and installs it themselves | IT admin pushes it via Google Admin console policy to managed devices |
| Can the user remove it? | Yes, any time | No — it is grayed out with an "installed by enterprise policy" note; only the admin can remove it |
| Does it count toward your public user number? | Yes | Yes — Chrome does not separate the two counts in the public listing figure |
| Does the user see your listing page first? | Usually, yes | Often no — it appears already installed, with no discovery step at all |
For a developer, this matters most in two situations: your own extension is deployed by organizations at scale (common for productivity, security, or collaboration tools), or you are trying to interpret your install and rating numbers and cannot square them with what your marketing efforts would predict.
What changes for a Manifest V3 extension deployed by policy
- Permissions still matter, arguably more. Admins reviewing what to allowlist look closely at requested permissions and host_permissions before approving an extension for their org — an over-broad request can get your extension blocked at the policy level even if end users never see a permission prompt.
- Updates still go through the Chrome Web Store review pipeline — enterprise deployment does not bypass store review, it only bypasses individual user install consent.
- Manifest V2 deprecation applies here too. A forcelisted Manifest V2 extension is subject to the same disabling timeline as anywhere else — if anything, the impact is larger, since it silently affects every managed device at once rather than one user at a time. See our Manifest V2 deprecation guide if that is the situation you are dealing with.
What the policy actually looks like
Admins set this through a JSON-structured policy value in the Google Admin console (or via the Windows registry / macOS configuration profile for unmanaged Chrome). A forcelist entry pairs your extension's store ID with an optional custom update URL:
| Policy | What it does |
|---|---|
| ExtensionInstallForcelist | Installs the extension automatically and prevents removal |
| ExtensionInstallAllowlist | Permits users to install it themselves, blocked otherwise |
| ExtensionInstallBlocklist | Prevents installation entirely, even from the store |
| ExtensionSettings | Newer, more granular policy covering all three plus per-permission controls |
See Google's Chrome Enterprise policy reference for the exact syntax if you are on the admin side of this rather than the developer side.
Why your numbers might not match your marketing
A spike in users with no matching spike in store traffic, reviews, or organic search impressions is a common signature of a large organization forcelisting your extension — not a marketing win you can attribute to anything you did.
If you track your extension's public user count and see growth that does not line up with a launch, a promotion, or a keyword ranking improvement, an enterprise deployment is one of the more likely explanations — worth knowing before you spend time trying to reverse-engineer a growth channel that was never a channel at all.
If you want to be enterprise-friendly on purpose
- Keep permissions minimal and well justified — this is the first thing an IT admin evaluates before allowlisting anything.
- Publish a clear privacy policy and be explicit about data handling; procurement reviews look for this even when individual users never would.
- Maintain a predictable update cadence — unmaintained extensions are a security liability admins actively screen for.
- Stay ahead of platform deprecations like Manifest V2 — an admin who has to explain a sudden mass-disable to their organization is unlikely to allowlist that developer again.