Configuring trusted Microsoft edge extensions for defender application guard via Intune

Question

We've started rolling out Microsoft Defender Application Guard for Microsoft Edge across our finance department because they regularly review emails and websites from external partners before anything reaches the internal network. The security side is working well, but now the team keeps telling us that a few browser add-ons they depend on every day dont appear once Edge opens in the protected environment, and its becoming a real headache for their workflow.

I'm managing these devices through Microsoft Intune and need to know the proper way to configure policy settings so that only a selected list of trusted Microsoft Edge extensions is permitted to run inside the Application Guard container. Which Intune configuration should be used to make those approved extensions available without weakening the isolation provided by Application Guard?

Answer 1

Hi Ezreal,

By design, Application Guard isolates the browsing session, so extensions are blocked unless explicitly trusted and deployed through policy.

The supported way to configure this is via Intune Administrative Templates for Microsoft Edge. In Intune, you’ll find the policy setting called “Allow specific extensions to be installed”. Here you can list the extension IDs of the trusted add-ons your finance team depends on. Once applied, those extensions will be permitted to run inside the Application Guard environment while everything else remains blocked.

Best practice is to scope this policy only to the device groups that require the extensions, so you maintain strict isolation elsewhere. Also, make sure the extensions come from the Microsoft Edge Add-ons store, since Application Guard will only allow trusted sources.

I hope the response provided some helpful insight. If you find this answer useful, please hit “accept answer” so I know it addressed your concern.

Jason.