What a browser extension can and can't control in access management

A browser extension has a fixed reach. It works inside the browser where it’s installed, on the sites it’s allowed to run on. The password fill-in that identity providers offer works within that reach, and so do tools that sign people in without showing them the password.

What a browser extension is

Google’s developer documentation describes Chrome extensions as additions that change the browser’s interface, watch for events in the browser and change web pages. They’re written with the same tools as websites: HTML, CSS and JavaScript.

An extension has three main parts. Content scripts run inside the web page you’re viewing. A background part, which Google calls the service worker, responds to browser events but can’t touch the page itself. The toolbar button can run code or open a small pop-up window when you click it.

What an extension can do on a page

Most of what matters for access control happens in content scripts. Chrome’s documentation says they can read the pages the browser visits, change them, and pass what they find back to the extension. In practice, that gives an extension four abilities:

• Read the page, such as finding the username and password fields on a sign-in screen.
• Fill in or change the page, such as entering a username and password and submitting them, or hiding a download button.
• Run only on chosen sites. The extension lists the web addresses where its content scripts run, so it can be limited to the sign-in pages of the services your company picks.
• React to what happens in the browser, through the background part.

Content scripts run in what Google calls an isolated world, a private space that the page and other extensions can’t reach. The extension’s manifest, its settings file, declares the permissions it uses. Host permissions are the ones that let it work with sites whose addresses match a pattern. When several permissions carry a warning, Chrome lists them for the person installing the extension.

Okta’s help center describes two safeguards in its own extension. It keeps the login it’s about to enter in a place the app can’t read, and deletes it once the sign-in page redirects. It also checks that the app’s web address matches the one Okta has on file before it submits anything.

What an extension can’t reach

Everything in Google’s description is about the browser and the pages in it. An extension has no say over desktop apps on the same computer, such as an email client, accounting software or a remote desktop app.

It also does nothing in a browser or on a device where it isn’t installed. If someone opens the same service in a second browser, or in the service’s phone app, the extension isn’t there to act. So an extension controls a service only when people use it through that browser. If they know the password, the other routes stay open.

How identity providers use extensions for password sign-in

Identity providers such as Okta and Microsoft Entra ID let people sign in once and reach many apps (single sign-on). Some apps don’t support SAML, a standard that lets an app accept a sign-in from an identity provider. For those apps, Okta and Entra ID fall back on filling in a saved username and password. That fill-in runs through an extension.

Microsoft says its password-based SSO stores each app’s usernames and passwords encrypted in the directory. Signing in to those apps requires the My Apps Secure Sign-in Extension, and people are asked to install it the first time they open one. An admin can also enter the username and password for a user or a group, which is how a shared login is set up. The extension is offered for Chrome and Microsoft Edge. On phones, Microsoft points people to Microsoft Edge for mobile.

Okta’s help center says the Okta Browser Plugin brings single sign-on to apps that need a username and password. It doesn’t work with apps that already accept sign-in from Okta through a standard such as SAML. When you open such an app’s sign-in page, the plugin fills in your login. Both products assume the person signs in from a browser that has the extension.

How a company controls which extensions run

Companies decide which extensions are allowed, and push out the ones people need, through browser management. Google’s help center says Chrome Enterprise Core comes at no additional cost and applies more than 100 Chrome policies from the Google Admin console. It can block suspicious extensions and report which extensions are installed. On a browser the company has enrolled, policies apply even when nobody signs in to a Google Account.

For extensions, Google’s admin help describes these controls:

• Let people install anything except what you block, or only what you allow.
• Stop extensions that ask for permissions you don’t allow, such as access to cookies.
• Force-install an extension, so people can’t turn it off or remove it.
• Keep extensions from working on sites you list.

How a managed browser differs

A managed browser, often called a secure browser or enterprise browser, treats the whole browser as the thing the company controls. Google’s paid Chrome Enterprise Premium, priced at $6 per user per month on its product page, adds controls over copy and paste, uploads, downloads and printing. Its access rules look at who the person is, whether the device meets your security settings, and where they are, in real time. Google also lists threat protection, reports, watermarks and screenshot protection.

Microsoft Edge for Business turns on when someone signs in to Edge with a Microsoft Entra ID account. It keeps work and personal browsing in separate windows, each with its own favorites and storage, and passwords and favorites aren’t shared between them. For personal Windows computers, Microsoft pairs it with app protection policies in Intune, its device and app management service.

Neither reaches outside the browser. The difference is the unit you manage: what happens on chosen sites, or the whole browser. That also changes how much you put on a personal device. Options for letting staff use personal devices for work systems compares the wider set of choices, and How companies manage sign-ins to cloud apps covers how these tools fit together.