{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-174-separate-extension-installation-counts-from-enabled-device-counts-in-defender/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-174-separate-extension-installation-counts-from-enabled-device-counts-in-defender/", "slug": "dse-20260917-174-separate-extension-installation-counts-from-enabled-device-counts-in-defender", "url": "https://update.dsesecurity.com/updates/dse-20260917-174-separate-extension-installation-counts-from-enabled-device-counts-in-defender/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-174-separate-extension-installation-counts-from-enabled-device-counts-in-defender.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-174-separate-extension-installation-counts-from-enabled-device-counts-in-defender/" }, "title": "Separate extension installation counts from enabled-device counts in Defender", "summary": "How should Defender browser-extension counts be interpreted when validating an extension cleanup?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:32:06+00:00", "modified_at": "2026-09-17T16:46:29+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 194, "potentially_affected": "Use this review with licensed Defender Vulnerability Management browser-extension assessment. Microsoft limits the assessment to Windows devices and extensions in Edge, Chrome and Firefox; account for other platforms separately.", "dse_recommendation": "DSE recommends defining whether an extension action aims to disable execution or remove installed packages before choosing the acceptance measure.", "primary_source": { "name": "Browser extensions assessment in Microsoft Defender Vulnerability Management - Microsoft Defender Vulnerability Management | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/defender-vulnerability-management/tvm-browser-extensions", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

The assessment reports both the number of devices with an extension installed and the number with that extension turned on. Extension details are collected across all users of the particular browser. Microsoft limits the assessment to Windows and to Edge, Chrome and Firefox extensions. Microsoft Learn.

\n

Applicability

\n

Use this review with licensed Defender Vulnerability Management browser-extension assessment. Microsoft limits the assessment to Windows devices and extensions in Edge, Chrome and Firefox; account for other platforms separately.

\n

DSE recommendation

\n

DSE recommends defining whether an extension action aims to disable execution or remove installed packages before choosing the acceptance measure. Record the browser and extension identity with both reported counts. Use the installed-device and user views to investigate remaining entries, and maintain a separate check for devices outside the assessment’s coverage.

\n

Verification

\n

After an approved extension change, inspect representative reported devices and compare their browser state with the relevant count. Confirm both enabled state and installed presence when removal is required. Record unresolved differences and the observation time; a reduced enabled count alone should not close a package-removal task.

\n

Official references

\n

Microsoft Learn: Browser extensions assessment in Microsoft Defender Vulnerability Management. Source reviewed September 17, 2026.

", "content_text": "Source facts\nThe assessment reports both the number of devices with an extension installed and the number with that extension turned on. Extension details are collected across all users of the particular browser. Microsoft limits the assessment to Windows and to Edge, Chrome and Firefox extensions. Microsoft Learn.\nApplicability\nUse this review with licensed Defender Vulnerability Management browser-extension assessment. Microsoft limits the assessment to Windows devices and extensions in Edge, Chrome and Firefox; account for other platforms separately.\nDSE recommendation\nDSE recommends defining whether an extension action aims to disable execution or remove installed packages before choosing the acceptance measure. Record the browser and extension identity with both reported counts. Use the installed-device and user views to investigate remaining entries, and maintain a separate check for devices outside the assessment’s coverage.\nVerification\nAfter an approved extension change, inspect representative reported devices and compare their browser state with the relevant count. Confirm both enabled state and installed presence when removal is required. Record unresolved differences and the observation time; a reduced enabled count alone should not close a package-removal task.\nOfficial references\nMicrosoft Learn: Browser extensions assessment in Microsoft Defender Vulnerability Management. Source reviewed September 17, 2026.", "content_markdown": "## Source facts\n\nThe assessment reports both the number of devices with an extension installed and the number with that extension turned on. Extension details are collected across all users of the particular browser. Microsoft limits the assessment to Windows and to Edge, Chrome and Firefox extensions. [Microsoft Learn](https://learn.microsoft.com/en-us/defender-vulnerability-management/tvm-browser-extensions).\n\n## Applicability\n\nUse this review with licensed Defender Vulnerability Management browser-extension assessment. Microsoft limits the assessment to Windows devices and extensions in Edge, Chrome and Firefox; account for other platforms separately.\n\n## DSE recommendation\n\nDSE recommends defining whether an extension action aims to disable execution or remove installed packages before choosing the acceptance measure. Record the browser and extension identity with both reported counts. Use the installed-device and user views to investigate remaining entries, and maintain a separate check for devices outside the assessment’s coverage.\n\n## Verification\n\nAfter an approved extension change, inspect representative reported devices and compare their browser state with the relevant count. Confirm both enabled state and installed presence when removal is required. Record unresolved differences and the observation time; a reduced enabled count alone should not close a package-removal task.\n\n## Official references\n\n[Microsoft Learn: Browser extensions assessment in Microsoft Defender Vulnerability Management](https://learn.microsoft.com/en-us/defender-vulnerability-management/tvm-browser-extensions). Source reviewed September 17, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-174-separate-extension-installation-counts-from-enabled-device-counts-in-defender/", "url": "https://update.dsesecurity.com/updates/dse-20260917-174-separate-extension-installation-counts-from-enabled-device-counts-in-defender/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-174-separate-extension-installation-counts-from-enabled-device-counts-in-defender/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Separate extension installation counts from enabled-device counts in Defender", "item": "https://update.dsesecurity.com/updates/dse-20260917-174-separate-extension-installation-counts-from-enabled-device-counts-in-defender/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-174-separate-extension-installation-counts-from-enabled-device-counts-in-defender/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-174-separate-extension-installation-counts-from-enabled-device-counts-in-defender/", "url": "https://update.dsesecurity.com/updates/dse-20260917-174-separate-extension-installation-counts-from-enabled-device-counts-in-defender/", "headline": "Separate extension installation counts from enabled-device counts in Defender", "description": "How should Defender browser-extension counts be interpreted when validating an extension cleanup?", "abstract": "How should Defender browser-extension counts be interpreted when validating an extension cleanup?", "articleBody": "Source facts\nThe assessment reports both the number of devices with an extension installed and the number with that extension turned on. Extension details are collected across all users of the particular browser. Microsoft limits the assessment to Windows and to Edge, Chrome and Firefox extensions. Microsoft Learn.\nApplicability\nUse this review with licensed Defender Vulnerability Management browser-extension assessment. Microsoft limits the assessment to Windows devices and extensions in Edge, Chrome and Firefox; account for other platforms separately.\nDSE recommendation\nDSE recommends defining whether an extension action aims to disable execution or remove installed packages before choosing the acceptance measure. Record the browser and extension identity with both reported counts. Use the installed-device and user views to investigate remaining entries, and maintain a separate check for devices outside the assessment’s coverage.\nVerification\nAfter an approved extension change, inspect representative reported devices and compare their browser state with the relevant count. Confirm both enabled state and installed presence when removal is required. Record unresolved differences and the observation time; a reduced enabled count alone should not close a package-removal task.\nOfficial references\nMicrosoft Learn: Browser extensions assessment in Microsoft Defender Vulnerability Management. Source reviewed September 17, 2026.", "datePublished": "2026-09-17T16:32:06+00:00", "dateModified": "2026-09-17T16:46:29+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-174-separate-extension-installation-counts-from-enabled-device-counts-in-defender/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-174-separate-extension-installation-counts-from-enabled-device-counts-in-defender/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Separate extension installation counts from enabled-device counts in Defender" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 194, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Browser extensions assessment in Microsoft Defender Vulnerability Management - Microsoft Defender Vulnerability Management | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/defender-vulnerability-management/tvm-browser-extensions" } } ] } }