# Separate extension installation counts from enabled-device counts in Defender

> How should Defender browser-extension counts be interpreted when validating an extension cleanup?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-174-separate-extension-installation-counts-from-enabled-device-counts-in-defender/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:32:06+00:00
- Modified: 2026-09-17T16:46:29+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

How should Defender browser-extension counts be interpreted when validating an extension cleanup?

## Potentially affected

Use this review with licensed Defender Vulnerability Management browser-extension assessment. Microsoft limits the assessment to Windows devices and extensions in Edge, Chrome and Firefox; account for other platforms separately.

## DSE recommendation

DSE recommends defining whether an extension action aims to disable execution or remove installed packages before choosing the acceptance measure.

## Article

## Source facts

The assessment reports both the number of devices with an extension installed and the number with that extension turned on. Extension details are collected across all users of the particular browser. Microsoft limits the assessment to Windows and to Edge, Chrome and Firefox extensions. [Microsoft Learn](https://learn.microsoft.com/en-us/defender-vulnerability-management/tvm-browser-extensions).

## Applicability

Use this review with licensed Defender Vulnerability Management browser-extension assessment. Microsoft limits the assessment to Windows devices and extensions in Edge, Chrome and Firefox; account for other platforms separately.

## DSE recommendation

DSE recommends defining whether an extension action aims to disable execution or remove installed packages before choosing the acceptance measure. Record the browser and extension identity with both reported counts. Use the installed-device and user views to investigate remaining entries, and maintain a separate check for devices outside the assessment’s coverage.

## Verification

After an approved extension change, inspect representative reported devices and compare their browser state with the relevant count. Confirm both enabled state and installed presence when removal is required. Record unresolved differences and the observation time; a reduced enabled count alone should not close a package-removal task.

## Official references

[Microsoft Learn: Browser extensions assessment in Microsoft Defender Vulnerability Management](https://learn.microsoft.com/en-us/defender-vulnerability-management/tvm-browser-extensions). Source reviewed September 17, 2026.

## Primary reference

- Name: Browser extensions assessment in Microsoft Defender Vulnerability Management - Microsoft Defender Vulnerability Management | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/defender-vulnerability-management/tvm-browser-extensions
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Separate extension installation counts from enabled-device counts in Defender,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-174-separate-extension-installation-counts-from-enabled-device-counts-in-defender/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.