Separate extension installation counts from enabled-device counts in Defender

Source facts

The assessment reports both the number of devices with an extension installed and the number with that extension turned on. Extension details are collected across all users of the particular browser. Microsoft limits the assessment to Windows and to Edge, Chrome and Firefox extensions. Microsoft Learn.

Applicability

Use this review with licensed Defender Vulnerability Management browser-extension assessment. Microsoft limits the assessment to Windows devices and extensions in Edge, Chrome and Firefox; account for other platforms separately.

DSE recommendation

DSE recommends defining whether an extension action aims to disable execution or remove installed packages before choosing the acceptance measure. Record the browser and extension identity with both reported counts. Use the installed-device and user views to investigate remaining entries, and maintain a separate check for devices outside the assessment’s coverage.

Verification

After an approved extension change, inspect representative reported devices and compare their browser state with the relevant count. Confirm both enabled state and installed presence when removal is required. Record unresolved differences and the observation time; a reduced enabled count alone should not close a package-removal task.

Official references

Microsoft Learn: Browser extensions assessment in Microsoft Defender Vulnerability Management. Source reviewed September 17, 2026.