Browser extensions can make routine work easier, but they also add code and permissions to a profile. In a profile that holds business accounts, treat each extension as a separate access decision—not as a harmless convenience.
Install only what the work requires
Before adding an extension, identify the task it needs to perform. If a browser setting or an approved internal tool can do the job, avoid adding another extension.
Keep work profiles focused. An extension used for personal browsing may not belong in a profile used to manage business accounts. Separating these uses reduces clutter and makes reviews easier.
Check the publisher and the listing
Prefer extensions from publishers with a clear, consistent presence and a track record that can be reviewed. Check the extension’s description, update history and support information, and make sure the listing matches the tool your team intends to use.
A familiar name or polished page is not enough on its own. Be cautious about lookalike extensions, unclear ownership, or listings that do not explain why the extension needs its requested access. Install through the browser’s normal, approved process, and follow your organisation’s security rules.
Read permission requests carefully
An extension’s permissions determine what it may be able to access. Compare each request with the task: a tool that formats text should not need broad access to unrelated sites or account activity.
Be especially cautious with permissions that allow an extension to read or change data on all pages. That access may expose sensitive information displayed in a browser, including account details and internal documents. If broad access appears essential, ask whether a narrower setting is available and have the need reviewed before using it in a business profile.
Recheck extensions after changes
An extension can change after installation. Watch for a new owner, a shift in purpose, or a request for permissions that were not needed before. Treat an unexpected change as a reason to pause and review, rather than clicking through automatically.
Updates can also be a useful point to check whether the extension still has a clear work purpose. If the reason for keeping it is uncertain, disable it while the team reviews the need. Follow your organisation’s process for reporting suspicious changes.
Remove what is no longer needed
Review the extensions in each work profile from time to time. Remove tools that are unused, duplicated, unsupported, or no longer required for the account work. Fewer extensions mean fewer permissions to manage and fewer unfamiliar changes to notice.
When removing an extension, check whether the browser retains related settings or data that should also be cleared under your team’s procedures. Avoid copying extensions into a profile simply because they were present in another one.
Keep a team allow-list
Maintain a written allow-list of extensions approved for work profiles. Record each extension’s purpose, the team or role that needs it, and any permission limits or review requirements. Keep the list easy to check during setup and handover.
An allow-list helps team members make consistent choices, but it should not become permanent approval. Review entries when ownership, permissions, or work needs change, and follow the relevant platform rules and organisational policies.