[Bug - Edge Addons] All extensions are blocked on *.cloud.microsoft starting in Edge ≥150 with no override

[AdeledePremonville]

Describe the bug
Starting with Microsoft Edge 150, the browser applies a hardcoded extension blocklist to *.cloud.microsoft (the M365 Copilot / Microsoft 365 app surfaces). On these pages, extensions no longer run. This is a regression: on Edge 149 and earlier, extensions worked normally on these same pages.

The block affects ALL extensions — not just a specific category, and not only enterprise/managed scenarios. It cannot be overridden by ExtensionSettings → runtime_allowed_hosts, by ExtensionInstallForcelist (force install), or by any documented policy. It hits both regular user-installed extensions and admin-approved, force-installed extensions on managed devices, so admins have no way to re-enable trusted extensions on these surfaces.

Verified breakage:

• Password managers — verified with Bitwarden (users are forced to copy/paste credentials out of the manager on Copilot pages, a security regression)
• Corporate training / user-adoption extensions
• Accessibility extensions relied on by users

To Reproduce
Steps to reproduce the behavior:

1. On Edge 149, install any extension and open an M365 Copilot / *.cloud.microsoft page. Confirm the extension runs normally.
2. Update to Edge ≥150 (or use a clean profile on ≥150) with the same extension installed.
3. Navigate to any *.cloud.microsoft page (e.g. M365 Copilot).
4. See that the extension no longer runs / is blocked on the page.
5. (Managed devices) Force-install the extension via ExtensionInstallForcelist and set ExtensionSettings runtime_allowed_hosts to allow all URLs — the extension is still blocked on *.cloud.microsoft.

Expected behavior
Extensions run on *.cloud.microsoft pages exactly as they do on every other domain, and as they did in Edge 149. At minimum, there should be an override (or the existing force-install / runtime_allowed_hosts allowlist should be honored) so users and admins can re-enable extensions on these surfaces.

Screenshots
N/A (can provide edge://policy and edge://version screenshots on request).

Desktop (please complete the following information):

• OS: Windows 11 (also reproducible on managed devices via Intune/GPO)
• Browser: Microsoft Edge (Stable)
• Version: 150 or later (works on 149 and earlier)

Additional context
This is a behavior change introduced between Edge 149 and 150. The block appears to be independent of any configurable policy: ExtensionInstallForcelist and ExtensionSettings runtime_allowed_hosts have no effect on *.cloud.microsoft. Please either restore pre-150 behavior, provide a policy/override so extensions can run on these pages, or, if this is by design, document the exemption in the ExtensionSettings and ExtensionInstallForcelist policy references so users and admins understand it cannot be configured away.

Policy reference pages affected:

• https://learn.microsoft.com/en-us/deployedge/microsoft-edge-policies/extensionsettings
• https://learn.microsoft.com/en-us/deployedge/microsoft-edge-policies/extensioninstallforcelist

[bhensey]

We're hitting this too.

Context: we build an enterprise security extension that IT admins force-install
on managed devices. One of its jobs is showing acceptable-use and training
prompts when employees open M365 Copilot. It's the tooling that lets security
teams approve Copilot rollouts in the first place.

What we're seeing:

• Edge 150 broke this silently for our whole fleet. Worked fine on 149.
• Still works on Chrome and every other Chromium browser.
• No release note, no deprecation window.
• No override: runtime_allowed_hosts does nothing, and force-installed
  extensions are blocked the same as everything else.

Expected behavior:

• Honor runtime_allowed_hosts for policy-installed extensions on these origins.

[Rahul-Bauri]

Hi @AdeledePremonville

Thank you for reporting this issue. To help us investigate further and determine whether this is a regression, policy-related behavior, or expected functionality, could you please provide the following details?

1. Sample Extension

• A minimal test extension or a publicly available extension that demonstrates the issue (for example, Bitwarden, as mentioned in the report).
• The extension ID and store link.

2. Specific Affected URLs

• The exact *.cloud.microsoft URLs where the issue occurs.
• For example, specific Microsoft 365 Copilot page URLs rather than a generic domain reference.

3. Evidence of the Regression

• A video recording comparing the behavior in Edge 149 and Edge 150.
• Screenshots showing the extension functioning in Edge 149 and no longer functioning in Edge 150.

4. Extension Diagnostics

Any relevant error messages or logs from:

• DevTools Console
• Service Worker Console (edge://extensions)
• Extension error logs

5. Policy Validation Information

Screenshots of:

• edge://policy
• edge://version

Confirmation that the policies are being applied successfully, including the exact ExtensionSettings configuration being used.

6. Manifest Details

• Manifest version (MV2 or MV3).
• The host permissions requested by the extension.

7. Clean Profile Reproduction

• Confirmation of whether the issue can be reproduced on a fresh Edge 150 profile without any enterprise policies applied.

These details will help us reproduce the issue accurately and assist the engineering team with further investigation. Thank you.

[bhensey]

Thanks for looking into this. Here are steps to reproduce with Bitwarden.

Summary: The Bitwarden extension stops functioning on "https://m365.cloud.microsoft/chat" after updating from Edge 149 to 150. Rolling back to 149.0.4022.98 resolves it, which points to a regression introduced in 150.

Environment:

• Broken on: Edge [150.0.4078.48] (Stable, Latest)
• Working on: Edge 149.0.4022.98 (Stable)
• • Extension ID: jbkfoedolllekgbhcbcoahefnbanhhlh
• Store listing: https://microsoftedge.microsoft.com/addons/detail/jbkfoedolllekgbhcbcoahefnbanhhlh

Steps to reproduce:

1. On Edge 150, install Bitwarden (or any extension)
2. Navigate to https://m365.cloud.microsoft/chat
3. Click the extension icon while on that page.

Observed behavior: The extension page will not work. There will be a disclaimer in the extension dropdown saying explicitly, "Extensions are not allowed on m365.cloud.microsoft". The same extension and same URL work normally on 149.
Expected behavior: The extension should function on this domain, as it does on 149.

Screenshots attached:
Allowed on Edge 149

Blocked on Edge 150

No enterprise policies

[captixn]

In case it helps, I also observe the very same issue. It's the same for any extension for Copilot domain on Edge.

[Rahul-Bauri]

Hi @bhensey, Thank you for taking the time to provide the detailed reproduction steps and screenshots demonstrating the issue. I have shared the information with the relevant internal team for further investigation. I will update you as soon as I receive any additional information regarding this issue.

[Rahul-Bauri]

Hi @bhensey @captixn, I received the following response from our team regarding this issue:

Currently, extensions are not designed to work with Copilot. At this time, the list of sites where Microsoft extensions are blocked includes Copilot, Edge:// pages, and EAS*. However, your feedback is valuable and helps us better understand the potential need for extension support in Copilot. If you could share more specific use cases, it would help inform future discussions and product decisions. Thanks for your understanding.