Deprecation for Manifest V2 (MV2) browser extensions support in Microsoft Edge

🚨 The Signal: Microsoft Edge is deprecating Manifest V2 (MV2) browser extensions by early 2027, moving to the more secure Manifest V3 (MV3). This change enhances security by enforcing stricter permissions and reducing attack surface, requiring organisations to update or replace MV2 extensions.

The Impact

All Microsoft Edge users and administrators deploying MV2 extensions are affected, facing a reduced attack surface and improved browser security.

  • Enterprise administrators: Must identify and replace or update MV2 extensions to maintain functionality and security.
  • End-users: May experience disruption if critical MV2 extensions are not migrated to MV3.
  • Extension developers: Must update MV2 extensions to MV3 for continued support in Microsoft Edge.
  • Security teams: Benefit from enhanced browser security and reduced attack vectors from legacy extensions.

The Action

  1. Identify all MV2 extensions currently deployed or allowed in your Microsoft Edge environment.
  2. Evaluate available MV3 replacements for identified MV2 extensions in the Edge Add-ons store.
  3. Plan and execute the migration of critical MV2 extensions to their MV3 counterparts.
  4. Update Microsoft Edge policies (e.g., ExtensionInstallForcelist, ExtensionInstallAllowlist) to reflect MV3 extensions.
  5. Utilise the ExtensionManifestV2Availability policy for temporary MV2 support on managed devices until full migration.

Domain: M365-Apps · Impact: high · Workload: M365 Apps · Essential Eight: User Application Hardening · ISM: ISM-1412, ISM-1485, ISM-1486, ISM-1542, ISM-1585, ISM-1667, ISM-1668, ISM-1669, ISM-1670, ISM-1823, ISM-1824, ISM-1859, ISM-1860