Browser Extensions & Their Permissions
The question it answers: Which browser extensions are installed on managed devices, and which can read all sites, cookies or downloads?
Browser extensions run inside every session the user has open. An extension that can read all sites, cookies or downloads can steal session tokens and data - and most organisations never approved the ones installed. This report lists every extension with its risk and the high-risk permissions it requests.
At a glance
Section titled “At a glance”| Where in the app | Tenant › Defender & Security Operations › Browser Extensions |
| Workload | Security |
| Kind | Findings list · dashboard tile |
| Data | Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). |
| Licence | Defender Vulnerability Management (add-on or included in Defender for Endpoint P2 / E5). |
| Report id (API and MCP) | tenant.secops.browser-extensions |
Columns
Section titled “Columns”| Column | Key | Type |
|---|---|---|
| Severity | Severity | Status |
| Browser | Category | Text |
| Extension | Subject | Link |
| Check | Setting | Text |
| Risk / devices | Value | Text |
| Finding | Finding | Text |
| Id / versions | Detail | Text |
| Date | When | Date |
| Devices | Number | Number |
A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).
What it needs
Section titled “What it needs”Licence: Defender Vulnerability Management (add-on or included in Defender for Endpoint P2 / E5).
Application permissions on the IntensiveReports app registration (all permissions):
| Permission | API | What it allows | Note |
|---|---|---|---|
ThreatHunting.Read.All | Microsoft Graph | Run hunting queries and read shared saved hunting queries |
Data sources it reads
POST /v1.0/security/runHuntingQuery (DeviceTvmBrowserExtensions, DeviceTvmBrowserExtensionsKB)
Through the API and MCP
Section titled “Through the API and MCP”GET /ir-api/v1/reports/tenant.secops.browser-extensions?size=100An AI assistant reads it with the MCP tool get_report and the id tenant.secops.browser-extensions. The client needs the Read grant for Security. See Using the API.