Deploy and manage Admin Lens

1. Install it for everyone

Use the browser's ExtensionInstallForcelist policy. In Intune, create a Settings catalog profile and search for Control which extensions are installed silently under Microsoft Edge or Google Chrome. With Group Policy, it's the same setting in the Edge or Chrome administrative templates.

Browser	Value to add
Microsoft Edge	ddggkhhlkebnpoceejpilplaondjjeha;https://edge.microsoft.com/extensionwebstorebase/v1/crx
Google Chrome	imkpffplflgalipafdbccdligcgmlmed;https://clients2.google.com/service/update2/crx

Microsoft's reference for the Edge setting, including the value format: ExtensionInstallForcelist. On Windows devices that aren't joined to a domain, Edge only force-installs extensions from Microsoft Edge Add-ons, which is where Admin Lens is.

2. Set its options

Admin Lens reads policy for extensions from the browser's 3rdparty policy key, which Edge and Chrome expose to the extension as managed storage. Any option you set is locked for users and shows a padlock in the popup and settings page.

Browser	Registry key (HKLM or HKCU)
Microsoft Edge	SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\ddggkhhlkebnpoceejpilplaondjjeha\policy
Google Chrome	SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\imkpffplflgalipafdbccdligcgmlmed\policy

Yes or no options are REG_DWORD values (1 or 0). Text is REG_SZ. Lists, such as the dictionary, are a REG_SZ holding JSON.

3. A shared dictionary

The customDictionary value is a JSON list. Each entry needs a term to match and a name. A note and a url (https only) are optional. Users see these marked Organisation, and can still add their own.

[
  {"term": "11111111-2222-3333-4444-555555555555", "name": "Contoso production subscription", "note": "Changes need an approved CAB ticket."},
  {"term": "SRV-FS01", "name": "Head office file server", "url": "https://contoso.sharepoint.com/sites/it/runbooks/srv-fs01"},
  {"term": "CON-ERR-1042", "name": "Payroll sync: token expired", "note": "Restart the sync service, then rerun."}
]

Deploy the options with Intune

Settings catalog doesn't include per-extension policy, so use a PowerShell script. In the Intune admin center go to Devices › Scripts and remediations › Platform scripts, add this script, run it in 64-bit PowerShell as the system account, and assign it to your devices.

# Admin Lens managed settings for Microsoft Edge (change the path for Chrome)
$key = "HKLM:\SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\ddggkhhlkebnpoceejpilplaondjjeha\policy"
New-Item -Path $key -Force | Out-Null
Set-ItemProperty -Path $key -Name redact  -Value 1 -Type DWord      # always redact tickets
Set-ItemProperty -Path $key -Name consent -Value 1 -Type DWord      # always warn on risky consent
Set-ItemProperty -Path $key -Name fmt     -Value "md" -Type String  # Markdown tickets
Set-ItemProperty -Path $key -Name timeZones -Value '["Europe/London","America/New_York"]' -Type String
$dictionary = ConvertTo-Json -Compress -InputObject @(
  @{ term = "SRV-FS01"; name = "Head office file server"; note = "Owned by the infrastructure team." }
)  # -InputObject keeps it a list even with one entry
Set-ItemProperty -Path $key -Name customDictionary -Value $dictionary -Type String

Check it worked

1. Open edge://policy or chrome://policy and select Reload policies. Admin Lens's settings are listed under its extension ID.
2. Open the Admin Lens popup. Settings you manage show a padlock and a note that your organisation manages them.
3. Open Admin Lens settings. Organisation dictionary terms are marked Organisation.

Firefox

Firefox reads extension settings from its enterprise policies file (policies.json) under 3rdparty › Extensions › admin-lens@azureblog.co.uk, using the same names as the table above.

Privacy for your users

Managed settings only flow one way, from you to the extension. Admin Lens has no server side and sends nothing back, so you can't see users' lookups, notes or counts, and nor can anyone else. The privacy policy has the detail.