Browser Security Management
Exodesk helps New Zealand businesses manage the browsers staff use for work. We review supported browsers and extensions, agree the required settings and deploy the browser policy through the management tools in scope.
The work covers approved extensions, work-account and sync settings, browser password storage, updates and reporting, coordinated with device security, your password vault and access removal.
Tell us which browsers, devices and applications your team uses
What is browser security management?
Browser security management is the ongoing control of the browsers a business works in: which extensions can run, how work accounts, sync and password storage are set, how updates apply, and whether every intended browser is reporting.
A browser left at its defaults can carry unreviewed extensions, saved passwords outside the business vault and sync settings nobody chose. We manage Chrome and Edge through the tools you already have, such as Microsoft Intune, Group Policy or Chrome Enterprise Core, within your managed IT agreement or as scoped work.
Exodesk has supported New Zealand businesses since 1989. Today, our Christchurch and Dunedin teams support businesses nationwide.
Browser controls we set up and maintain
The scope lists the browsers, devices and settings included, and who handles exceptions, updates and review.
Browsers and extensions
Reporting enabled for the browsers in scope, with installed extensions recorded and reconciled against the device inventory.
Extension governance
An approved list built from what each team uses, with publisher, purpose and permissions checked and a request route for new tools.
Browser policy
Chrome and Edge browser security settings deployed through the management route you run, piloted with a test group before wider rollout.
Sign-in, profiles and sync
Work-account sign-in, sync settings and the rules for personal profiles, set to match the policy your business agrees.
Password storage
Browser password saving aligned with your approved vault, with existing passwords migrated and verified before removal.
Updates and review
Update and relaunch settings tested, compliance reported and the extension list reviewed on an agreed schedule.
We treat browser security as part of the wider device baseline covered by endpoint security, and policy can be deployed through Microsoft Intune where you use it.
Leavers and compromised accounts
Ending a browser session or disabling a profile does not remove access in every business application. We document the handover between browser security controls, identity administrators and application owners, tested with a designated account.
A password reset can invalidate some sessions, but it does not reliably end every active session across every service. Microsoft’s guidance on revoking access separates disabling the account, revoking sessions and refresh tokens, and ending sessions that applications issue for themselves, which the identity provider cannot revoke directly.
For a suspected compromise, the incident process blocks access where required, revokes the relevant sessions and tokens, secures credentials and sign-in methods, checks the device, and reviews app consents, mailbox rules and forwarding. Access is restored only after the result is verified, because a compromised device can capture a new session after the user signs in again.
Extension permissions, updates and review
An extension can access data within the site permissions and functions it has been granted, not everything a person can see. In browser security reviews, approval looks at both together.
Site access and API permissions work together; reading cookies through the browser API, for example, needs its own permission as well as access to the site. Chrome’s permission warning guidelines say an update that adds a warning-triggering permission disables the extension until the user accepts it, and enterprise install policy can change that approval step. An update can still misuse permissions already granted without asking again.
- Broad site access. Recorded with a business reason and reviewed, rather than removed regardless of function; an approved password manager extension may need it
- Site restrictions. Tested against real tasks before enforcement, so a tool for one portal does not reach unrelated systems
- Publisher changes. A change of publisher or a significant update triggers review of the extension and its permissions
- Private windows. In Chrome, extensions need explicit permission to run in incognito windows. Private browsing limits some local records but does not make a device trustworthy
Unapproved extensions are one form of shadow IT.
Management routes, profiles and sync
Group Policy, mobile device management and a cloud browser console can all deploy browser policy. We choose and document the actual route for your devices, because machine-level and user-level policies apply differently.
Signing into Chrome with an ordinary Microsoft 365 work address does not by itself enrol the browser, apply policy or enable reporting. Browser sign-in, browser sync and signing into a website are separate things, so restricting browser-account sign-in does not on its own stop personal webmail or uploads in a managed profile. Those need application or data-protection controls, such as data loss prevention.
Whether staff may keep a separate personal profile on a work device is a business decision we record in the policy. Profiles do not isolate malware running under the same operating-system user, and what sync copies depends on browser settings and policy. In browser security work, we state what the chosen controls enforce and what they leave to other layers.
Saved passwords and the business vault
Disabling new password saves does not remove passwords already saved in the browser. As part of browser security work, we change storage in a controlled order so nobody loses the only working copy of a credential.
- Prepare the vault. Set up the approved business vault with access, sharing and recovery agreed
- Migrate and verify. Move work credentials and confirm staff can sign in from the vault
- Apply the policy. Configure browser password storage settings for managed browsers
- Clean up. Remove redundant browser copies and any temporary export files, and check synced copies and recovery access
A built-in browser password manager is not insecure because it is built in. The question is whether it meets your requirements for approved storage, access governance, recovery and audit. Vault selection, rollout and team sharing are covered on password manager.
Session risk, MFA and sign-in logs
Information-stealing malware can copy browser session data, and a stolen session may avoid a fresh sign-in prompt. Multi-factor authentication remains valuable alongside phishing-resistant methods such as passkeys, device protection, access controls, monitoring and session response.
The usable lifetime of a session depends on the service, the token type and the controls in place, so the affected applications are checked rather than waiting for a fixed countdown. Unusual locations, unfamiliar devices and sign-ins without a prompt are investigation signals, not proof of compromise by themselves; normal single sign-on can also succeed silently.
Sign-in logs only help if they are kept long enough and someone reviews them. Under Microsoft Entra data retention, sign-in logs are kept for seven days on Entra ID Free and 30 days on P1 or P2, so longer retention needs an export or collection arrangement. Within browser security management we set up controls and reporting; continuous monitoring and response is a separate service, covered by managed detection and response.
How the work is delivered
We confirm what browser security covers first, then test before anything reaches the whole business.
Confirm coverage
Record the devices, operating systems, browsers and management tools in use.
Record extensions and needs
Collect installed extensions and ask each team which tools it depends on.
Agree policy and exceptions
Set the extension list, account, sync, password and update settings, with exceptions and their owners.
Pilot, then roll out
Test with a pilot group, adjust, then deploy and check reporting shows the intended browsers received the policy.
Support and review
Handle requests, exceptions and updates, and review the list and access-removal test on schedule.
Your agreed scope records the supported browsers and devices, approved extensions and exceptions, the management route, reporting coverage, and who handles requests and reviews. After rollout, we confirm which browsers received the policy and record any gaps for follow-up.
What affects the cost?
The cost of browser security management depends on the browser and device coverage, existing management tools, licence requirements, migration work, reporting and ongoing support.
- Coverage. The number of devices, browsers and operating systems in scope
- Management tools. Whether existing tools and licences support the policy and reporting
- Password migration. The credentials to move into the vault and verify before browser copies are removed
- Ongoing support. Extension requests, exceptions, update compliance and scheduled review
We separate one-off configuration from recurring services and identify what your current support arrangement already includes.
Browser security questions
Can an extension read business data?
It can access data within the site permissions and functions it has been granted. Some extensions need broad access, so approval considers the publisher, purpose and permissions, followed by testing and review.
Do extension updates keep the same access?
An update can reuse access already granted without a new prompt. Adding a permission that triggers a warning can require approval again. Existing approval is a reason for ongoing review, not proof that later versions remain trustworthy.
Does resetting a password end a stolen session?
It can invalidate some sessions, but it must not be relied on to end all access. Follow the response procedure for the identity provider, the affected applications and the device, then verify that access has ended.
Does MFA remove the risk of session theft?
No single control removes it. Keep multi-factor authentication, preferably phishing-resistant methods where supported, alongside device protection, access controls, monitoring and session response. A stolen session may avoid a fresh sign-in prompt.
Does signing into Chrome with a work account manage it?
Not automatically. Management depends on browser enrolment or device-based policy. A Microsoft 365 work address on its own does not show that the Chrome profile is managed.
Should we turn off browser password saving?
If your policy requires work credentials in the business vault, migrate and verify them before removing browser copies. Disabling new saves alone does not remove existing passwords, so synced copies and recovery access are checked too.
Does the service include security monitoring and incident response?
Only where those are part of the agreed service. Browser settings and reporting are different from continuous monitoring and response. The arrangement names who owns alerts, access removal and application sessions.
How much does browser security management cost?
It depends on coverage, the tools and licences already in place, configuration, migration and ongoing reporting or support. The proposal identifies included work and any additional charges. A free management console does not make the complete service free.
Discuss browser management
Tell us which browsers and devices your team uses, which applications matter to the business and who manages them today. We will confirm what browser security management would cover and scope the next step. Please leave passwords and account details out of the enquiry.
Talk to us about your browsers
Tell us your business, the browsers and devices in use and what you want browser security to control, and we will be in touch to arrange a time that suits.
Prefer to talk?
Christchurch
Level 1, 85 Riccarton Road
Christchurch 8011
03 343 3124
Dunedin
Level 3, Bartons Building
2 Stafford Street, Dunedin 9016
03 479 2941