BrowserExtension - InstalledExtensionsWithTheMostRequiredPermissions.md

Query the installed extensions with the most required permissions

---

Defender XDR

let PermissionInformation = DeviceTvmBrowserExtensionsKB
     | where IsPermissionRequired == "true"
     | summarize
         TotalPermissions = dcount(PermissionName),
         PermissionNames = make_set(PermissionName)
         by ExtensionId
     | where TotalPermissions > 3 // Change baseline if needed
     | project ExtensionId, TotalPermissions, PermissionNames;
DeviceTvmBrowserExtensions
| join PermissionInformation on ExtensionId
| sort by TotalPermissions
| join DeviceInfo on DeviceId
| project
     DeviceName,
     BrowserName,
     ExtensionName,
     ExtensionRisk,
     PermissionNames,
     TotalPermissions