Understanding Browser Security
A look under the hood at how the browser security agent scans, collects data, and enforces policy across your endpoints.
Architecture
Specifications of Agent Processes
The resource footprint of each agent process involved in browser security.
Agent process resource usage
Data Collection
Browser Scanning and Data Collection
When scans run, and how long the data they collect is kept.
Scan timing and retention
Browser scans are conducted following agent onboarding and agent version upgrades. Subsequent scans are not automatic, but can be scheduled daily, weekly, or monthly according to organizational needs.
Requirements
Prerequisites
Some browser security features depend on the Browser Security extension being installed; others don't.
Extension dependency
The Browser Security extension is mandatory on all managed browsers within endpoints to provide comprehensive visibility into web applications and activity. The following functionalities require the extension to be present:
- Download Filter
- Web Filter
- Browser Router
- Web activity tracking
Conversely, the following features do not require the Browser Security extension:
- Add-on Management
- Threat Prevention
- Data Leakage Prevention
- Browser Customization
- Java Manager
- Browser Lockdown
- Web Isolation
- Browser Restriction
For automatic first-party extension installation, open Browsers → Add-on Settings and review Install Browser Security extensions on managed browsers. Internet/intranet tracking are separate choices. Save and verify the result. For targeted deployment, use the official installation procedure.
The Windows message Command-line that bypass managed extensions is restricted identifies a browser startup check. It can block a browser started with extension-disabling arguments even when the console shows no deployed browser policies. Changing an extension restriction or browser warning preference does not establish that this separate guard is disabled. See browser launch-block guidance.
If an Endpoint Central agent-managed computer is absent from Browsers, check its Browser Security entitlement and applicable Endpoint Security scope. In the selected-computer add-on workflow, open Admin → Global Settings → Endpoint Security → Manage and review the computer. Check the Browser Security component state and last contact. Base-agent installation alone does not establish an installed Browser component or inclusion in Browser managed views. After processing scope/component changes, refresh and verify the view. Enrollment does not prove policy enforcement.
Enforcement
Policy Deployment and Enforcement in Agent
How quickly policies take effect, and how conflicts between policies are resolved.
To Computers
Associating or removing a policy requests the operation for the target computer. The endpoint must receive and process the command before enforcement changes. Review per-computer status and remarks, then verify browser behavior. Offline devices cannot confirm completion until they reconnect.
To Groups
Upon association and deployment of a policy to a custom group, it's immediately applied to all currently online agent machines in that group. For large custom groups exceeding 100 machines, the policy is initially applied to a subset of 100 machines, with the remaining machines receiving it during the next refresh cycle.
Browser Security Policy Conflict Precedence
When multiple policies of the same feature (for example, Web Filter) are deployed to a single endpoint, the most recently deployed policy is enforced.
After publishing a policy modification, check Yet to update computers in Summary. Use Update Policy where available and confirm the update. Review per-computer status and browser behavior. Publication alone does not prove that every associated computer received the version.
For a Windows Bookmark Manager payload, separate overlapping policies do not concatenate their bookmark lists. Put bookmarks that must coexist into one policy and verify its deployed collection. Add-on Management also selects the retained collection for each applicable add-on payload; do not assume that selected extension lists from different policies are merged.
The Windows Browser Restriction enforcement path can create AppLocker rules with the MEBSPAPPLOCKER identifier. This differs from the managed-extension command-line launch guard. If another product also controls AppLocker, provide the effective rules and policy status to support before changing either policy set. See Browser Restriction.