Created by Claude - please verify

Browser extensions - Defender Vulnerability Management inventory through advanced hunting (top 500 by devices).

Required Microsoft Graph permissions

ThreatHunting.Read.All — application permission, granted to the app registration with admin consent.

Licence: Defender Vulnerability Management (add-on or included in Defender for Endpoint P2 / E5).

Endpoint: POST /v1.0/security/runHuntingQuery (DeviceTvmBrowserExtensions, DeviceTvmBrowserExtensionsKB)

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Browser Extensions & Their Permissions

Browser extensions run inside every session the user has open. An extension that can read all sites, cookies or downloads can steal session tokens and data - and most organisations never approved the ones installed. This report lists every extension with its risk and the high-risk permissions it requests.