Skip to content
Contact us
  • There are no suggestions because the search field is empty.

User Risk: Browser Extension Settings

Supported browsers

The User Risk browser extension ships as two separate builds; one for Chromium-based browsers and one for Firefox. Deploy the build that matches the browser your users run.

Supported:

  • Chromium-based browsers: Google Chrome and Microsoft Edge
  • Firefox.

Not supported:

  • Safari, including its macOS, iOS, and iPadOS versions.

    Browser extension modes

    The User Risk browser extension provides various benefits to both you, and your users:

    • For you: insights, visibility, and policy enforcement.
    • For your users: contextually relevant security coaching and guardrails.

    Once the extension is deployed, browser-detected applications appear in the Applications tab. The extension has two modes — Full and Limited — that control what users see.

    🎵 Modes control what users sees from the extension itself, not whether policies take effect. App usage policies are enforced regardless of which extension mode you choose. 

    Mode What users see
    Full Users can interact with the browser extension. They can view their User Risk score, see what apps they can and can't use, learn how to remove OAuth permissions they've granted, and request access to apps. Nudges and blocks appear when an app's policy requires them.
    Limited Users see a brief description of the browser extension, which you can customize. They don't see their User Risk score, what apps have been approved or not, or any other extension content. Nudges and blocks appear when an app's policy requires them.

    Update the extension’s mode

    UpGuard users with the admin role (or with admin features enabled) can update the extension’s default mode. The extension's mode applies to all users and teams. 

    1. Click the settings cog in UpGuard’s top right corner.
    2. Click Browser Extension under User Risk in the left panel.
    3. Click the toggle next to the appropriate mode.

    User Risk’s browser UI immediately updates and your user’s browser extensions will update within an hour.  

    A live preview of the end-user app nudge appears next to the mode options. Use it to see what each mode looks like before you choose.

    Customize the extension’s branding

    You can customize the browser extension so it looks like it comes from your security team, rather than UpGuard. You can set a light or dark appearance, add your logo, choose an accent color, and set the organization name users see. You can also customize the messages users see.

    1. Click the Settings (gear) icon in UpGuard’s upper right-hand corner.
    2. Click Browser Extension under User Risk in the left-hand navigation panel.
    3. In the Brand customization section, select the Apply branding toggle.
    4. Configure your branding:
      • Appearance: select Dark or Light. Only the accent strip takes color, so the background stays neutral and readable.
      • Company logo: upload your logo. Use a PNG with a transparent background, max 800 KB. A transparent PNG works best on both light and dark backgrounds.
      • Accent color: enter your organization’s brand color as a hex value. This will color the accent strip at the top of the browser extension.
      • (optional) Organization display name: enter the name shown in default messages and wherever you use the {org} tag, up to 32 characters. Leave blank to use your account name.
    5. Click Apply changes.

    Changes will reflect on your users’ browser extensions within an hour.

    Customize the extension’s messages

    Replace the default message users see on nudges, block screens, and the extension window with your own wording. You can customize four messages:

    Message

    Where users see it

    Default message

    Nudge

    Under the title of the nudge, on an app with a nudge policy.

    {app} is not approved for use at {org}. To keep sensitive data secure, do not log in or create an account.

    Block screen

    Under the title of the full-page block screen, on an app with a block policy.

    {app} is not approved for use at {org}. To keep sensitive data secure, switch to an approved alternative.

    Extension window (Limited)

    The extension’s description, when the extension is in Limited mode.

    This extension helps your IT team understand the applications in use in your organization.

    Extension window (Full)

    Under the Stop using [app name] or Action required heading, when a user opens the extension on a nudged or blocked app in Full mode.

    It is not approved for use at {org}. Using this app is a policy violation and puts your organization at serious risk.

    Use tags to insert names into a message:

    • {app}: the app’s name. Not accepted in the Extension window (Limited) message.

    • {org}: your Organization display name, or your account name if that field is blank.

    To customize a message:

    1. Navigate to Settings (gear icon) > Browser Extension (under User Risk).

    2. In the Brand customization section, make sure the Apply branding toggle is selected. The Messages section appears under Organization display name.

    3. Click the pencil icon next to the message you want to change.

    4. Enter your message in the text box.

    5. Click Done.

    6. (optional) Repeat steps 3–5 for each message you want to change.

    7. Click Apply changes.

    Message rules:

    • Each message can be up to 200 characters. 

    • HTML tags, such as <b>, show as plain text.

    • Tags must match exactly. For example, {App} (capitalized) and { app } (spaces between the curly brackets) won't work. 

    🎵 Each changed message is recorded in the Audit Log as an Extension Message Changed entry.

    Edit app usage detection settings 

    User Risk registers app usage after a designated period of usage. By default, User Risk tracks usage after 1 minute of active usage, but you can change that time period in settings.

    1. Click the settings cog in UpGuard’s top right corner.
    2. Click Browser Extension under User Risk in the left panel.
    3. Scroll to the App usage detection section.
    4. Click the Only detect app usage after dropdown.
    5. Select the desired time period.

    User Risk’s browser UI immediately updates and your user’s browser extensions will update within an hour.  

    Remove unused browser-detected apps from User Risk

    UpGuard removes a browser-detected app from a user’s Applications list when the user hasn’t used it for a set period; 30 days by default. You can shorten this to seven or 14 days.

    🎵 Apps accessed with a corporate login aren’t affected.

    To change the removal period:

    1. Navigate to Settings (gear icon) > Browser Extension (under User Risk).

    2. Scroll to the App usage detection section.

    3. Click the Remove unused browser-detected apps dropdown.

    4. Select After 7 days, After 14 days, or After 30 days.

      • Note that choosing a longer period later won't bring removed apps back. An app returns only when a user visits it again.

    5. In the Change unused app removal period? dialog, click Change.

    🎵 Apps aren’t removed straight away. At the next scan, UpGuard removes any app a user hasn’t used within the new period from their Applications list, along with the app’s risks.