Skip Edge on unmanaged devices instead of writing a dead policy

Unmanaged Edge installs extensions from the Microsoft Store and nowhere else:
it reads ExtensionInstallForcelist, blanks the value to [BLOCKED]<id>, and
reports an invalid extension id forever after. Writing that key buys nothing
and costs a permanent policy error plus a "Managed by your organization"
badge, so the script now checks dsregcmd and skips Edge with the two ways
round it. -Force writes it anyway.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/install-extension-policy.ps1

@@ -44,7 +44,10 @@ param(
 
     [string]$UpdateUrl = 'https://ext.juicerroom.com/updates.xml',
 
-    [switch]$Remove
+    [switch]$Remove,
+
+    # Write the Edge policy even though Edge will refuse to act on it.
+    [switch]$Force
 )
 
 $ErrorActionPreference = 'Stop'
@@ -91,6 +94,28 @@ function Test-BrowserInstalled([string]$Name) {
     return $false
 }
 
+<#
+    Edge refuses to install an extension it did not get from the Microsoft Store
+    unless the device is managed — domain-joined, Intune-enrolled or Entra-joined.
+    The policy is read and then blanked: edge://policy shows the value as
+    "[BLOCKED]..." with "This device isn't managed by your organization", and an
+    "Invalid extension ID" error from parsing that prefix.
+
+    Chrome and Brave have no such restriction. So on an unmanaged machine there
+    is nothing to be gained by writing Edge's key, and a real cost: Edge starts
+    reporting "Managed by your organization" and shows a policy error forever.
+#>
+function Test-DeviceManaged {
+    try {
+        $status = & dsregcmd /status 2>$null | Out-String
+        return ($status -match 'AzureAdJoined\s*:\s*YES') -or
+               ($status -match 'DomainJoined\s*:\s*YES') -or
+               ($status -match 'EnterpriseJoined\s*:\s*YES')
+    } catch {
+        return $false      # no dsregcmd is itself a fair sign this is not managed
+    }
+}
+
 $hive = if ($Scope -eq 'Machine') { 'HKLM:' } else { 'HKCU:' }
 
 if ($Scope -eq 'Machine') {
@@ -111,6 +136,20 @@ if (-not $targets) {
     throw 'Found no Chrome, Edge or Brave installation. Name one with -Browser to configure it regardless of what this can see.'
 }
 
+if (-not $Remove -and ($targets -contains 'Edge') -and -not $Force -and -not (Test-DeviceManaged)) {
+    Write-Warning @'
+Edge is skipped: this device is not managed (not domain-joined, Intune-enrolled
+or Entra-joined), and unmanaged Edge only installs extensions from the Microsoft
+Store. It would read the policy and blank the value.
+
+  Use Chrome or Brave for the update-server install, or load extension\ unpacked
+  in Edge - an unpacked copy still reloads itself when the dashboard reports a
+  newer version. -Force writes the key anyway.
+'@
+    $targets = @($targets | Where-Object { $_ -ne 'Edge' })
+    if (-not $targets) { exit 1 }
+}
+
 Write-Host "Configuring: $($targets -join ', ')"