Has anyone else been dealing with fake antivirus alerts and other scary pop-ups appearing through Edge or Chrome? It looks like certain websites are being added to the browser's list of sites allowed to send notifications. I've seen this happen twice in the past day and typically encounter a few cases each month. What's the best way to block website notifications entirely, preferably through browser policy or centralized device management?
3 Answers
The usual cause is that someone clicked Allow on a website notification prompt. The site may look harmless, but once permission is granted it can send misleading antivirus warnings, ads, or links designed to trick users into downloading malware. The simplest fix is to disable website notifications by default and only allow them for a specific business need.
For managed environments, configure Chrome and Edge policies so websites are not allowed to request notification permissions. This can be deployed through Group Policy or Intune, depending on how the devices are managed. You can then create narrowly scoped exceptions if a particular site genuinely requires notifications.
We used a browser policy for this and pushed it centrally. It was straightforward once the browser policy templates were imported, and it stopped the problem across the managed devices.
You can also remove any existing permissions by checking each browser’s site notification settings and deleting unfamiliar entries. However, cleaning up individual sites is less reliable than blocking notification requests globally, since users can accidentally approve another deceptive prompt later.
Some users aren’t intentionally taking a risk—they may think they’re signing up for legitimate recipe or other site updates. Blocking notifications by default avoids relying on everyone to recognize deceptive prompts.