⚙️🪟💻CP - Edge - Block non-company accounts
One browser, one company identity. Edge will accept a sign-in from your domain and turn away the Entra account someone brought from their last job.
What this policy is about 🪪
Edge will happily sign in as a profile for any Entra account, including one from a completely different organization. This policy pins that down: only accounts from the domain you specify can become an Edge primary account. Everyone else is refused at the door.
It works off a match pattern, and the value is your customer's own domain. Like a tenant ID, that pattern is a per-environment value, never a constant baked into a blueprint that ships to every tenant.
This does not stop anyone from visiting a website or logging into a web app. It stops them from signing the managed browser itself into an outside company's identity, which is the part that drags another tenant's sync, policies, and data onto your device.
Why this matters 🕵️
When a user signs Edge into another organization's Entra account, that browser becomes a little outpost of a tenant you do not manage. Their bookmarks, history, and saved data sync in and out through controls you have never seen, on a device you are responsible for. Add a departing employee who signs into their next employer's account, and now two companies' identities share one managed browser. Nobody meant for that to happen; the browser just said yes.
Restricting sign-in to your own domain keeps the managed browser tied to the identity you actually govern. Collaboration with other orgs still happens the proper way, through guest access and shared apps, not by a second company's account moving in.
🛠️ Configuration
Where: Intune admin center → Devices → Configuration → Create → Windows → Settings catalog → Microsoft Edge.
| Setting | Value |
|---|---|
| Restrict which accounts can be used to sign in to Microsoft Edge | Enabled |
| Restrict which accounts can be used as Microsoft Edge primary accounts (Device) | Per-tenant domain pattern, e.g. .*@company\.com |
| Assignment, include | All devices |
| Assignment, exclude | None (standard exclusions only) |
The pattern is a regular expression matched against the account. Set it to the customer's real domain, escape the dot (\.), and for multiple domains combine them (.*@company\.com|.*@company\.be). A hardcoded domain shipped to every tenant either locks the wrong people out or lets the wrong people in.
Caveats ⚠️
Never ship a hardcoded domain. This is the exact mistake that turns a rollout into an incident: paste one customer's domain into the blueprint and every other tenant restricts to a company that is not theirs. Use a per-environment value so each tenant matches itself.
Get the pattern right or you lock everyone out. A bad regex, or a forgotten domain a customer also uses, blocks legitimate sign-ins. Test the pattern against the tenant's actual domains before you assign it broadly.
Multi-domain and rebrands need a review. Tenants pick up new domains through mergers and rebrands. When they do, this pattern has to be updated, or the new domain's users cannot sign in.
License and reversibility. Included in Business Premium. Clean-revert: unassign and Edge returns to accepting any account on the next policy refresh.
🔗 Related
- ⚙️🪟💻CP - Edge - Security: the broader Edge hardening baseline this sits alongside.
You shall not pass, says the browser, to every account that is not on the domain. Corporate collaboration still gets the guest door; a second tenant does not get to move in. 🪪