⚙️🪟💻CP - Edge - Security Baseline
The one profile that turns Edge into a managed browser. SmartScreen on, extensions locked, legacy paths closed, and browser data encrypted to the account.
What this policy is about 🛡️
Edge is the most-used app on a managed Windows device and one of its largest attack surfaces. This baseline sets the floor: SmartScreen catches phishing and malicious downloads and users cannot click past it, extensions are blocked by default, legacy Internet Explorer paths are closed, and browser data is bound to the account with hardware-backed encryption.
The extension setting is the keystone. Blocking every extension by default is what makes an extension allow list actually mean something. Without this baseline, an allow list is decoration.
Each setting here is defensible on its own, but the point is the whole. An Edge that has SmartScreen on but leaves extensions and IE mode wide open is not hardened. This profile sets the same locked posture for every managed Edge so nobody has to remember the list.
Why this matters 🕵️
The browser is where phishing lands, where drive-by downloads start, and where a rogue extension reads every page a user visits. SmartScreen that a user can bypass is a warning nobody heeds; an unmanaged extension store is a supply chain you never vetted; an IE mode left open is a decade of old exploits kept on life support. Each looks ordinary right up until it is the incident.
Setting a baseline means every managed Edge starts from the same locked posture, and the only browsers that deviate are the ones you deliberately excepted.
🛠️ Configuration
Where: Intune admin center → Devices → Configuration → Create → Windows → Settings catalog → Microsoft Edge.
SmartScreen and phishing
| Setting | Value |
|---|---|
| Configure Microsoft Defender SmartScreen | Enabled |
| Prevent bypassing SmartScreen prompts for sites | Enabled |
| Prevent bypassing SmartScreen warnings about downloads | Enabled |
| Configure SmartScreen to block potentially unwanted apps | Enabled |
| Configure Edge Website Typo Protection | Enabled |
Connection and isolation
| Setting | Value |
|---|---|
| Enable site isolation for every site | Enabled |
| Allow users to proceed from the HTTPS warning page | Disabled |
| Allow software WebGL fallback using SwiftShader | Disabled |
HTTP authentication
| Setting | Value |
|---|---|
| Allow Basic authentication for HTTP | Disabled |
| Supported authentication schemes | ntlm, negotiate |
Extensions
| Setting | Value |
|---|---|
| Blocks external extensions from being installed | Enabled |
| Control which extensions cannot be installed | Enabled |
| Extension IDs the user should be prevented from installing | * (block all) |
| Enable browser legacy extension point blocking | Enabled |
Internet Explorer mode and legacy
| Setting | Value |
|---|---|
| Automatically open downloaded MHT/MHTML files in Internet Explorer mode | Disabled |
| Allow unconfigured sites to be reloaded in Internet Explorer mode | Disabled |
| Show the Reload in Internet Explorer mode button in the toolbar | Disabled |
Process hardening
| Setting | Value |
|---|---|
| Enable Application Bound Encryption | Enabled |
| Allow user-level native messaging hosts (installed without admin permissions) | Disabled |
| WebAssembly modules sent cross-origin | Disabled |
| Dynamic Code Settings | Prevent the browser process from creating dynamic code |
Assignment: include All devices; exclude standard exclusion groups only.
Caveats ⚠️
The block-all extension setting is the load-bearing one. * blocks every extension, so anything users genuinely need must be named in the Edge extension allow-list policy. Ship the block without the allow list and you have broken every legitimate add-on at once.
Basic auth and legacy IE sites surface fast. An internal appliance stuck on HTTP Basic auth, or a line-of-business app that only runs in IE mode, will break. That is the baseline doing its job, so inventory those legacy endpoints before rollout and configure the IE mode site list deliberately rather than leaving the fallback open.
Application Bound Encryption changes how other tools read Edge data. Binding cookies and passwords to the account can break backup or migration tooling that used to read them in the clear. Verify anything that touches the Edge profile still works.
Versioned by design. Edge adds and renames policies with each release, so this baseline moves with the browser. When you bump it to a newer Edge version, re-check that each setting still exists under the same name.
License and reversibility. Included in Business Premium. Clean-revert: unassign and Edge returns to its unmanaged defaults on the next policy refresh.
🔗 Related
- ⚙️🪟💻CP - Edge - Block non-company accounts: keeps the managed browser tied to your own identity.
- ⚙️🪟💻CP - Edge - Disable Password Manager: keeps corporate passwords out of the browser vault.
- ⚙️🪟💻CP - Edge - Scareware Blocker: blocks full-screen scam pages that mimic security alerts.
Shields up, red alert. This is the profile that stops the most-used app on the device from being its softest target. 🛡️