Description: This policy controls the use of code integrity guard in the browser process, which only allows Microsoft signed binaries to load. Setting this policy to Enabled will enable code integrity guard in the browser process. Setting this policy to Disabled, or if the policy is not set, will prevent the browser from enabling code integrity guard in the browser process. The policy value Audit (1) is obsolete as of version 110. Setting this value is equivalent to the Disabled value. This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, or Windows 10 Pro or Enterprise instances that enrolled for device management. This policy will only take effect on Windows 10 RS2 and above. Policy options mapping: * Disabled (0) = Do not enable code integrity guard in the browser process. * Audit (1) = Enable code integrity guard audit mode in the browser process. * Enabled (2) = Enable code integrity guard enforcement in the browser process. Use the preceding information when configuring this policy.

Why It's Important: This setting helps protect Microsoft Edge from being hijacked by unsafe or malicious software. By allowing only trusted, Microsoft-signed code to run in the browser, it blocks harmful programs from sneaking in and compromising your security. SHIELD enables this policy to lock down the browser environment—like allowing only verified personnel into a secure building. It’s a strong defense against attacks that try to inject dangerous code into your browser.

Learn More

Description: Specifies whether SharedArrayBuffers can be used in a non cross-origin-isolated context. A SharedArrayBuffer is a binary data buffer that can be used to create views on shared memory. SharedArrayBuffers have a memory access vulnerability in several popular CPUs. If you enable this policy, sites are allowed to use SharedArrayBuffers with no restrictions. If you disable or don't configure this policy, sites are allowed to use SharedArrayBuffers only when cross-origin isolated. Microsoft Edge will require cross-origin isolation when using SharedArrayBuffers from Microsoft Edge 91 onward for Web Compatibility reasons.

Why It's Important: SharedArrayBuffers are powerful tools for speeding up websites, but they can also be misused to exploit weaknesses in certain computer processors. This setting makes sure websites can only use them in a secure, isolated environment, reducing the chance of attacks. SHIELD disables unrestricted access to SharedArrayBuffers to protect users from advanced threats that could steal sensitive data. It’s like only allowing high-powered tools in a locked, controlled lab—keeping performance benefits without compromising safety.

Learn More

Description: This policy setting lets you configure whether to turn on Edge TyposquattingChecker. Edge TyposquattingChecker provides warning messages to help protect your users from potential typosquatting sites. By default, Edge TyposquattingChecker is turned on. If you enable this policy, Edge TyposquattingChecker is turned on. If you disable this policy, Edge TyposquattingChecker is turned off. If you don't configure this policy, Edge TyposquattingChecker is turned on but users can choose whether to use Edge TyposquattingChecker.

Why It's Important: This policy enables Microsoft Edge’s Typosquatting Checker, which warns users if they mistype a web address that could lead to a fraudulent or malicious site. It helps protect against phishing and credential theft caused by look-alike domain names.

Learn More

Description: Allow Microsoft Edge to monitor user passwords. If you enable this policy, the user will get alerted if any of their passwords stored in Microsoft Edge are found to be unsafe. Microsoft Edge will show an alert and this information will also be available in Settings > Passwords > Password Monitor. If you disable this policy, users will not be asked for permission to enable this feature. Their passwords will not be scanned and they will not be alerted either. If you don't configure the policy, users can turn this feature on or off. To learn more about how Microsoft Edge finds unsafe passwords see https://go.microsoft.com/fwlink/?linkid=2133833 Additional guidance: This policy can be set as both Recommended as well as Mandatory, however with an important callout. Mandatory enabled: If the policy is set to Mandatory enabled, the UI in Settings will be disabled but remain in 'On' state, and a briefcase icon will be made visible next to it with this description displayed on hover - "This setting is managed by your organization." Recommended enabled: If the policy is set to Recommended enabled, the UI in Settings will remain in 'Off' state, but a briefcase icon will be made visible next to it with this description displayed on hover - "Your organization recommends a specific value for this setting and you have chosen a different value" Mandatory and Recommended disabled: Both these states will work the normal way, with the usual captions being shown to users.

Why It's Important: This setting helps protect users by warning them if any of their saved passwords have been leaked or compromised. It’s like having a security system that quietly checks your locks and alerts you if one has been picked. SHIELD enables this policy to give users an early warning against account breaches—helping them change weak or stolen passwords before hackers can use them. It’s a simple way to boost security without interrupting the user’s workflow.

Learn More

Description: Allows you to control when to trigger password protection warning. Password protection alerts users when they reuse their protected password on potentially suspicious sites. You can use the 'PasswordProtectionLoginURLs' (Configure the list of enterprise login URLs where password protection service should capture fingerprint of password) and 'PasswordProtectionChangePasswordURL' (Configure the change password URL) policies to configure which passwords to protect. Exemptions: Passwords for the sites listed in 'PasswordProtectionLoginURLs' and 'PasswordProtectionChangePasswordURL', as well as for the sites listed in 'SmartScreenAllowListDomains' (Configure the list of domains for which Microsoft Defender SmartScreen won't trigger warnings), will not trigger a password-protection warning. Set to 'PasswordProtectionWarningOff' (0) to not show password protection warningss. Set to 'PasswordProtectionWarningOnPasswordReuse' (1) to show password protection warnings when the user reuses their protected password on a non-allowlisted site. If you disable or don't configure this policy, then the warning trigger is not shown. * 0 = Password protection warning is off. * 1 = Password protection warning is triggered by password reuse.

Why It's Important: [coming soon]

Learn More

Description: Configures the change password URL (HTTP and HTTPS schemes only). Password protection service will send users to this URL to change their password after seeing a warning in the browser. If you enable this policy, then password protection service sends users to this URL to change their password. If you disable this policy or don't configure it, then password protection service will not redirect users to a change password URL. This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain or Windows 10 Pro or Enterprise instances that are enrolled for device management.

Why It's Important: This setting helps users quickly and safely change their password if Edge detects it might be compromised. Instead of leaving them to figure out where to go, it sends them straight to the right page—like guiding someone to the help desk when their keycard stops working. SHIELD enables this policy to make password recovery fast and secure, reducing confusion and helping users take action immediately when their credentials are at risk.

Learn More

Description: Enable Microsoft Edge to save user passwords. If you enable this policy, users can save their passwords in Microsoft Edge. The next time they visit the site, Microsoft Edge will enter the password automatically. If you disable this policy, users can't save new passwords, but they can still use previously saved passwords. If you enable or disable this policy, users can't change or override it in Microsoft Edge. If you don't configure it, users can save passwords, as well as turn this feature off.

Why It's Important: This setting prevents users from saving new passwords in Microsoft Edge, which helps reduce the risk of sensitive credentials being stored in the browser—especially on shared or unmanaged devices. SHIELD disables this feature to enforce stricter password management practices, encouraging users to use secure, enterprise-approved tools instead. It’s like telling employees not to write down passwords on sticky notes—keeping credentials out of places where they could be easily accessed or misused.

Learn More

Description: [coming soon]

Why It's Important: [coming soon]

Learn More

Description: Enables the use of a default search provider on the context menu. If you set this policy to disabled the search context menu item that relies on your default search provider and sidebar search will not be available. If this policy is set to enabled or not set, the context menu item for your default search provider and sidebar search will be available. The policy value is only applied when the 'DefaultSearchProviderEnabled' (Enable the default search provider) policy is enabled, and is not applicable otherwise.

Why It's Important: This policy disables the option to search using the default search provider directly from the context menu or sidebar. It helps reduce unintended data sharing with external search engines and ensures all web queries occur through approved, controlled channels within enterprise environments.

Learn More

Description: Allows users to import autofill form data from another browser into Microsoft Edge. If you enable this policy, the option to manually import autofill data is automatically selected. If you disable this policy, autofill form data isn't imported at first run, and users can't import it manually. If you don't configure this policy, autofill data is imported at first run, and users can choose whether to import this data manually during later browsing sessions. You can set this policy as a recommendation. This means that Microsoft Edge will import autofill data on first run, but users can select or clear autofill data option during manual import. Note: This policy currently manages importing from Google Chrome (on Windows 7, 8, and 10 and on macOS) and Mozilla Firefox (on Windows 7, 8, and 10 and on macOS) browsers.

Why It's Important: This policy prevents Microsoft Edge from importing saved autofill form data from other browsers. It helps protect sensitive user information and ensures that only approved and policy-controlled data is used within managed environments.

Learn More

Description: Allows users to import browser settings from another browser into Microsoft Edge. If you enable this policy, the Browser settings check box is automatically selected in the Import browser data dialog box. If you disable this policy, browser settings aren't imported at first run, and users can’t import them manually. If you don’t configure this policy, browser settings are imported at first run, and users can choose whether to import them manually during later browsing sessions. You can also set this policy as a recommendation. This means that Microsoft Edge imports the settings on first run, but users can select or clear the browser settings option during manual import. Note: This policy currently manages importing Google Chrome (on Windows 7, 8, and 10 and on macOS).

Why It's Important: This policy disables the importing of browser configuration settings from other browsers into Microsoft Edge. It ensures that all users start with consistent, organization-approved settings and prevents personal or unverified configurations from affecting managed devices.

Learn More

Description: Allows users to import their browsing history from another browser into Microsoft Edge. If you enable this policy, the Browsing history check box is automatically selected in the Import browser data dialog box. If you disable this policy, browsing history data isn't imported at first run, and users can’t import this data manually. If you don’t configure this policy, browsing history data is imported at first run, and users can choose whether to import it manually during later browsing sessions. You can also set this policy as a recommendation. This means that Microsoft Edge imports browsing history on first run, but users can select or clear the history option during manual import. Note: This policy currently manages importing from Internet Explorer (on Windows 7, 8, and 10), Google Chrome (on Windows 7, 8, and 10 and on macOS), Mozilla Firefox (on Windows 7, 8, and 10 and on macOS), and Apple Safari (macOS) browsers.

Why It's Important: This policy prevents Microsoft Edge from importing browsing history from other browsers. It helps maintain privacy and compliance by ensuring that personal or unmanaged web activity isn’t transferred into enterprise profiles or logged within managed environments.

Learn More

Description: Allows users to import Cookies from another browser into Microsoft Edge. If you disable this policy, Cookies aren't imported on first run. If you don’t configure this policy, Cookies are imported on first run. You can also set this policy as a recommendation. This means that Microsoft Edge imports Cookies on first run. Note: This policy currently manages importing Google Chrome (on Windows 7, 8, and 10 and on macOS).

Why It's Important: This policy disables the importing of cookies from other browsers into Microsoft Edge. It prevents session data and tracking information from personal or unmanaged browsers from being transferred into managed environments, supporting data protection and privacy compliance.

Learn More

Description: Allows users to import favorites from another browser into Microsoft Edge. If you enable this policy, the Favorites check box is automatically selected in the Import browser data dialog box. If you disable this policy, favorites aren't imported at first run, and users can’t import them manually. If you don’t configure this policy, favorites are imported at first run, and users can choose whether to import them manually during later browsing sessions. You can also set this policy as a recommendation. This means that Microsoft Edge imports favorites on first run, but users can select or clear the favorites option during manual import. Note: This policy currently manages importing from Internet Explorer (on Windows 7, 8, and 10), Google Chrome (on Windows 7, 8, and 10 and on macOS), Mozilla Firefox (on Windows 7, 8, and 10 and on macOS), and Apple Safari (on macOS) browsers.

Why It's Important: This policy disables the importing of favorites (bookmarks) from other browsers during Edge setup or manual import. It helps ensure a consistent browsing experience across managed devices and prevents the introduction of personal or unapproved links into enterprise environments.

Learn More

Description: Allows users to import their home page setting from another browser into Microsoft Edge. If you enable this policy, the option to manually import the home page setting is automatically selected. If you disable this policy, the home page setting isn’t imported at first run, and users can’t import it manually. If you don’t configure this policy, the home page setting is imported at first run, and users can choose whether to import this data manually during later browsing sessions. You can set this policy as a recommendation. This means that Microsoft Edge imports the home page setting on first run, but users can select or clear the home page option during manual import. Note: This policy currently manages importing from Internet Explorer (on Windows 7, 8, and 10).

Why It's Important: This policy prevents Microsoft Edge from importing homepage configurations from other browsers. It helps maintain a consistent and secure start page across all managed devices, ensuring users begin their sessions from an approved and trusted URL defined by enterprise policy.

Learn More

Description: Allows users to import open and pinned tabs from another browser into Microsoft Edge. If you enable this policy, the Open tabs check box is automatically selected in the Import browser data dialog box. If you disable this policy, open tabs aren't imported at first run, and users can't import them manually. If you don't configure this policy, open tabs are imported at first run, and users can choose whether to import them manually during later browsing sessions. You can also set this policy as a recommendation. This means that Microsoft Edge imports open tabs on first run, but users can select or clear the Open tabs option during manual import. Note: This policy currently only supports importing from Google Chrome (on Windows 7, 8, and 10 and on macOS).

Why It's Important: This policy disables importing of open or pinned tabs from other browsers during setup or manual import. It prevents personal or unmanaged browsing sessions from being carried over to enterprise environments, protecting privacy and ensuring a clean, policy-controlled workspace.

Learn More

Description: Allows users to import payment info from another browser into Microsoft Edge. If you enable this policy, the payment info check box is automatically selected in the Import browser data dialog box. If you disable this policy, payment info isn’t imported at first run, and users can’t import it manually. If you don’t configure this policy, payment info is imported at first run, and users can choose whether to import it manually during later browsing sessions. You can also set this policy as a recommendation. This means that Microsoft Edge imports payment info on first run, but users can select or clear the payment info option during manual import. Note: This policy currently manages importing from Google Chrome (on Windows 7, 8, and 10 and on macOS).

Why It's Important: This policy prevents Microsoft Edge from importing saved payment information from other browsers. It helps protect sensitive financial data and ensures that only approved and secure payment methods are used within managed or enterprise environments.

Learn More

Description: Allows users to import saved passwords from another browser into Microsoft Edge. If you enable this policy, the option to manually import saved passwords is automatically selected. If you disable this policy, saved passwords aren't imported on first run, and users can't import them manually. If you don't configure this policy, passwords are imported at first run, and users can choose whether to import them manually during later browsing sessions. You can set this policy as a recommendation. This means that Microsoft Edge imports passwords on first run, but users can select or clear the passwords option during manual import. Note: This policy currently manages importing from Internet Explorer (on Windows 7, 8, and 10), Google Chrome (on Windows 7, 8, and 10 and on macOS), and Mozilla Firefox (on Windows 7, 8, and 10 and on macOS) browsers.

Why It's Important: This policy blocks Microsoft Edge from importing saved passwords from other browsers. It helps maintain centralized credential management and prevents personal or unmanaged credentials from being transferred into secure enterprise profiles.

Learn More

Description: Allows users to import search engine settings from another browser into Microsoft Edge. If you enable, this policy, the option to import search engine settings is automatically selected. If you disable this policy, search engine settings aren't imported at first run, and users can’t import them manually. If you don’t configure this policy, search engine settings are imported at first run, and users can choose whether to import this data manually during later browsing sessions. You can set this policy as a recommendation. This means that Microsoft Edge imports search engine settings on first run, but users can select or clear the search engine option during manual import. Note: This policy currently manages importing from Internet Explorer (on Windows 7, 8, and 10).

Why It's Important: This policy prevents Microsoft Edge from importing search engine configurations from other browsers. It helps maintain consistency across managed devices, ensuring that all users use approved search providers that comply with organizational privacy, security, and compliance standards.

Learn More

Description: Allows users to import Shortcuts from another browser into Microsoft Edge. If you disable this policy, Shortcuts aren't imported on first run. If you don’t configure this policy, Shortcuts are imported on first run. You can also set this policy as a recommendation. This means that Microsoft Edge imports Shortcuts on first run. Note: This policy currently manages importing from Google Chrome (on Windows 7, 8, and 10 and on macOS).

Why It's Important: This policy blocks Microsoft Edge from importing shortcuts from other browsers during setup. It helps enforce a clean and standardized browser experience on managed devices, preventing the transfer of personal or non-compliant web shortcuts into the enterprise environment.

Learn More

Description: Allows users to import Startup settings from another browser into Microsoft Edge. If you enable this policy, the Startup settings are always imported. If you disable this policy, startup settings are not imported at first run or at manual import. If you don't configure this policy, startup settings are imported at first run, and users can choose whether to import this data manually by selecting browser settings option during later browsing sessions. You can set this policy as a recommendation. This means that Microsoft Edge will import startup settings on first run, but users can select or clear browser settings option during manual import. Note: This policy currently manages importing from Microsoft Edge Legacy and Google Chrome (on Windows 7, 8, and 10) browsers.

Why It's Important: This policy prevents Microsoft Edge from importing startup settings such as homepages or new tab configurations from other browsers. It helps maintain a standardized browsing environment and prevents external or personal browser settings from being transferred to managed devices.

Learn More

Description: This policy sets the media autoplay policy for websites. The default setting, "Not configured" respects the current media autoplay settings and lets users configure their autoplay settings. Setting to "Enabled" sets media autoplay to "Allow". All websites are allowed to autoplay media. Users can’t override this policy. Setting to "Disabled" sets media autoplay to "Block". No websites are allowed to autoplay media. Users can’t override this policy. A tab will need to be closed and re-opened for this policy to take effect.

Why It's Important: This policy blocks websites from automatically playing audio or video content. It helps reduce distractions, improves performance, and prevents sites from initiating unwanted media that could contain intrusive ads or track user behavior.

Learn More

Description: This policy prevents Microsoft from collecting a user's Microsoft Edge browsing history to be used for personalizing advertising, search, news and other Microsoft services. This setting is only available for users with a Microsoft account. This setting is not available for child accounts or enterprise accounts. If you disable this policy, users can't change or override the setting. If this policy is enabled or not configured, Microsoft Edge will default to the user’s preference.

Why It's Important: This policy stops Microsoft Edge from sending users’ browsing history to Microsoft for personalized ads, news, or search recommendations. Disabling this feature helps protect user privacy and ensures browsing data stays local, which is critical for compliance in managed or enterprise environments.

Learn More

Description: Prevents Microsoft Edge from occasionally sending queries to a browser network time service to retrieve an accurate timestamp. If you disable this policy, Microsoft Edge will stop sending queries to a browser network time service. If you enable this policy or don't configure it, Microsoft Edge will occasionally send queries to a browser network time service.

Why It's Important: This policy disables Edge from contacting Microsoft’s network time service to fetch time synchronization data. It helps prevent unnecessary outbound connections and supports strict network control policies, ensuring that only approved time synchronization sources are used.

Learn More

Description: Allows use of the QUIC protocol in Microsoft Edge. If you enable this policy or don't configure it, the QUIC protocol is allowed. If you disable this policy, the QUIC protocol is blocked. QUIC is a transport layer network protocol that can improve performance of web applications that currently use TCP.

Why It's Important: This policy disables the QUIC protocol in Microsoft Edge to ensure all web traffic uses traditional, inspectable transport methods such as HTTPS over TCP. It helps maintain network visibility for monitoring and compliance while reducing potential security and compatibility issues in managed environments.

Learn More

Description: This policy controls the audio process sandbox. If you enable this policy, the audio process will run sandboxed. If you disable this policy, the audio process will run unsandboxed and the WebRTC audio-processing module will run in the renderer process. This leaves users open to security risks related to running the audio subsystem unsandboxed. If you don't configure this policy, the default configuration for the audio sandbox will be used, which might differ based on the platform. This policy is intended to give enterprises flexibility to disable the audio sandbox if they use security software setups that interfere with the sandbox.

Why It's Important: This policy enables the audio process sandbox in Microsoft Edge, isolating audio handling from the main browser process. It helps protect users from potential exploits targeting the audio subsystem and improves overall browser security by containing untrusted code in a restricted environment.

Learn More

Description: This policy allows users to reload unconfigured sites (that are not configured in the Enterprise Mode Site List) in Internet Explorer mode when browsing in Microsoft Edge and a site requires Internet Explorer for compatibility. After a site has been reloaded in Internet Explorer mode, "in-page" navigations will stay in Internet Explorer mode (for example, a link, script, or form on the page, or a server-side redirect from another "in-page" navigation). Users can choose to exit from Internet Explorer mode, or Microsoft Edge will automatically exit from Internet Explorer mode when a navigation that isn't "in-page" occurs (for example, using the address bar, the back button, or a favorite link). Users can also optionally tell Microsoft Edge to use Internet Explorer mode for the site in the future. This choice will be remembered for a length of time managed by the 'InternetExplorerIntegrationLocalSiteListExpirationDays' (Specify the number of days that a site remains on the local IE mode site list) policy. If the 'InternetExplorerIntegrationLevel' (Configure Internet Explorer integration) policy is set to 'IEMode', then sites explicitly configured by the 'InternetExplorerIntegrationSiteList' (Configure the Enterprise Mode Site List) policy's site list to use Microsoft Edge can't be reloaded in Internet Explorer mode, and sites configured by the site list or by the 'SendIntranetToInternetExplorer' (Send all intranet sites to Internet Explorer) policy to use Internet Explorer mode can't exit from Internet Explorer mode. If you enable this policy, users are allowed to reload unconfigured sites in Internet Explorer mode. If you disable this policy, users aren't allowed to reload unconfigured sites in Internet Explorer mode. Note that if you enable this policy, it takes precedence over how you configured the 'InternetExplorerIntegrationTestingAllowed' (Allow Internet Explorer mode testing) policy, and that policy will be disabled.

Why It's Important: This policy prevents users from manually reloading unlisted or unapproved sites in Internet Explorer mode. It ensures that only sites defined by enterprise policies can use IE mode, reducing the risk of compatibility abuse, inconsistent rendering, or exposure to legacy security vulnerabilities.

Learn More

Description: Microsoft Edge uses the Edge Feedback feature (enabled by default) to allow users to send feedback, suggestions or customer surveys and to report any issues with the browser. Also, by default, users can't disable (turn off) the Edge Feedback feature. If you enable this policy or don't configure it, users can invoke Edge Feedback. If you disable this policy, users can't invoke Edge Feedback.

Why It's Important: This policy disables the ability for users to send feedback or diagnostic reports through Microsoft Edge. It helps maintain privacy and compliance by preventing unapproved data submissions or telemetry sharing from managed and privileged devices.

Learn More

Description: This policy disables and completely hides the Family safety page in Settings. Navigation to edge://settings/familysafety will also be blocked. The Family safety page describes what features are available for family groups and how to join a family group.

Why It's Important: This policy disables and hides Family Safety settings in Microsoft Edge, ensuring that consumer-oriented parental control options are not visible or accessible on enterprise or privileged systems. It keeps managed configurations consistent and prevents users from linking work profiles with personal family accounts.

Learn More

Description: Allow users to open files using the ClickOnce protocol. The ClickOnce protocol allows websites to request that the browser open files from a specific URL using the ClickOnce file handler on the user's computer or device. If you enable this policy, users can open files using the ClickOnce protocol. This policy overrides the user's ClickOnce setting in the edge://flags/ page. If you disable this policy, users can't open files using the ClickOnce protocol. Instead, the file will be saved to the file system using the browser. This policy overrides the user's ClickOnce setting in the edge://flags/ page. If you don't configure this policy, users can't open files using the ClickOnce protocol. Users have the option to enable the use of the ClickOnce protocol with the edge://flags/ page. Disabling ClickOnce may prevent ClickOnce applications (.application files) from launching properly.

Why It's Important: This policy disables the ClickOnce protocol in Microsoft Edge to prevent websites from automatically launching local applications or file handlers. It helps protect against malicious sites that could exploit this mechanism to run untrusted code or trigger unwanted software installations.

Learn More

Description: Allow users to open files using the DirectInvoke protocol. The DirectInvoke protocol allows websites to request that the browser open files from a specific URL using a specific file handler on the user's computer or device. If you enable or don't configure this policy, users can open files using the DirectInvoke protocol. If you disable this policy, users can't open files using the DirectInvoke protocol. Instead, the file will be saved to the file system. Note: Disabling DirectInvoke may prevent certain Microsoft SharePoint Online features from working as expected.

Why It's Important: This policy disables the DirectInvoke protocol to stop websites from directly opening files with local applications. It prevents untrusted web content from bypassing download protections and launching files automatically, reducing the risk of malicious code execution.

Learn More

Description: [coming soon]

Why It's Important: This policy stops websites from checking whether users have saved payment methods in Microsoft Edge. It helps protect financial privacy by preventing sites from detecting or profiling stored payment data, even if no transaction occurs.

Learn More

Description: Disables the internal PDF viewer in Microsoft Edge. If you enable this policy Microsoft Edge treats PDF files as downloads and lets users open them with the default application. If you don't configure this policy or disable it, Microsoft Edge will open PDF files (unless the user disables it).

Why It's Important: This policy allows Microsoft Edge to open PDF files using its built-in viewer instead of forcing downloads. It provides a secure, sandboxed environment for viewing PDFs without requiring external software, reducing the risk of malware from untrusted PDF readers.

Learn More

Description: Set whether to ask where to save a file before downloading it. If you enable this policy, the user is asked where to save each file before downloading; if you don't configure it, files are saved automatically to the default location, without asking the user. If you don't configure this policy, the user will be able to change this setting.

Why It's Important: This policy disables prompts asking users where to save files before downloading. It ensures that all downloads automatically go to a predefined secure directory, reducing user error, enforcing consistency, and simplifying management on enterprise devices.

Learn More

Description: This policy controls the use of code integrity guard in the browser process, which only allows Microsoft signed binaries to load. Setting this policy to Enabled will enable code integrity guard in the browser process. Setting this policy to Disabled, or if the policy is not set, will prevent the browser from enabling code integrity guard in the browser process. The policy value Audit (1) is obsolete as of version 110. Setting this value is equivalent to the Disabled value. This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, or Windows 10 Pro or Enterprise instances that enrolled for device management. This policy will only take effect on Windows 10 RS2 and above. Policy options mapping: * Disabled (0) = Do not enable code integrity guard in the browser process. * Audit (1) = Enable code integrity guard audit mode in the browser process. * Enabled (2) = Enable code integrity guard enforcement in the browser process. Use the preceding information when configuring this policy.

Why It's Important: This policy enforces Code Integrity Guard (CIG) for the Microsoft Edge browser process, allowing only Microsoft-signed binaries to load. It helps protect against malicious code injection, ensuring that only trusted and verified code runs within the browser for stronger endpoint security.

Learn More

Description: Set whether the browser can leverage Online Text to Speech voice fonts, part of Azure Cognitive Services. These voice fonts are higher quality than the pre-installed system voice fonts. If you enable or don't configure this policy, web-based applications that use the SpeechSynthesis API can use Online Text to Speech voice fonts. If you disable this policy, the voice fonts aren't available.

Why It's Important: This policy disables the use of Azure-powered Online Text to Speech voices in Microsoft Edge. It prevents browser content from sending text to external cloud services for processing, helping protect sensitive information and maintain privacy on managed or secured devices.

Learn More

Description: Set whether websites can use the W3C Web Speech API to recognize speech from the user. The Microsoft Edge implementation of the Web Speech API uses Azure Cognitive Services, so voice data will leave the machine. If you enable or don't configure this policy, web-based applications that use the Web Speech API can use Speech Recognition. If you disable this policy, Speech Recognition is not available through the Web Speech API.

Why It's Important: This policy disables web-based speech recognition in Microsoft Edge, preventing audio data from being sent to Azure Cognitive Services for processing. It helps protect user privacy and ensures that voice data never leaves the local device, which is critical for compliance in secured environments.

Learn More

Description: If you set this policy to 'ShareAllowed' (0, the default), users will be able to access the Windows 10 Share experience from the Settings and More Menu in Microsoft Edge to share with other apps on the system. If you set this policy to 'ShareDisallowed' (1), users won't be able to access the Windows 10 Share experience. If the Share button is on the toolbar, it will also be hidden. * 0 = Allow using the Share experience * 1 = Don't allow using the Share experience.

Why It's Important: This policy manages whether users can use the Windows Share feature from Microsoft Edge. Disabling or limiting the Share experience helps prevent accidental or unauthorized sharing of web content or sensitive information through external applications.

Learn More

Description: Set whether websites can access serial ports. You can completely block access or ask the user each time a website wants to get access to a serial port. Setting the policy to 3 lets websites ask for access to serial ports. Setting the policy to 2 denies access to serial ports. You can override this policy for specific URL patterns by using the 'SerialAskForUrls' (Allow the Serial API on specific sites) and 'SerialBlockedForUrls' (Block the Serial API on specific sites) policies. If you don't configure this policy, by default, websites can ask users whether they can access a serial port, and users can change this setting. Policy options mapping: * BlockSerial (2) = Do not allow any site to request access to serial ports via the Serial API * AskSerial (3) = Allow sites to ask for user permission to access a serial port Use the preceding information when configuring this policy.

Why It's Important: This policy controls whether websites can access serial ports on a device. Blocking or limiting access helps prevent unauthorized sites from interacting with connected hardware, protecting against data leaks, device tampering, or exploitation of serial communication channels.

Learn More

Description: Control where developer tools can be used. If you set this policy to 'DeveloperToolsDisallowedForForceInstalledExtensions' (0, the default), users can access the developer tools and the JavaScript console in general, but not in the context of extensions installed by enterprise policy. If you set this policy to 'DeveloperToolsAllowed' (1), users can access the developer tools and the JavaScript console in all contexts, including extensions installed by enterprise policy. If you set this policy to 'DeveloperToolsDisallowed' (2), users can't access the developer tools or inspect website elements. Keyboard shortcuts and menu or context menu entries that open the developer tools or the JavaScript Console are disabled. * 0 = Block the developer tools on extensions installed by enterprise policy, allow in other contexts * 1 = Allow using the developer tools * 2 = Don't allow using the developer tools.

Why It's Important: This policy controls when and where Microsoft Edge developer tools can be accessed. Limiting access helps prevent tampering with enterprise-managed extensions or site code, reducing the risk of unauthorized debugging, data extraction, or policy circumvention.

Learn More

Description: Enables the AutoFill feature and allows users to auto-complete address information in web forms using previously stored information. If you disable this policy, AutoFill never suggests or fills in address information, nor does it save additional address information that the user might submit while browsing the web. If you enable this policy or don't configure it, users can control AutoFill for addresses in the user interface. Note that if you disable this policy you also stop all activity for all web forms, except payment and password forms. No further entries are saved, and Microsoft Edge won't suggest or AutoFill any previous entries.

Why It's Important: This policy disables the AutoFill feature for address information in Microsoft Edge to prevent personal or sensitive data from being automatically stored or entered into web forms. It helps protect user privacy and ensures that only authorized data entry occurs on managed or secure systems.

Learn More

Description: Enables Microsoft Edge's AutoFill feature and lets users auto complete payment instruments like credit or debit cards in web forms using previously stored information. This includes suggesting new payment instruments like Buy Now Pay Later (BNPL) in web forms and Express Checkout. If you enable this policy or don't configure it, users can control AutoFill for payment instruments. If you disable this policy, AutoFill never suggests, fills, or recommends new payment Instruments. Additionally, it won't save any payment instrument information that users submit while browsing the web.

Why It's Important: This policy disables the ability for Microsoft Edge to store or automatically fill payment card information in web forms. It helps prevent financial data exposure, ensuring that payment information is never cached or reused outside secure, approved payment workflows.

Learn More

Description: Enable the option to allow the use of guest profiles in Microsoft Edge. In a guest profile, the browser doesn't import browsing data from existing profiles, and it deletes browsing data when all guest profiles are closed. If you enable this policy or don't configure it, Microsoft Edge lets users browse in guest profiles. If you disable this policy, Microsoft Edge doesn't let users browse in guest profiles.

Why It's Important: This policy disables guest mode in Microsoft Edge to prevent users from browsing without accountability or local policy enforcement. It ensures all browsing activity occurs under managed profiles where security, compliance, and monitoring policies can be properly applied.

Learn More

Description: Enables web search suggestions in Microsoft Edge's Address Bar and Auto-Suggest List and prevents users from changing this policy. If you enable this policy, web search suggestions are used. If you disable this policy, web search suggestions are never used, however local history and local favorites suggestions still appear. If you disable this policy, neither the typed characters, nor the URLs visited will be included in telemetry to Microsoft. If this policy is left not set, search suggestions are enabled but the user can change that.

Why It's Important: This policy disables web search suggestions in Microsoft Edge to prevent typed characters and URLs from being sent to Microsoft or external services. It helps protect user privacy and ensures that search data stays local, while still allowing suggestions from history and favorites.

Learn More

Description: Lets you allow users to access the Collections feature, where they can collect, organize, share, and export content more efficiently and with Office integration. If you enable or don't configure this policy, users can access and use the Collections feature in Microsoft Edge. If you disable this policy, users can't access and use Collections in Microsoft Edge.

Why It's Important: This policy disables the Collections feature in Microsoft Edge to prevent users from storing or sharing webpage content through browser-based collections. It helps reduce data retention and sharing risks, ensuring sensitive information stays within approved enterprise tools.

Learn More

Description: The web capture feature is rebranded to "Screenshot". Enables the Screenshot feature in Microsoft Edge. This feature lets users capture web and PDF content, and annotate captures using inking tools. Users can also do a visual image search based on the captured content. If you enable or don't configure this policy, the Screenshot option appears in the context menu, the Settings and more menu, and by using the keyboard shortcut, CTRL+SHIFT+S. If you disable this policy, users can't access this feature in Microsoft Edge.

Why It's Important: This policy disables the Screenshot feature in Microsoft Edge to prevent users from capturing or sharing web or PDF content directly from the browser. It helps protect sensitive information and reduce the risk of data leakage in managed or high-security environments.

Learn More

Description: Enables the integrated Microsoft translation service on Microsoft Edge. If you enable this policy, Microsoft Edge offers translation functionality to the user by showing an integrated translate flyout when appropriate, and a translate option on the right-click context menu. Disable this policy to disable all built-in translate features. If you don't configure the policy, users can choose whether to use the translation functionality or not.

Why It's Important: This policy disables Microsoft Edge’s built-in translation feature to prevent text and page content from being sent to external translation services. It helps maintain data privacy and ensures that sensitive or internal information isn’t transmitted outside the organization.

Learn More

Description: Enables Windows to index Microsoft Edge browsing data stored locally on the user's device and allows users to find and launch previously stored browsing data directly from Windows features such as the search box on the taskbar in Windows. If you enable this policy or don't configure it, Microsoft Edge will publish local browsing data to the Windows Indexer. If you disable this policy, Microsoft Edge will not share data to the Windows Indexer. Note that if you disable this policy, Microsoft Edge will remove the data shared with Windows on the device and stop sharing any new browsing data.

Why It's Important: This policy disables Windows from indexing Edge browsing data stored locally. It helps maintain user privacy and prevents sensitive or privileged browsing information from appearing in Windows search results or being accessible through the system indexer.

Learn More

Description: Enables Microsoft Edge mini menu on websites and PDFs. The mini menu is triggered on text selection and has basic actions like copy and smart actions like definitions. If you enable or don't config this policy, selecting text on websites and PDFs will show the Microsoft Edge mini menu. If you disable this policy, the Microsoft Edge mini menu will not be shown when text on websites and PDFs is selected.

Why It's Important: This policy disables the Microsoft Edge mini menu that appears when users select text on websites or PDFs. It helps reduce distractions, prevents unneeded data lookups, and maintains a simplified, focused browser experience on managed or privileged devices.

Learn More

Description: This policy lets you enhance the security state in Microsoft Edge. If you set this policy to 'StandardMode', the enhanced mode will be turned off and Microsoft Edge will fallback to its standard security mode. If you set this policy to 'BalancedMode', the security state will be in balanced mode. If you set this policy to 'StrictMode', the security state will be in strict mode. If you set this policy to 'BasicMode', the security state will be in basic mode. Note: Sites that use WebAssembly (WASM) are not currently supported when 'EnhanceSecurityMode' (Enhance the security state in Microsoft Edge) is enabled. Policy options mapping: * StandardMode (0) = Standard mode * BalancedMode (1) = Balanced mode * StrictMode (2) = Strict mode * BasicMode (2) = Basic mode Use the preceding information when configuring this policy.

Why It's Important: This policy enables enhanced security mode in Microsoft Edge, which applies additional protections to reduce the risk of web-based attacks. It limits potentially unsafe browser features and strengthens defenses against exploits, helping protect users and data on managed devices.

Learn More

Description: WebSQL is on by default as of Microsoft Edge version 101, but can be disabled via a Microsoft Edge flag. If you enable this policy, WebSQL cannot be disabled. If you disable or don't configure this policy, WebSQL can be disabled.

Why It's Important: This policy disables the ability to force WebSQL, an outdated web storage technology, to remain enabled in Microsoft Edge. It helps maintain browser security and performance by allowing the deprecation of legacy storage features in favor of more secure modern standards like IndexedDB.

Learn More

Description: If you enable this policy, the First-run experience and the splash screen will not be shown to users when they run Microsoft Edge for the first time. For the configuration options shown in the First Run Experience, the browser will default to the following: -On the New Tab Page, the feed type will be set to MSN News and the layout to Inspirational. -The user will still be automatically signed into Microsoft Edge if the Windows account is of Azure AD or MSA type. -Sync will not be enabled by default and users will be able to turn on sync from the sync settings. If you disable or don't configure this policy, the First-run experience and the Splash screen will be shown. Note: The specific configuration options shown to the user in the First Run Experience, can also be managed by using other specific policies. You can use the HideFirstRunExperience policy in combination with these policies to configure a specific browser experience on your managed devices. Some of these other policies are: -'AutoImportAtFirstRun' (Automatically import another browser's data and settings at first run) -'NewTabPageLocation' (Configure the new tab page URL) -'NewTabPageSetFeedType' (Configure the Microsoft Edge new tab page experience) -'SyncDisabled' (Disable synchronization of data using Microsoft sync services) -'BrowserSignin' (Browser sign-in settings) -'NonRemovableProfileEnabled' (Configure whether a user always has a default profile automatically signed in with their work or school account).

Why It's Important: This policy hides the Microsoft Edge first-run experience and splash screen, allowing users to start the browser without setup prompts or configuration screens. It helps create a consistent, managed browser environment on enterprise or privileged devices by applying predefined settings automatically.

Learn More

Description: If you enable this policy, all supported datatypes and settings from the specified browser will be silently and automatically imported at first run. During the First Run Experience, the import section will also be skipped. The browser data from Microsoft Edge Legacy will always be silently migrated at the first run, irrespective of the value of this policy. You can use the following values for this policy: * 0 = Automatically imports all supported datatypes and settings from the default browser * 1 = Automatically imports all supported datatypes and settings from Internet Explorer * 2 = Automatically imports all supported datatypes and settings from Google Chrome * 3 = Automatically imports all supported datatypes and settings from Safari * 4 = Disables automatic import, and the import section of the first-run experience is skipped * 5 = Automatically imports all supported datatypes and settings from Mozilla Firefox If this policy is set to the default value (0), then the datatypes corresponding to the default browser on the managed device will be imported. If the browser specified as the value of this policy is not present in the managed device, Microsoft Edge will simply skip the import without any notification to the user. If you set this policy to 'DisabledAutoImport' (4), the import section of the first-run experience is skipped entirely and Microsoft Edge doesn't import browser data and settings automatically. If this policy is set to the value of Internet Explorer (1), the following datatypes will be imported from Internet Explorer: 1. Favorites or bookmarks 2. Saved passwords 3. Search engines 4. Browsing history 5. Home page If this policy is set to the value of Google Chrome (2), the following datatypes will be imported from Google Chrome: 1. Favorites 2. Saved passwords 3. Addresses and more 4. Payment info 5. Browsing history 6. Settings 7. Pinned and Open tabs 8. Extensions 9. Cookies. If this policy is set to the value of Safari (3), the following datatypes will be imported from Safari: 1. Favorites or bookmarks 2. Browsing history Starting with Microsoft Edge version 83, if this policy is set to the value of Mozilla Firefox (5), the following datatypes will be imported from Mozilla Firefox: 1. Favorites or bookmarks 2. Saved passwords 3. Addresses and more 4. Browsing History If you want to restrict specific datatypes from getting imported on the managed devices, you can use this policy with other policies such as 'ImportAutofillFormData' (Allow importing of autofill form data), 'ImportBrowserSettings' (Allow importing of browser settings), 'ImportFavorites' (Allow importing of favorites), and etc.

Why It's Important: This policy controls whether Microsoft Edge automatically imports data such as favorites, passwords, and browsing history from other browsers during first launch. Enabling it can help streamline onboarding and improve user experience when transitioning to Edge on managed devices.

Learn More

Description: Allows you to set whether users can view publicly accessible Office files on the web that aren't on OneDrive or SharePoint. (For example: Word documents, PowerPoint presentations, and Excel spreadsheets) If you enable or don't configure this policy, these files can be viewed in Microsoft Edge using Office Viewer instead of downloading the files. If you disable this policy, these files will be downloaded to be viewed.

Why It's Important: This policy disables the ability to open publicly accessible Office files directly in Microsoft Edge. It helps prevent data exposure by requiring users to download and open files in secure, managed Office applications instead of viewing them through the browser.

Learn More

Description: This policy controls sending required and optional diagnostic data about browser usage to Microsoft. Required diagnostic data is collected to keep Microsoft Edge secure, up to date and performing as expected. Optional diagnostic data includes data about how you use the browser, websites you visit and crash reports to Microsoft for product and service improvement. Up to version 121, this policy is not supported on Windows 10 devices. To control this data collection on Windows 10 for 121 and previous, IT admins must use the Windows diagnostic data group policy. This policy will either be 'Allow Telemetry' or 'Allow Diagnostic Data', depending on the version of Windows. For version 122 and later, this policy is supported on Windows 10 devices to allow controlling Microsoft Edge data collection separately from Windows 10 diagnostics data collection. Use one of the following settings to configure this policy: 'Off' turns off required and optional diagnostic data collection. This option is not recommended. 'RequiredData' sends required diagnostic data but turns off optional diagnostic data collection. Microsoft Edge will send required diagnostic data to keep Microsoft Edge secure, up to date and performing as expected. 'OptionalData' sends optional diagnostic data includes data about browser usage, websites that are visited, crash reports sent to Microsoft for product and service improvement. On Windows 7/macOS, this policy controls sending required and optional data to Microsoft. If you don't configure this policy or disable it, Microsoft Edge will default to the user's preference. Policy options mapping: * Off (0) = Off (Not recommended) * RequiredData (1) = Required data * OptionalData (2) = Optional data Use the preceding information when configuring this policy.

Why It's Important: This policy allows Microsoft Edge to send required diagnostic data and optional usage information to Microsoft. It helps maintain browser security, reliability, and performance by allowing telemetry for issue detection and improvement, while still giving administrators control over the amount of data shared.

Learn More

Description: This policy controls the visibility of the 'Open link in new Internet Explorer mode tab' option on the context menu for file:// links. This setting works in conjunction with: 'InternetExplorerIntegrationLevel' (Configure Internet Explorer integration) is set to 'IEMode'. If you set this policy to true, the 'Open link in new Internet Explorer mode tab' context menu item will be available for file:// links. If you set this policy to false or don't configure it, the context menu item will not be added.

Why It's Important: This policy hides the option to open links in Internet Explorer mode from the Edge context menu. It helps prevent users from manually switching to legacy rendering modes, reducing compatibility risks and maintaining a consistent, modern browsing experience.

Learn More

Description: Shows a launcher bar on the right side of Microsoft Edge's screen. Enable this policy to always show the Sidebar. Disable this policy to never show the Sidebar. If you don't configure the policy, users can choose whether to show the Sidebar.

Why It's Important: This policy disables the Hubs Sidebar in Microsoft Edge to keep the browser interface clean and focused. It helps reduce distractions and prevents access to sidebar apps or web tools that are not approved for managed or privileged devices.

Learn More

Description: Allows Microsoft Edge to display links recently shared by or shared with the user from Microsoft 365 apps in History. If you enable or don't configure this policy, Microsoft Edge displays links recently shared by or shared with the user from Microsoft 365 apps in History. If you disable this policy, Microsoft Edge does not display links recently shared by or shared with the user from Microsoft 365 apps in History. The control in Microsoft Edge settings is disabled and set to off. This policy only applies for Microsoft Edge local user profiles and profiles signed in using Azure Active Directory.

Why It's Important: This policy disables the display of Microsoft 365 shared links in the browser history. It helps protect user privacy and prevents sensitive or work-related collaboration links from appearing in browsing records where they could be exposed to unauthorized users.

Learn More

Description: Show Microsoft Rewards experience and notifications. If you enable this policy: - Microsoft account users (excludes Azure AD accounts) in search and earn markets will see the Microsoft Rewards experience in their Microsoft Edge user profile. - The setting to enable Microsoft Rewards in Microsoft Edge settings will be enabled and toggled on. - The setting to enable Give mode will be enabled and respect the user's setting. If you disable this policy: - Microsoft account users (excludes Azure AD accounts) in search and earn markets will not see the Microsoft Rewards experience in their Microsoft Edge user profile. - The setting to enable Microsoft Rewards in Microsoft Edge settings will be disabled and toggled off. If you don't configure this policy: - Microsoft account users (excludes Azure AD accounts) in search and earn markets will see the Microsoft Rewards experience in their Microsoft Edge user profile. - The setting to enable Microsoft Rewards in Microsoft Edge settings will be enabled and toggled on. - The setting to enable Give mode will be enabled and respect the user's setting.

Why It's Important: This policy disables Microsoft Rewards in Edge to remove personal reward and incentive features from managed or privileged environments. It helps maintain a professional browser experience, reduce distractions, and prevent any unintended data sharing between personal and organizational accounts.

Learn More

Description: Set this policy to show the Reload in Internet Explorer mode button in the toolbar. Users can hide the button in the toolbar through edge://settings/appearance. The button will only be shown on the toolbar when the 'InternetExplorerIntegrationReloadInIEModeAllowed' (Allow unconfigured sites to be reloaded in Internet Explorer mode) policy is enabled or if the user has chosen to enable "Allow sites to be reloaded in Internet Explorer mode". If you enable this policy, the Reload in Internet mode button is pinned to the toolbar. If you disable or don't configure this policy, the Reload in Internet Explorer mode button isn't shown in the toolbar by default. Users can toggle the Show Internet Explorer mode button in edge://settings/appearance.

Why It's Important: This policy hides the “Reload in Internet Explorer mode” button from the Edge toolbar. It helps simplify the browser interface and ensures users don’t unintentionally switch to legacy IE mode, which is reserved for specific, approved compatibility scenarios.

Learn More

Description: Specifies whether SharedArrayBuffers can be used in a non cross-origin-isolated context. A SharedArrayBuffer is a binary data buffer that can be used to create views on shared memory. SharedArrayBuffers have a memory access vulnerability in several popular CPUs. If you enable this policy, sites are allowed to use SharedArrayBuffers with no restrictions. If you disable or don't configure this policy, sites are allowed to use SharedArrayBuffers only when cross-origin isolated. Microsoft Edge will require cross-origin isolation when using SharedArrayBuffers from Microsoft Edge 91 onward for Web Compatibility reasons.

Why It's Important: This policy disables the use of SharedArrayBuffers in non–cross-origin-isolated contexts to protect against side-channel attacks like Spectre and Meltdown. It ensures web pages can only use shared memory in secure, isolated environments, reducing the risk of data leakage between browser processes.

Learn More

Description: Standalone Sidebar is an optional mode for the Sidebar in Microsoft Edge. When this mode is activated by a user, the Sidebar appears in a fixed position on the Microsoft Windows desktop, and is hidden from the browser application frame. If you enable or don't configure this policy, users will have the ability to activate the Standalone Sidebar. If you disable this policy, options to activate Standalone Sidebar will be hidden or made unavailable. Note that blocking 'HubsSidebarEnabled' (Show Hubs Sidebar) will also prevent users from accessing Standalone Sidebar.

Why It's Important: This policy disables the Standalone Sidebar in Microsoft Edge to prevent users from running persistent web content outside the main browser window. It helps maintain focus on approved applications and reduces the risk of exposing sensitive data through side-loaded web tools or extensions.

Learn More

Description: Configures users ability to override state of feature flags. If you set this policy to 'CommandLineOverridesEnabled', users can override state of feature flags using command line arguments but not edge://flags page. If you set this policy to 'OverridesEnabled', users can override state of feature flags using command line arguments or edge://flags page. If you set this policy to 'OverridesDisabled', users can't override state of feature flags using command line arguments or edge://flags page. If you don't configure this policy, the behavior is the same as the 'OverridesEnabled'. Policy options mapping: * CommandLineOverridesEnabled (2) = Allow users to override feature flags using command line arguments only * OverridesEnabled (1) = Allow users to override feature flags * OverridesDisabled.

Why It's Important: This policy controls whether users can change Microsoft Edge feature flags. It allows administrators to decide if testing or troubleshooting requires flexibility, while still keeping control over which experimental features can be enabled in managed environments.

Learn More

Description: Controls whether insecure websites are allowed to make requests to more-private network endpoints. This policy relates to the CORS-RFC1918 specification. A network endpoint is more private than another if: 1) Its IP address is localhost and the other is not. 2) Its IP address is private and the other is public. In the future, depending on spec evolution, this policy might apply to all cross-origin requests directed at private IPs or localhost. A website is deemed secure if it meets the definition of a secure context in https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts. Otherwise, it will be treated as an insecure context. When this policy is either not set or set to false, the default behavior for requests from insecure contexts to more-private network endpoints will depend on the user's personal configuration for the BlockInsecurePrivateNetworkRequests feature, which may be set by a field trial or on the command line. When this policy is set to true, insecure websites are allowed to make requests to any network endpoint, subject to other cross-origin checks.

Why It's Important: This policy blocks insecure websites from making requests to private or local network addresses. It helps protect internal resources from being accessed or exploited through malicious web pages, reducing the risk of cross-network attacks.

Learn More

Description: This policy setting lets you configure whether to turn on Edge TyposquattingChecker. Edge TyposquattingChecker provides warning messages to help protect your users from potential typosquatting sites. By default, Edge TyposquattingChecker is turned on. If you enable this policy, Edge TyposquattingChecker is turned on. If you disable this policy, Edge TyposquattingChecker is turned off. If you don't configure this policy, Edge TyposquattingChecker is turned on but users can choose whether to use Edge TyposquattingChecker.

Why It's Important: This policy enables Microsoft Edge’s Typosquatting Checker, which warns users if they mistype a web address that could lead to a fraudulent or malicious site. It helps protect against phishing and credential theft caused by look-alike domain names.

Learn More

Description: Enable this policy to enable Google Cast. Users will be able to launch it from the app menu, page context menus, media controls on Cast-enabled websites, and (if shown) the Cast toolbar icon. Disable this policy to disable Google Cast. By default, Google Cast is enabled.

Why It's Important: This policy disables Google Cast in Microsoft Edge to prevent users from wirelessly sharing browser content to external displays or devices. It helps reduce data leakage risks and ensures sensitive information stays within managed systems.

Learn More

Description: Microsoft Edge Workspaces helps improve productivity for users in your organization. If you enable this policy, users will be able to access the Microsoft Edge Workspaces feature. If you disable or don't configure this policy, users will not be able to access the Microsoft Edge Workspaces feature.

Why It's Important: This policy disables Microsoft Edge Workspaces to limit data sharing and collaborative browsing on privileged or managed devices. It helps maintain security by preventing users from unintentionally exposing sensitive information through shared browser sessions.

Learn More

Description: If you enable this policy or leave it unset, Basic authentication challenges received over non-secure HTTP will be allowed. If you disable this policy, non-secure HTTP requests from the Basic authentication scheme are blocked, and only secure HTTPS is allowed. This policy setting is ignored (and Basic is always forbidden) if the 'AuthSchemes' (Supported authentication schemes) policy is set and does not include Basic.

Why It's Important: This policy blocks the use of Basic authentication over unsecured HTTP connections. It helps protect user credentials from being sent in plain text, reducing the risk of interception or credential theft during transmission.

Learn More

Description: Specifies which HTTP authentication schemes are supported. You can configure the policy by using these values: 'basic', 'digest', 'ntlm', and 'negotiate'. Separate multiple values with commas. If you don't configure this policy, all four schemes are used. Example value: basic,digest,ntlm,negotiate.

Why It's Important: This policy enables control over which HTTP authentication methods are allowed in Microsoft Edge. It helps enforce secure authentication standards and prevents the use of outdated or less secure methods when accessing enterprise websites or internal systems.

Learn More

Description: Allow Microsoft Edge to monitor user passwords. If you enable this policy, the user will get alerted if any of their passwords stored in Microsoft Edge are found to be unsafe. Microsoft Edge will show an alert and this information will also be available in Settings > Passwords > Password Monitor. If you disable this policy, users will not be asked for permission to enable this feature. Their passwords will not be scanned and they will not be alerted either. If you don't configure the policy, users can turn this feature on or off. This policy can be set as both Recommended as well as Mandatory, however with an important callout. Mandatory enabled: If the policy is set to Mandatory enabled, the UI in Settings will be disabled but remain in 'On' state, and a briefcase icon will be made visible next to it with this description displayed on hover - "This setting is managed by your organization." Recommended enabled: If the policy is set to Recommended enabled, the UI in Settings will remain in 'Off' state, but a briefcase icon will be made visible next to it with this description displayed on hover - "Your organization recommends a specific value for this setting and you have chosen a different value" Mandatory and Recommended disabled: Both these states will work the normal way, with the usual captions being shown to users.

Why It's Important: This policy disables password monitoring alerts in Microsoft Edge. It’s used in managed environments where password security is already enforced through enterprise identity systems like Entra ID or SHIELD, which handle breach detection and credential protection at a higher level.

Learn More

Description: Configures the Password Generator Settings toggle that enables/disables the feature for users. If you enable or don't configure this policy, then Password Generator will offer users a strong and unique password suggestion (via a dropdown) on Signup and Change Password pages. If you disable this policy, users will no longer see strong password suggestions on Signup or Change Password pages.

Why It's Important: This policy disables Edge’s built-in strong password suggestion feature. It’s used in managed environments where passwords are handled through enterprise identity solutions like Microsoft Entra ID or SHIELD-managed authentication, ensuring credentials are created and stored only through approved systems.

Learn More

Description: Allows you to control when to trigger password protection warning. Password protection alerts users when they reuse their protected password on potentially suspicious sites. You can use the 'PasswordProtectionLoginURLs' (Configure the list of enterprise login URLs where password protection service should capture fingerprint of password) and 'PasswordProtectionChangePasswordURL' (Configure the change password URL) policies to configure which passwords to protect. Exemptions: Passwords for the sites listed in 'PasswordProtectionLoginURLs' and 'PasswordProtectionChangePasswordURL', as well as for the sites listed in 'SmartScreenAllowListDomains' (Configure the list of domains for which Microsoft Defender SmartScreen won't trigger warnings), will not trigger a password-protection warning. Set to 'PasswordProtectionWarningOff' (0) to not show password protection warningss. Set to 'PasswordProtectionWarningOnPasswordReuse' (1) to show password protection warnings when the user reuses their protected password on a non-allowlisted site. If you disable or don't configure this policy, then the warning trigger is not shown. * 0 = Password protection warning is off. * 1 = Password protection warning is triggered by password reuse.

Why It's Important: This policy disables password protection warnings in Microsoft Edge, meaning users won’t be alerted when reusing passwords on untrusted sites. It is typically used in managed environments where SHIELD or other enterprise controls already enforce strong password hygiene and prevent unsafe credential use.

Learn More

Description: Configures the change password URL (HTTP and HTTPS schemes only). Password protection service will send users to this URL to change their password after seeing a warning in the browser. If you enable this policy, then password protection service sends users to this URL to change their password. If you disable this policy or don't configure it, then password protection service will not redirect users to a change password URL. This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain or Windows 10 Pro or Enterprise instances that are enrolled for device management.

Why It's Important: This policy enables a custom password change URL in Microsoft Edge, ensuring users are redirected to a trusted, official site when prompted to update their credentials. It helps protect users from phishing attempts and supports secure password recovery within managed environments.

Learn More

Description: The feature helps users add an additional layer of privacy to their online accounts by requiring device authentication (as a way of confirming the user's identity) before the saved password is auto-filled into a web form. This ensures that non-authorized persons can't use saved passwords for autofill. Note that this feature does not protect against locally-running malware. This group policy configures the radio button selector that enables this feature for users. It also has a frequency control where users can specify how often they would like to be prompted for authentication. If you set this policy to 'Automatically', disable this policy, or don't configure this policy, autofill will not have any authentication flow. If you set this policy to 'WithDevicePassword', users will have to enter their device password (or preferred mode of authentication under Windows) to prove their identity before their password is auto filled. Authentication modes include Windows Hello, PIN, face recognition, or fingerprint. The frequency for authentication prompt will be set to 'Ask permission once per browsing session' by default. However, users can change it to the other option, which is 'Always ask permission'. If you set this policy to 'WithCustomPrimaryPassword', users will be asked to create their custom password and then to be redirected to Settings. After the custom password is set, users can authenticate themselves using the custom password and their passwords will get auto-filled after successful authentication. The frequency for authentication prompt will be set to 'Ask permission once per browsing session' by default. However, users can change it to the other option, which is 'Always ask permission'. If you set this policy to 'AutofillOff', saved passwords will no longer be suggested for autofill. Policy options mapping: * Automatically (0) = Automatically * WithDevicePassword (1) = With device password * WithCustomPrimaryPassword (2) = With custom primary password * AutofillOff (3) = Autofill off Use the preceding information when configuring this policy.

Why It's Important: This policy disables the requirement for device authentication before autofilling saved passwords. It simplifies sign-ins for managed users but is only applied in environments where password storage is already tightly controlled through other SHIELD security measures.

Learn More

Description: Enable Microsoft Edge to save user passwords. If you enable this policy, users can save their passwords in Microsoft Edge. The next time they visit the site, Microsoft Edge will enter the password automatically. If you disable this policy, users can't save new passwords, but they can still use previously saved passwords. If you enable or disable this policy, users can't change or override it in Microsoft Edge. If you don't configure it, users can save passwords, as well as turn this feature off.

Why It's Important: This policy prevents Microsoft Edge from saving passwords locally. It helps protect privileged accounts by ensuring credentials are stored only in approved, secure identity systems rather than in the browser.

Learn More

Description: Enables printing in Microsoft Edge and prevents users from changing this setting. If you enable this policy or don't configure it, users can print. If you disable this policy, users can't print from Microsoft Edge. Printing is disabled in the wrench menu, extensions, JavaScript applications, and so on. Users can still print from plug-ins that bypass Microsoft Edge while printing. For example, certain Adobe Flash applications have the print option in their context menu, which isn't covered by this policy.

Why It's Important: This policy disables printing in Microsoft Edge to prevent sensitive or privileged information from being printed or shared outside secure channels. It helps reduce data leakage risks on managed or high-security devices.

Learn More

Description: Define a list of sites, based on URL patterns, that are blocked (your users can't load them). Format the URL pattern according to https://go.microsoft.com/fwlink/?linkid=2095322. You can define exceptions in the 'URLAllowlist' (Define a list of allowed URLs) policy. These policies are limited to 1000 entries; subsequent entries are ignored. Note that blocking internal 'edge://*' URLs isn't recommended - this may lead to unexpected errors. This policy doesn't prevent the page from updating dynamically through JavaScript. For example, if you block 'contoso.com/abc', users might still be able to visit 'contoso.com' and click on a link to visit 'contoso.com/abc', as long as the page doesn't refresh. If you don't configure this policy, no URLs are blocked.

Why It's Important: This policy blocks access to unapproved or risky websites in Microsoft Edge. It helps protect users from phishing pages, malware-hosting sites, and other online threats by limiting browsing to trusted domains only.

Learn More

Description: Allow access to the listed URLs, as exceptions to the URL block list. Format the URL pattern according to https://go.microsoft.com/fwlink/?linkid=2095322. You can use this policy to open exceptions to restrictive block lists. For example, you can include '*' in the block list to block all requests, and then use this policy to allow access to a limited list of URLs. You can use this policy to open exceptions to certain schemes, subdomains of other domains, ports, or specific paths. The most specific filter determines if a URL is blocked or allowed. The allowed list takes precedence over the block list. This policy is limited to 1000 entries; subsequent entries are ignored. If you don't configure this policy, there are no exceptions to the block list in the 'URLBlocklist' (Block access to a list of URLs) policy.

Why It's Important: This policy defines which websites users are allowed to access when general web access is restricted. It helps ensure that only approved and trusted sites remain accessible, supporting secure and compliant browser use for privileged accounts.

Learn More