Description: [coming soon]

Why It's Important: [coming soon]

Learn More

Description: The 'SitePerProcess' policy can be used to prevent users from opting out of the default behavior of isolating all sites. Note that you can also use the 'IsolateOrigins' (Enable site isolation for specific origins) policy to isolate additional, finer-grained origins. If you enable this policy, users can't opt out of the default behavior where each site runs in its own process. If you disable or don’t configure this policy, a user can opt out of site isolation. (For example, by using "Disable site isolation" entry in edge://flags.) Disabling the policy or not configuring the policy doesn't turn off Site Isolation.

Why It's Important: This setting helps protect users by keeping websites separated from each other inside the browser. That means if one site is compromised, it can’t reach into another site’s data—like keeping guests in separate rooms to prevent eavesdropping. SHIELD enables this policy to add strong protection against cross-site attacks and data leaks. It’s like giving each website its own private workspace, so they can’t interfere with each other or steal information.

Learn More

Description: This policy setting lets you configure whether to turn on Microsoft Defender SmartScreen. Microsoft Defender SmartScreen provides warning messages to help protect your users from potential phishing scams and malicious software. By default, Microsoft Defender SmartScreen is turned on. If you enable this setting, Microsoft Defender SmartScreen is turned on. If you disable this setting, Microsoft Defender SmartScreen is turned off. If you don't configure this setting, users can choose whether to use Microsoft Defender SmartScreen. This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain; or on Windows 10 Pro or Enterprise instances that are enrolled for device management.

Why It's Important: This setting helps keep users safe while browsing by warning them about dangerous websites and downloads. It’s like having a security guard that checks every link and file before you open it—blocking threats before they reach your device. SHIELD enables this policy to protect users from phishing attacks, scams, and malware. It’s a proactive defense that works silently in the background, helping users avoid risky clicks and downloads.

Learn More

Description: This policy setting lets you configure whether to turn on blocking for potentially unwanted apps with Microsoft Defender SmartScreen. Potentially unwanted app blocking with Microsoft Defender SmartScreen provides warning messages to help protect users from adware, coin miners, bundleware, and other low-reputation apps that are hosted by websites. Potentially unwanted app blocking with Microsoft Defender SmartScreen is turned off by default. If you enable this setting, potentially unwanted app blocking with Microsoft Defender SmartScreen is turned on. If you disable this setting, potentially unwanted app blocking with Microsoft Defender SmartScreen is turned off. If you don't configure this setting, users can choose whether to use potentially unwanted app blocking with Microsoft Defender SmartScreen. This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain; or on Windows 10 Pro or Enterprise instances that are enrolled for device management.

Why It's Important: This setting helps protect users from shady software that can slow down their computer, show unwanted ads, or sneak in other programs. These apps aren’t full-blown viruses, but they’re still risky and annoying. SHIELD enables this policy to block these unwanted apps before they can cause problems. It’s like having a bouncer at the door who stops sketchy software from getting in—keeping your system clean and secure.

Learn More

Description: [coming soon]

Why It's Important: [coming soon]

Learn More

Description: [coming soon]

Why It's Important: [coming soon]

Learn More

Description: Microsoft Edge shows a warning page when users visit sites that have SSL errors. If you enable or don't configure (default) this policy, users can click through these warning pages. If you disable this policy, users are blocked from clicking through any warning page.

Why It's Important: This policy prevents users from bypassing HTTPS security warnings when visiting sites with invalid or untrusted certificates. It helps protect users from phishing, spoofing, and man-in-the-middle attacks by blocking access to insecure or potentially malicious sites.

Learn More

Description: This policy lets you manage settings for 'AutomaticHttpsDefault' (Configure Automatic HTTPS), which switches connections from HTTP to HTTPS. This feature helps protect against man-in-the-middle attacks by enforcing more secure connections, but users might experience more connection errors. Note: The 'UpgradeCapableDomains' configuration requires a component list, and will not upgrade these connections if 'ComponentUpdatesEnabled' (Enable component updates in Microsoft Edge) is set to 'Disabled'. If you don't configure this policy, 'AutomaticHttpsDefault' will be enabled, and will only upgrade connections on domains likely to support HTTPS. Policy options mapping: * DisableAutomaticHttps (0) = Automatic HTTPS functionality is disabled. * UpgradeCapableDomains (1) = Navigations delivered over HTTP are switched to HTTPS, only on domains likely to support HTTPS. * AlwaysUpgrade (2) = All navigations delivered over HTTP are switched to HTTPS. Connection errors might occur more often. Use the preceding information when configuring this policy.

Why It's Important: This policy enforces the use of Automatic HTTPS in Microsoft Edge, automatically upgrading unsecured HTTP connections to HTTPS whenever possible. It helps protect users from man-in-the-middle attacks, ensuring web traffic is encrypted and secure by default.

Learn More

Description: The 'SitePerProcess' policy can be used to prevent users from opting out of the default behavior of isolating all sites. Note that you can also use the 'IsolateOrigins' (Enable site isolation for specific origins) policy to isolate additional, finer-grained origins. If you enable this policy, users can't opt out of the default behavior where each site runs in its own process. If you disable or don’t configure this policy, a user can opt out of site isolation. (For example, by using "Disable site isolation" entry in edge://flags.) Disabling the policy or not configuring the policy doesn't turn off Site Isolation.

Why It's Important: This policy enforces site isolation for every website in Microsoft Edge, ensuring each site runs in its own browser process. It improves security by preventing malicious or compromised sites from accessing data from other tabs or web origins.

Learn More

Description: Sets the minimum supported version of SSL. If you don't configure this policy, Microsoft Edge uses a default minimum version, TLS 1.0. If you enable this policy, you can set the minimum version to one of the following values: "tls1", "tls1.1" or "tls1.2". When set, Microsoft Edge won't use any version of SSL/TLS lower than the specified version. Any unrecognized value is ignored. * "tls1" = TLS 1.0 * "tls1.1" = TLS 1.1 * "tls1.2" = TLS 1.2 Example value: tls1.

Why It's Important: This policy enforces TLS 1.2 as the minimum version for secure connections in Microsoft Edge. It ensures that all encrypted traffic uses strong, modern cryptographic protocols, protecting users from vulnerabilities found in older versions like TLS 1.0 and 1.1.

Learn More

Description: This policy setting lets you configure whether to turn on Microsoft Defender SmartScreen. Microsoft Defender SmartScreen provides warning messages to help protect your users from potential phishing scams and malicious software. By default, Microsoft Defender SmartScreen is turned on. If you enable this setting, Microsoft Defender SmartScreen is turned on. If you disable this setting, Microsoft Defender SmartScreen is turned off. If you don't configure this setting, users can choose whether to use Microsoft Defender SmartScreen. This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain; or on Windows 10 Pro or Enterprise instances that are enrolled for device management.

Why It's Important: This policy enables Microsoft Defender SmartScreen in Edge, helping protect users from malicious websites, phishing attempts, and unsafe downloads. It provides real-time warnings to prevent users from accidentally accessing or downloading harmful content.

Learn More

Description: This policy setting lets you configure whether to turn on blocking for potentially unwanted apps with Microsoft Defender SmartScreen. Potentially unwanted app blocking with Microsoft Defender SmartScreen provides warning messages to help protect users from adware, coin miners, bundleware, and other low-reputation apps that are hosted by websites. Potentially unwanted app blocking with Microsoft Defender SmartScreen is turned off by default. If you enable this setting, potentially unwanted app blocking with Microsoft Defender SmartScreen is turned on. If you disable this setting, potentially unwanted app blocking with Microsoft Defender SmartScreen is turned off. If you don't configure this setting, users can choose whether to use potentially unwanted app blocking with Microsoft Defender SmartScreen. This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain; or on Windows 10 Pro or Enterprise instances that are enrolled for device management.

Why It's Important: This policy turns on blocking for potentially unwanted applications (PUAs) in Microsoft Edge. It helps protect users from low-reputation apps such as adware, coin miners, and bundled software that can reduce performance or compromise privacy.

Learn More

Description: This policy lets you configure whether to enable DNS requests made by Microsoft Defender SmartScreen. Note: Disabling DNS requests will prevent Microsoft Defender SmartScreen from getting IP addresses, and potentially impact the IP-based protections provided. If you enable or don't configure this setting, Microsoft Defender SmartScreen will make DNS requests. If you disable this setting, Microsoft Defender SmartScreen will not make any DNS requests. This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, Windows 10 Pro or Enterprise instances that enrolled for device management, or macOS instances that are that are managed via MDM or joined to a domain via MCX.

Why It's Important: This policy allows Microsoft Defender SmartScreen to make DNS requests, which are needed to identify and block malicious websites and downloads. Enabling it ensures SmartScreen has full visibility into potential threats, improving protection accuracy.

Learn More

Description: This policy setting lets you configure whether Microsoft Defender SmartScreen checks download reputation from a trusted source. If you enable or don't configure this setting, Microsoft Defender SmartScreen checks the download’s reputation regardless of source. If you disable this setting, Microsoft Defender SmartScreen doesn’t check the download’s reputation when downloading from a trusted source. This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain; or on Windows 10 Pro or Enterprise instances that are enrolled for device management.

Why It's Important: This policy makes sure SmartScreen checks the safety of all downloads, even from trusted or familiar sources. It helps protect users from compromised or spoofed websites that may appear safe but deliver malicious files.

Learn More

Description: This policy setting lets you decide whether users can override the Microsoft Defender SmartScreen warnings about potentially malicious websites. If you enable this setting, users can't ignore Microsoft Defender SmartScreen warnings and they are blocked from continuing to the site. If you disable or don't configure this setting, users can ignore Microsoft Defender SmartScreen warnings and continue to the site. This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain; or on Windows 10 Pro or Enterprise instances that are enrolled for device management.

Why It's Important: This policy prevents users from bypassing Microsoft Defender SmartScreen warnings when visiting potentially dangerous websites. It helps protect against phishing, credential theft, and malicious sites by ensuring users can’t ignore security alerts.

Learn More

Description: This policy lets you determine whether users can override Microsoft Defender SmartScreen warnings about unverified downloads. If you enable this policy, users in your organization can't ignore Microsoft Defender SmartScreen warnings, and they're prevented from completing the unverified downloads. If you disable or don't configure this policy, users can ignore Microsoft Defender SmartScreen warnings and complete unverified downloads. This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain; or on Windows 10 Pro or Enterprise instances that are enrolled for device management.

Why It's Important: This policy stops users from bypassing Microsoft Defender SmartScreen warnings when downloading unverified files. It helps prevent malware infections and phishing attacks by ensuring unsafe or suspicious downloads are automatically blocked.

Learn More