Microsoft Edge - Policies
The latest version of Microsoft Edge includes the following policies. You can use these policies to configure how Microsoft Edge runs in your organization.
For information about an additional set of policies used to control how and when Microsoft Edge is updated, check out Microsoft Edge update policy reference.
You can download the Microsoft Security Compliance Toolkit for the recommended security configuration baseline settings for Microsoft Edge. For more information see the Microsoft Security Baselines Blog.
Starting in Microsoft Edge version 116, certain policies will not be applied to a profile that is signed in with a Microsoft account. For more information, please check an individual policy for details on whether it applies to a profile that is signed in with a Microsoft account.
Note
This article applies to Microsoft Edge version 77 or later.
For Microsoft Edge Mobile policy reference, see Microsoft Edge Mobile - Policies.
New policies
The following table lists the new, and deprecated policies that are in this article update.
Policy Name | Caption |
---|---|
ViewXFAPDFInIEModeAllowedFileHash | View XFA-based PDF files using IE Mode for allowed file hash. |
ViewXFAPDFInIEModeAllowedOrigins | View XFA-based PDF files using IE Mode for allowed file origin. |
SelectParserRelaxationEnabled | Controls whether the new HTML parser behavior for the <select> element is enabled |
PromotionalTabsEnabled | Enable full-tab promotional content (deprecated) |
Available policies
These tables list all of the browser-related group policies available in this release of Microsoft Edge. Use the links in the table to get more details about specific policies.
- Application Guard settings
- Cast
- Content settings
- Default search provider
- Downloads
- Edge Website Typo Protection settings
- Edge Workspaces settings
- Experimentation
- Extensions
- Games settings
- Generative AI
- HTTP authentication
- Identity and sign-in
- Idle Browser Actions
- Immersive Reader settings
- Kiosk Mode settings
- Manageability
- Native Messaging
- Network settings
- PDF Reader
- Password manager and protection
- Performance
- Permit or deny screen capture
- Printing
- Private Network Request Settings
- Proxy server
- Related Website Sets Settings
- Sleeping tabs settings
- SmartScreen settings
- Startup, home page and new tab page
- Additional
Application Guard settings
Policy Name | Caption |
---|---|
ApplicationGuardContainerProxy | Application Guard Container Proxy |
ApplicationGuardFavoritesSyncEnabled | Application Guard Favorites Sync Enabled |
ApplicationGuardPassiveModeEnabled | Ignore Application Guard site list configuration and browse Edge normally |
ApplicationGuardTrafficIdentificationEnabled | Application Guard Traffic Identification |
ApplicationGuardUploadBlockingEnabled | Prevents files from being uploaded while in Application Guard |
Cast
Policy Name | Caption |
---|---|
EdgeDisableDialProtocolForCastDiscovery | Disable DIAL protocol for cast device discovery |
EnableMediaRouter | Enable Google Cast |
ShowCastIconInToolbar | Show the cast icon in the toolbar |
Content settings
Policy Name | Caption |
---|---|
AutoSelectCertificateForUrls | Automatically select client certificates for these sites |
AutomaticDownloadsAllowedForUrls | Allow multiple automatic downloads in quick succession on specific sites |
AutomaticDownloadsBlockedForUrls | Block multiple automatic downloads in quick succession on specific sites |
AutomaticFullscreenAllowedForUrls | Allow automatic full screen on specified sites |
AutomaticFullscreenBlockedForUrls | Block automatic full screen on specified sites |
CookiesAllowedForUrls | Allow cookies on specific sites |
CookiesBlockedForUrls | Block cookies on specific sites |
CookiesSessionOnlyForUrls | Limit cookies from specific websites to the current session |
DataUrlInSvgUseEnabled | Data URL support for SVGUseElement |
DefaultAutomaticDownloadsSetting | Default automatic downloads setting |
DefaultCookiesSetting | Configure cookies |
DefaultFileSystemReadGuardSetting | Control use of the File System API for reading |
DefaultFileSystemWriteGuardSetting | Control use of the File System API for writing |
DefaultGeolocationSetting | Default geolocation setting |
DefaultImagesSetting | Default images setting |
DefaultInsecureContentSetting | Control use of insecure content exceptions |
DefaultJavaScriptJitSetting | Control use of JavaScript JIT |
DefaultJavaScriptSetting | Default JavaScript setting |
DefaultNotificationsSetting | Default notification setting |
DefaultPluginsSetting | Default Adobe Flash setting (obsolete) |
DefaultPopupsSetting | Default pop-up window setting |
DefaultThirdPartyStoragePartitioningSetting | Default setting for third-party storage partitioning |
DefaultWebBluetoothGuardSetting | Control use of the Web Bluetooth API |
DefaultWebHidGuardSetting | Control use of the WebHID API |
DefaultWebUsbGuardSetting | Control use of the WebUSB API |
DefaultWindowManagementSetting | Default Window Management permission setting |
FileSystemReadAskForUrls | Allow read access via the File System API on these sites |
FileSystemReadBlockedForUrls | Block read access via the File System API on these sites |
FileSystemWriteAskForUrls | Allow write access to files and directories on these sites |
FileSystemWriteBlockedForUrls | Block write access to files and directories on these sites |
ImagesAllowedForUrls | Allow images on these sites |
ImagesBlockedForUrls | Block images on specific sites |
InsecureContentAllowedForUrls | Allow insecure content on specified sites |
InsecureContentBlockedForUrls | Block insecure content on specified sites |
IntranetFileLinksEnabled | Allow intranet zone file URL links from Microsoft Edge to open in Windows File Explorer |
JavaScriptAllowedForUrls | Allow JavaScript on specific sites |
JavaScriptBlockedForUrls | Block JavaScript on specific sites |
JavaScriptJitAllowedForSites | Allow JavaScript to use JIT on these sites |
JavaScriptJitBlockedForSites | Block JavaScript from using JIT on these sites |
LegacySameSiteCookieBehaviorEnabled | Enable default legacy SameSite cookie behavior setting (obsolete) |
LegacySameSiteCookieBehaviorEnabledForDomainList | Revert to legacy SameSite behavior for cookies on specified sites |
NotificationsAllowedForUrls | Allow notifications on specific sites |
NotificationsBlockedForUrls | Block notifications on specific sites |
PluginsAllowedForUrls | Allow the Adobe Flash plug-in on specific sites (obsolete) |
PluginsBlockedForUrls | Block the Adobe Flash plug-in on specific sites (obsolete) |
PopupsAllowedForUrls | Allow pop-up windows on specific sites |
PopupsBlockedForUrls | Block pop-up windows on specific sites |
RegisteredProtocolHandlers | Register protocol handlers |
SerialAllowAllPortsForUrls | Automatically grant sites permission to connect all serial ports |
SerialAllowUsbDevicesForUrls | Automatically grant sites permission to connect to USB serial devices |
ShowPDFDefaultRecommendationsEnabled | Allow notifications to set Microsoft Edge as default PDF reader |
SpotlightExperiencesAndRecommendationsEnabled | Choose whether users can receive customized background images and text, suggestions, notifications, and tips for Microsoft services |
ThirdPartyStoragePartitioningBlockedForOrigins | Disable third-party storage partitioning for specific top-level origins |
WebHidAllowAllDevicesForUrls | Allow listed sites to connect to any HID device |
WebHidAllowDevicesForUrls | Allow listed sites connect to specific HID devices |
WebHidAllowDevicesWithHidUsagesForUrls | Automatically grant permission to these sites to connect to HID devices containing top-level collections with the given HID usage |
WebHidAskForUrls | Allow the WebHID API on these sites |
WebHidBlockedForUrls | Block the WebHID API on these sites |
WebUsbAllowDevicesForUrls | Grant access to specific sites to connect to specific USB devices |
WebUsbAskForUrls | Allow WebUSB on specific sites |
WebUsbBlockedForUrls | Block WebUSB on specific sites |
WindowManagementAllowedForUrls | Allow Window Management permission on specified sites |
WindowManagementBlockedForUrls | Block Window Management permission on specified sites |
Default search provider
Policy Name | Caption |
---|---|
DefaultSearchProviderEnabled | Enable the default search provider |
DefaultSearchProviderEncodings | Default search provider encodings |
DefaultSearchProviderImageURL | Specifies the search-by-image feature for the default search provider |
DefaultSearchProviderImageURLPostParams | Parameters for an image URL that uses POST |
DefaultSearchProviderKeyword | Default search provider keyword |
DefaultSearchProviderName | Default search provider name |
DefaultSearchProviderSearchURL | Default search provider search URL |
DefaultSearchProviderSuggestURL | Default search provider URL for suggestions |
NewTabPageSearchBox | Configure the new tab page search box experience |
Downloads
Policy Name | Caption |
---|---|
ShowDownloadsInsecureWarningsEnabled | Enable insecure download warnings |
Edge Website Typo Protection settings
Policy Name | Caption |
---|---|
PreventTyposquattingPromptOverride | Prevent bypassing Edge Website Typo Protection prompts for sites |
TyposquattingAllowListDomains | Configure the list of domains for which Edge Website Typo Protection won't trigger warnings |
TyposquattingCheckerEnabled | Configure Edge Website Typo Protection |
Edge Workspaces settings
Policy Name | Caption |
---|---|
EdgeWorkspacesEnabled | Enable Workspaces |
WorkspacesNavigationSettings | Configure navigation settings per groups of URLs in Microsoft Edge Workspaces |
Experimentation
Policy Name | Caption |
---|---|
FeatureFlagOverridesControl | Configure users ability to override feature flags |
Extensions
Policy Name | Caption |
---|---|
BlockExternalExtensions | Blocks external extensions from being installed |
ControlDefaultStateOfAllowExtensionFromOtherStoresSettingEnabled | Configure default state of Allow extensions from other stores setting |
ExtensionAllowedTypes | Configure allowed extension types |
ExtensionDeveloperModeSettings | Control the availability of developer mode on extensions page |
ExtensionExtendedBackgroundLifetimeForPortConnectionsToUrls | Configure a list of origins that grant an extended background lifetime to connecting extensions. |
ExtensionInstallAllowlist | Allow specific extensions to be installed |
ExtensionInstallBlocklist | Control which extensions cannot be installed |
ExtensionInstallForcelist | Control which extensions are installed silently |
ExtensionInstallSources | Configure extension and user script install sources |
ExtensionInstallTypeBlocklist | Blocklist for extension install types |
ExtensionManifestV2Availability | Control Manifest v2 extension availability |
ExtensionSettings | Configure extension management settings |
Games settings
Policy Name | Caption |
---|---|
GamerModeEnabled | Enable Gamer Mode |
Generative AI
Policy Name | Caption |
---|---|
GenAILocalFoundationalModelSettings | Settings for GenAI local foundational model |
HTTP authentication
Policy Name | Caption |
---|---|
AllHttpAuthSchemesAllowedForOrigins | List of origins that allow all HTTP authentication |
AllowCrossOriginAuthPrompt | Allow cross-origin HTTP Authentication prompts |
AuthNegotiateDelegateAllowlist | Specifies a list of servers that Microsoft Edge can delegate user credentials to |
AuthSchemes | Supported authentication schemes |
AuthServerAllowlist | Configure list of allowed authentication servers |
BasicAuthOverHttpEnabled | Allow Basic authentication for HTTP |
DisableAuthNegotiateCnameLookup | Disable CNAME lookup when negotiating Kerberos authentication |
EnableAuthNegotiatePort | Include non-standard port in Kerberos SPN |
NtlmV2Enabled | Control whether NTLMv2 authentication is enabled |
WindowsHelloForHTTPAuthEnabled | Windows Hello For HTTP Auth Enabled |
Identity and sign-in
Policy Name | Caption |
---|---|
AutomaticProfileSwitchingSiteList | Configure the automatic profile switching site list |
EdgeDefaultProfileEnabled | Default Profile Setting Enabled |
GuidedSwitchEnabled | Guided Switch Enabled |
ImplicitSignInEnabled | Enable implicit sign-in |
LinkedAccountEnabled | Enable the linked account feature |
OneAuthAuthenticationEnforced | OneAuth Authentication Flow Enforced for signin |
OnlyOnPremisesImplicitSigninEnabled | Only on-premises account enabled for implicit sign-in |
ProactiveAuthWorkflowEnabled | Enable proactive authentication |
SignInCtaOnNtpEnabled | Enable sign in click to action dialog (obsolete) |
SwitchIntranetSitesToWorkProfile | Switch intranet sites to a work profile |
SwitchSitesOnIEModeSiteListToWorkProfile | Switch sites on the IE mode site list to a work profile |
WAMAuthBelowWin10RS3Enabled | WAM for authentication below Windows 10 RS3 enabled |
Idle Browser Actions
Policy Name | Caption |
---|
Immersive Reader settings
Policy Name | Caption |
---|---|
ImmersiveReaderGrammarToolsEnabled | Enable Grammar Tools feature within Immersive Reader in Microsoft Edge (obsolete) |
ImmersiveReaderPictureDictionaryEnabled | Enable Picture Dictionary feature within Immersive Reader in Microsoft Edge (obsolete) |
Kiosk Mode settings
Policy Name | Caption |
---|---|
KioskAddressBarEditingEnabled | Configure address bar editing for kiosk mode public browsing experience |
KioskDeleteDownloadsOnExit | Delete files downloaded as part of kiosk session when Microsoft Edge closes |
KioskSwipeGesturesEnabled | Swipe gestures in Microsoft Edge kiosk mode enabled |
Manageability
Policy Name | Caption |
---|---|
EdgeManagementEnabled | Microsoft Edge management enabled |
EdgeManagementEnrollmentToken | Microsoft Edge management enrollment token |
EdgeManagementExtensionsFeedbackEnabled | Microsoft Edge management extensions feedback enabled |
EdgeManagementPolicyOverridesPlatformPolicy | Microsoft Edge management service policy overrides platform policy. |
EdgeManagementUserPolicyOverridesCloudMachinePolicy | Allow cloud-based Microsoft Edge management service user policies to override local user policies. |
MAMEnabled | Mobile App Management Enabled |
Native Messaging
Policy Name | Caption |
---|---|
NativeMessagingAllowlist | Control which native messaging hosts users can use |
NativeMessagingBlocklist | Configure native messaging block list |
NativeMessagingUserLevelHosts | Allow user-level native messaging hosts (installed without admin permissions) |
Network settings
Policy Name | Caption |
---|---|
AccessControlAllowMethodsInCORSPreflightSpecConformant | Make Access-Control-Allow-Methods matching in CORS preflight spec conformant |
BlockTruncatedCookies | Block truncated cookies (obsolete) |
CompressionDictionaryTransportEnabled | Enable compression dictionary transport support |
IPv6ReachabilityOverrideEnabled | Enable IPv6 reachability check override |
ZstdContentEncodingEnabled | Enable zstd content encoding support |
PDF Reader
Policy Name | Caption |
---|---|
ViewXFAPDFInIEModeAllowedFileHash | View XFA-based PDF files using IE Mode for allowed file hash. |
ViewXFAPDFInIEModeAllowedOrigins | View XFA-based PDF files using IE Mode for allowed file origin. |
Password manager and protection
Policy Name | Caption |
---|---|
DeletingUndecryptablePasswordsEnabled | Enable deleting undecryptable passwords |
PasswordDeleteOnBrowserCloseEnabled | Prevent passwords from being deleted if any Edge settings is enabled to delete browsing data when Microsoft Edge closes |
PasswordGeneratorEnabled | Allow users to get a strong password suggestion whenever they are creating an account online |
PasswordManagerBlocklist | Configure the list of domains for which the password manager UI (Save and Fill) will be disabled |
PasswordManagerEnabled | Enable saving passwords to the password manager |
PasswordManagerRestrictLengthEnabled | Restrict the length of passwords that can be saved in the Password Manager |
PasswordMonitorAllowed | Allow users to be alerted if their passwords are found to be unsafe |
PasswordProtectionChangePasswordURL | Configure the change password URL |
PasswordProtectionLoginURLs | Configure the list of enterprise login URLs where the password protection service should capture salted hashes of a password |
PasswordProtectionWarningTrigger | Configure password protection warning trigger |
PasswordRevealEnabled | Enable Password reveal button |
PrimaryPasswordSetting | Configures a setting that asks users to enter their device password while using password autofill |
Performance
Policy Name | Caption |
---|---|
EfficiencyMode | Configure when efficiency mode should become active |
EfficiencyModeEnabled | Efficiency mode enabled |
EfficiencyModeOnPowerEnabled | Enable efficiency mode when the device is connected to a power source |
ExtensionsPerformanceDetectorEnabled | Extensions Performance Detector enabled |
PerformanceDetectorEnabled | Performance Detector Enabled |
PinBrowserEssentialsToolbarButton | Pin browser essentials toolbar button |
StartupBoostEnabled | Enable startup boost |
Permit or deny screen capture
Policy Name | Caption |
---|---|
SameOriginTabCaptureAllowedByOrigins | Allow Same Origin Tab capture by these origins |
ScreenCaptureAllowedByOrigins | Allow Desktop, Window, and Tab capture by these origins |
TabCaptureAllowedByOrigins | Allow Tab capture by these origins |
WindowCaptureAllowedByOrigins | Allow Window and Tab capture by these origins |
Printing
Policy Name | Caption |
---|---|
DefaultPrinterSelection | Default printer selection rules |
PrintHeaderFooter | Print headers and footers |
PrintPdfAsImageDefault | Print PDF as Image Default |
PrintPostScriptMode | Print PostScript Mode |
PrintPreviewStickySettings | Configure the sticky print preview settings |
PrintPreviewUseSystemDefaultPrinter | Set the system default printer as the default printer |
PrintRasterizationMode | Print Rasterization Mode |
PrintRasterizePdfDpi | Print Rasterize PDF DPI |
PrintStickySettings | Print preview sticky settings |
PrinterTypeDenyList | Disable printer types on the deny list |
PrintingAllowedBackgroundGraphicsModes | Restrict background graphics printing mode |
PrintingBackgroundGraphicsDefault | Default background graphics printing mode |
PrintingEnabled | Enable printing |
PrintingLPACSandboxEnabled | Enable Printing LPAC Sandbox |
PrintingPaperSizeDefault | Default printing page size |
PrintingWebpageLayout | Sets layout for printing |
UseSystemPrintDialog | Print using system print dialog |
Private Network Request Settings
Policy Name | Caption |
---|---|
InsecurePrivateNetworkRequestsAllowed | Specifies whether to allow websites to make requests to any network endpoint in an insecure manner. |
InsecurePrivateNetworkRequestsAllowedForUrls | Allow the listed sites to make requests to more-private network endpoints from in an insecure manner |
PrivateNetworkAccessRestrictionsEnabled | Specifies whether to apply restrictions to requests to more private network endpoints |
Proxy server
Policy Name | Caption |
---|---|
ProxyBypassList | Configure proxy bypass rules (deprecated) |
ProxyMode | Configure proxy server settings (deprecated) |
ProxyPacUrl | Set the proxy .pac file URL (deprecated) |
ProxyServer | Configure address or URL of proxy server (deprecated) |
ProxySettings | Proxy settings |
Related Website Sets Settings
Policy Name | Caption |
---|---|
RelatedWebsiteSetsEnabled | Enable Related Website Sets |
RelatedWebsiteSetsOverrides | Override Related Website Sets. |
Sleeping tabs settings
Policy Name | Caption |
---|---|
AutoDiscardSleepingTabsEnabled | Configure auto discard sleeping tabs |
SleepingTabsBlockedForUrls | Block sleeping tabs on specific sites |
SleepingTabsEnabled | Configure sleeping tabs |
SleepingTabsTimeout | Set the background tab inactivity timeout for sleeping tabs |
SmartScreen settings
Policy Name | Caption |
---|---|
ExemptSmartScreenDownloadWarnings | Disable SmartScreen AppRep based warnings for specified file types on specified domains |
NewSmartScreenLibraryEnabled | Enable new SmartScreen library (obsolete) |
PreventSmartScreenPromptOverride | Prevent bypassing Microsoft Defender SmartScreen prompts for sites |
PreventSmartScreenPromptOverrideForFiles | Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads |
SmartScreenAllowListDomains | Configure the list of domains for which Microsoft Defender SmartScreen won't trigger warnings |
SmartScreenDnsRequestsEnabled | Enable Microsoft Defender SmartScreen DNS requests |
SmartScreenEnabled | Configure Microsoft Defender SmartScreen |
SmartScreenForTrustedDownloadsEnabled | Force Microsoft Defender SmartScreen checks on downloads from trusted sources |
SmartScreenPuaEnabled | Configure Microsoft Defender SmartScreen to block potentially unwanted apps |
Startup, home page and new tab page
Policy Name | Caption |
---|---|
HomepageIsNewTabPage | Set the new tab page as the home page |
HomepageLocation | Configure the home page URL |
NewTabPageAllowedBackgroundTypes | Configure the background types allowed for the new tab page layout |
NewTabPageAppLauncherEnabled | Hide App Launcher on Microsoft Edge new tab page |
NewTabPageBingChatEnabled | Disable Bing chat entry-points on Microsoft Edge Enterprise new tab page |
NewTabPageCompanyLogo | Set new tab page company logo (obsolete) |
NewTabPageCompanyLogoEnabled | Hide the company logo on the Microsoft Edge new tab page |
NewTabPageContentEnabled | Allow Microsoft content on the new tab page |
NewTabPageHideDefaultTopSites | Hide the default top sites from the new tab page |
NewTabPageLocation | Configure the new tab page URL |
NewTabPageManagedQuickLinks | Set new tab page quick links |
NewTabPagePrerenderEnabled | Enable preload of the new tab page for faster rendering |
NewTabPageQuickLinksEnabled | Allow quick links on the new tab page |
NewTabPageSetFeedType | Configure the Microsoft Edge new tab page experience (obsolete) |
RestoreOnStartup | Action to take on Microsoft Edge startup |
RestoreOnStartupURLs | Sites to open when the browser starts |
RestoreOnStartupUserURLsEnabled | Allow users to add and remove their own sites during startup when the RestoreOnStartupURLs policy is configured |
ShowHomeButton | Show Home button on toolbar |
Additional
Policy Name | Caption |
---|---|
AADWebSiteSSOUsingThisProfileEnabled | Single sign-on for work or school sites using this profile enabled |
AIGenThemesEnabled | Enables DALL-E themes generation |
AccessibilityImageLabelsEnabled | Let screen reader users get image descriptions from Microsoft |
AdHocCodeSigningForPWAsEnabled | Native application signing during Progressive Web Application installation |
AdditionalSearchBoxEnabled | Enable additional search box in browser |
AddressBarEditingEnabled | Configure address bar editing |
AddressBarMicrosoftSearchInBingProviderEnabled | Enable Microsoft Search in Bing suggestions in the address bar |
AdsSettingForIntrusiveAdsSites | Ads setting for sites with intrusive ads |
AdsTransparencyEnabled | Configure if the ads transparency feature is enabled |
AllowBackForwardCacheForCacheControlNoStorePageEnabled | Allow pages with Cache-Control: no-store header to enter back/forward cache |
AllowDeletingBrowserHistory | Enable deleting browser and download history |
AllowFileSelectionDialogs | Allow file selection dialogs |
AllowGamesMenu | Allow users to access the games menu (deprecated) |
AllowPopupsDuringPageUnload | Allows a page to show popups during its unloading (obsolete) |
AllowSurfGame | Allow surf game |
AllowSyncXHRInPageDismissal | Allow pages to send synchronous XHR requests during page dismissal (obsolete) |
AllowSystemNotifications | Allows system notifications |
AllowTokenBindingForUrls | Configure the list of sites for which Microsoft Edge will attempt to establish a Token Binding with (obsolete) |
AllowTrackingForUrls | Configure tracking prevention exceptions for specific sites |
AllowWebAuthnWithBrokenTlsCerts | Allow Web Authentication requests on sites with broken TLS certificates. |
AllowedDomainsForApps | Define domains allowed to access Google Workspace |
AlternateErrorPagesEnabled | Suggest similar pages when a webpage can't be found |
AlwaysOpenPdfExternally | Always open PDF files externally |
AmbientAuthenticationInPrivateModesEnabled | Enable Ambient Authentication for InPrivate and Guest profiles |
AppCacheForceEnabled | Allows the AppCache feature to be re-enabled, even if it's turned off by default (obsolete) |
ApplicationBoundEncryptionEnabled | Enable Application Bound Encryption |
ApplicationLocaleValue | Set application locale |
AskBeforeCloseEnabled | Get user confirmation before closing a browser window with multiple tabs |
AudioCaptureAllowed | Allow or block audio capture |
AudioCaptureAllowedUrls | Sites that can access audio capture devices without requesting permission |
AudioProcessHighPriorityEnabled | Allow the audio process to run with priority above normal on Windows |
AudioSandboxEnabled | Allow the audio sandbox to run |
AutoImportAtFirstRun | Automatically import another browser's data and settings at first run |
AutoLaunchProtocolsComponentEnabled | AutoLaunch Protocols Component Enabled |
AutoLaunchProtocolsFromOrigins | Define a list of protocols that can launch an external application from listed origins without prompting the user |
AutoOpenAllowedForURLs | URLs where AutoOpenFileTypes can apply |
AutoOpenFileTypes | List of file types that should be automatically opened on download |
AutofillAddressEnabled | Enable AutoFill for addresses |
AutofillCreditCardEnabled | Enable AutoFill for payment instruments |
AutofillMembershipsEnabled | Save and fill memberships |
AutomaticHttpsDefault | Configure Automatic HTTPS |
AutoplayAllowed | Allow media autoplay for websites |
AutoplayAllowlist | Allow media autoplay on specific sites |
BackgroundModeEnabled | Continue running background apps after Microsoft Edge closes |
BackgroundTemplateListUpdatesEnabled | Enables background updates to the list of available templates for Collections and other features that use templates (deprecated) |
BeforeunloadEventCancelByPreventDefaultEnabled | Control the behavior for the cancel dialog produced by the beforeunload event (obsolete) |
BingAdsSuppression | Block all ads on Bing search results |
BlockThirdPartyCookies | Block third party cookies |
BrowserAddProfileEnabled | Enable profile creation from the Identity flyout menu or the Settings page |
BrowserCodeIntegritySetting | Configure browser process code integrity guard setting |
BrowserGuestModeEnabled | Enable guest mode |
BrowserLegacyExtensionPointsBlockingEnabled | Enable browser legacy extension point blocking |
BrowserNetworkTimeQueriesEnabled | Allow queries to a Browser Network Time service |
BrowserSignin | Browser sign-in settings |
BrowsingDataLifetime | Browsing Data Lifetime Settings |
BuiltInDnsClientEnabled | Use built-in DNS client |
BuiltinCertificateVerifierEnabled | Determines whether the built-in certificate verifier will be used to verify server certificates (obsolete) |
CECPQ2Enabled | CECPQ2 post-quantum key-agreement enabled for TLS (obsolete) |
CORSNonWildcardRequestHeadersSupport | CORS non-wildcard request header support enabled |
CSSCustomStateDeprecatedSyntaxEnabled | Controls whether the deprecated :--foo syntax for CSS custom state is enabled |
CertificateTransparencyEnforcementDisabledForCas | Disable Certificate Transparency enforcement for a list of subjectPublicKeyInfo hashes |
CertificateTransparencyEnforcementDisabledForLegacyCas | Disable Certificate Transparency enforcement for a list of legacy certificate authorities (obsolete) |
CertificateTransparencyEnforcementDisabledForUrls | Disable Certificate Transparency enforcement for specific URLs |
ClearBrowsingDataOnExit | Clear browsing data when Microsoft Edge closes |
ClearCachedImagesAndFilesOnExit | Clear cached images and files when Microsoft Edge closes |
ClickOnceEnabled | Allow users to open files using the ClickOnce protocol |
ClipboardAllowedForUrls | Allow clipboard use on specific sites |
ClipboardBlockedForUrls | Block clipboard use on specific sites |
CollectionsServicesAndExportsBlockList | Block access to a specified list of services and export targets in Collections |
CommandLineFlagSecurityWarningsEnabled | Enable security warnings for command-line flags |
ComponentUpdatesEnabled | Enable component updates in Microsoft Edge |
ComposeInlineEnabled | Compose is enabled for writing on the web |
ConfigureDoNotTrack | Configure Do Not Track |
ConfigureFriendlyURLFormat | Configure the default paste format of URLs copied from Microsoft Edge, and determine if additional formats will be available to users |
ConfigureKeyboardShortcuts | Configure the list of commands for which to disable keyboard shortcuts |
ConfigureOnPremisesAccountAutoSignIn | Configure automatic sign in with an Active Directory domain account when there is no Azure AD domain account |
ConfigureOnlineTextToSpeech | Configure Online Text To Speech |
ConfigureShare | Configure the Share experience |
ConfigureViewInFileExplorer | Configure the View in File Explorer feature for SharePoint pages in Microsoft Edge |
CopilotCDPPageContext | Control Copilot with Commercial Data Protection access to page context for Microsoft Entra ID profiles (deprecated) |
CopilotPageContext | Control Copilot access to page context for Microsoft Entra ID profiles |
CreatePasskeysInICloudKeychain | Control whether passkey creation will default to iCloud Keychain. |
CrossOriginWebAssemblyModuleSharingEnabled | Specifies whether WebAssembly modules can be sent cross-origin (obsolete) |
CryptoWalletEnabled | Enable CryptoWallet feature (obsolete) |
CustomHelpLink | Specify custom help link |
DNSInterceptionChecksEnabled | DNS interception checks enabled |
DefaultBrowserSettingEnabled | Set Microsoft Edge as default browser |
DefaultBrowserSettingsCampaignEnabled | Enables default browser settings campaigns |
DefaultClipboardSetting | Default clipboard site permission |
DefaultSearchProviderContextMenuAccessAllowed | Allow default search provider context menu search access |
DefaultSensorsSetting | Default sensors setting |
DefaultSerialGuardSetting | Control use of the Serial API |
DefaultShareAdditionalOSRegionSetting | Set the default "share additional operating system region" setting |
DefinePreferredLanguages | Define an ordered list of preferred languages that websites should display in if the site supports the language |
DelayNavigationsForInitialSiteListDownload | Require that the Enterprise Mode Site List is available before tab navigation |
DeleteDataOnMigration | Delete old browser data on migration |
DeveloperToolsAvailability | Control where developer tools can be used |
DiagnosticData | Send required and optional diagnostic data about browser usage |
DirectInvokeEnabled | Allow users to open files using the DirectInvoke protocol |
Disable3DAPIs | Disable support for 3D graphics APIs |
DisableScreenshots | Disable taking screenshots |
DiscoverPageContextEnabled | Enable Discover access to page contents for AAD profiles (obsolete) |
DiskCacheDir | Set disk cache directory |
DiskCacheSize | Set disk cache size, in bytes |
DisplayCapturePermissionsPolicyEnabled | Specifies whether the display-capture permissions-policy is checked or skipped (obsolete) |
DnsOverHttpsMode | Control the mode of DNS-over-HTTPS |
DnsOverHttpsTemplates | Specify URI template of desired DNS-over-HTTPS resolver |
DoNotSilentlyBlockProtocolsFromOrigins | Define a list of protocols that can not be silently blocked by anti-flood protection |
DoubleClickCloseTabEnabled | Double Click feature in Microsoft Edge enabled (only available in China) |
DownloadDirectory | Set download directory |
DownloadRestrictions | Allow download restrictions |
DynamicCodeSettings | Dynamic Code Settings |
Edge3PSerpTelemetryEnabled | Edge 3P SERP Telemetry Enabled |
EdgeAssetDeliveryServiceEnabled | Allow features to download assets from the Asset Delivery Service |
EdgeCollectionsEnabled | Enable the Collections feature |
EdgeDiscoverEnabled | Discover feature In Microsoft Edge (obsolete) |
EdgeEDropEnabled | Enable Drop feature in Microsoft Edge |
EdgeEnhanceImagesEnabled | Enhance images enabled (obsolete) |
EdgeEntraCopilotPageContext | Control access to page content for Entra ID Profiles accessing Microsoft Copilot with Enterprise Data Protection (EDP) from the Microsoft Edge sidebar |
EdgeFollowEnabled | Enable Follow service in Microsoft Edge (obsolete) |
EdgeOpenInSidebarEnabled | Enable open in sidebar |
EdgeShoppingAssistantEnabled | Shopping in Microsoft Edge Enabled |
EdgeSidebarAppUrlHostAllowList | Allow specific apps to be opened in Microsoft Edge sidebar |
EdgeSidebarAppUrlHostBlockList | Control which apps cannot be opened in Microsoft Edge sidebar |
EdgeSidebarCustomizeEnabled | Enable sidebar customize |
EdgeWalletCheckoutEnabled | Enable Wallet Checkout feature |
EdgeWalletEtreeEnabled | Edge Wallet E-Tree Enabled |
EditFavoritesEnabled | Allows users to edit favorites |
EnableDeprecatedWebPlatformFeatures | Re-enable deprecated web platform features for a limited time (obsolete) |
EnableDomainActionsDownload | Enable Domain Actions Download from Microsoft (obsolete) |
EnableOnlineRevocationChecks | Enable online OCSP/CRL checks |
EnableSha1ForLocalAnchors | Allow certificates signed using SHA-1 when issued by local trust anchors (obsolete) |
EncryptedClientHelloEnabled | TLS Encrypted ClientHello Enabled |
EnforceLocalAnchorConstraintsEnabled | Determines whether the built-in certificate verifier will enforce constraints encoded into trust anchors loaded from the platform trust store (obsolete) |
EnhanceSecurityMode | Enhance the security state in Microsoft Edge |
EnhanceSecurityModeAllowUserBypass | Allow users to bypass Enhanced Security Mode |
EnhanceSecurityModeBypassIntranet | Enhanced Security Mode configuration for Intranet zone sites |
EnhanceSecurityModeBypassListDomains | Configure the list of domains for which enhance security mode will not be enforced |
EnhanceSecurityModeEnforceListDomains | Configure the list of domains for which enhance security mode will always be enforced |
EnhanceSecurityModeIndicatorUIEnabled | Manage the indicator UI of the Enhanced Security Mode (ESM) feature in Microsoft Edge |
EnhanceSecurityModeOptOutUXEnabled | Manage opt-out user experience for Enhanced Security Mode (ESM) in Microsoft Edge (deprecated) |
EnterpriseHardwarePlatformAPIEnabled | Allow managed extensions to use the Enterprise Hardware Platform API |
EnterpriseModeSiteListManagerAllowed | Allow access to the Enterprise Mode Site List Manager tool |
EventPathEnabled | Re-enable the Event.path API until Microsoft Edge version 115 (obsolete) |
ExemptDomainFileTypePairsFromFileTypeDownloadWarnings | Disable download file type extension-based warnings for specified file types on domains (obsolete) |
ExemptFileTypeDownloadWarnings | Disable download file type extension-based warnings for specified file types on domains |
ExperimentationAndConfigurationServiceControl | Control communication with the Experimentation and Configuration Service |
ExplicitlyAllowedNetworkPorts | Explicitly allowed network ports |
ExternalProtocolDialogShowAlwaysOpenCheckbox | Show an "Always open" checkbox in external protocol dialog |
FamilySafetySettingsEnabled | Allow users to configure Family safety and Kids Mode |
FavoritesBarEnabled | Enable favorites bar |
FetchKeepaliveDurationSecondsOnShutdown | Fetch keepalive duration on shutdown |
FileOrDirectoryPickerWithoutGestureAllowedForOrigins | Allow file or directory picker APIs to be called without prior user gesture |
ForceBingSafeSearch | Enforce Bing SafeSearch |
ForceBuiltInPushMessagingClient | Forces Microsoft Edge to use its built-in WNS push client to connect to the Windows Push Notification Service. |
ForceCertificatePromptsOnMultipleMatches | Configure whether Microsoft Edge should automatically select a certificate when there are multiple certificate matches for a site configured with "AutoSelectCertificateForUrls" (deprecated) |
ForceEphemeralProfiles | Enable use of ephemeral profiles |
ForceGoogleSafeSearch | Enforce Google SafeSearch |
ForceLegacyDefaultReferrerPolicy | Use a default referrer policy of no-referrer-when-downgrade (obsolete) |
ForceMajorVersionToMinorPositionInUserAgent | Enable or disable freezing the User-Agent string at major version 99 (obsolete) |
ForceNetworkInProcess | Force networking code to run in the browser process (obsolete) |
ForcePermissionPolicyUnloadDefaultEnabled | Controls whether unload event handlers can be disabled. |
ForceSync | Force synchronization of browser data and do not show the sync consent prompt |
ForceSyncTypes | Configure the list of types that are included for synchronization |
ForceYouTubeRestrict | Force minimum YouTube Restricted Mode |
FullscreenAllowed | Allow full screen mode |
GloballyScopeHTTPAuthCacheEnabled | Enable globally scoped HTTP auth cache |
GoToIntranetSiteForSingleWordEntryInAddressBar | Force direct intranet site navigation instead of searching on single word entries in the Address Bar |
HSTSPolicyBypassList | Configure the list of names that will bypass the HSTS policy check |
HardwareAccelerationModeEnabled | Use graphics acceleration when available |
HeadlessModeEnabled | Control use of the Headless Mode |
HideFirstRunExperience | Hide the First-run experience and splash screen |
HideInternetExplorerRedirectUXForIncompatibleSitesEnabled | Hide the one-time redirection dialog and the banner on Microsoft Edge |
HideRestoreDialogEnabled | Hide restore pages dialog after browser crash |
HttpAllowlist | HTTP Allowlist |
HubsSidebarEnabled | Show Hubs Sidebar |
ImportAutofillFormData | Allow importing of autofill form data |
ImportBrowserSettings | Allow importing of browser settings |
ImportCookies | Allow importing of Cookies |
ImportExtensions | Allow importing of extensions |
ImportFavorites | Allow importing of favorites |
ImportHistory | Allow importing of browsing history |
ImportHomepage | Allow importing of home page settings |
ImportOnEachLaunch | Allow import of data from other browsers on each Microsoft Edge launch |
ImportOpenTabs | Allow importing of open tabs |
ImportPaymentInfo | Allow importing of payment info |
ImportSavedPasswords | Allow importing of saved passwords |
ImportSearchEngine | Allow importing of search engine settings |
ImportShortcuts | Allow importing of shortcuts |
ImportStartupPageSettings | Allow importing of startup page settings |
InAppSupportEnabled | In-app support Enabled |
InPrivateModeAvailability | Configure InPrivate mode availability |
InsecureFormsWarningsEnabled | Enable warnings for insecure forms (deprecated) |
IntensiveWakeUpThrottlingEnabled | Control the IntensiveWakeUpThrottling feature |
InternetExplorerIntegrationAlwaysUseOSCapture | Always use the OS capture engine to avoid issues with capturing Internet Explorer mode tabs |
InternetExplorerIntegrationAlwaysWaitForUnload | Wait for Internet Explorer mode tabs to completely unload before ending the browser session |
InternetExplorerIntegrationCloudNeutralSitesReporting | Configure reporting of potentially misconfigured neutral site URLs to the M365 Admin Center Site Lists app |
InternetExplorerIntegrationCloudSiteList | Configure the Enterprise Mode Cloud Site List |
InternetExplorerIntegrationCloudUserSitesReporting | Configure reporting of IE Mode user list entries to the M365 Admin Center Site Lists app |
InternetExplorerIntegrationComplexNavDataTypes | Configure whether form data and HTTP headers will be sent when entering or exiting Internet Explorer mode |
InternetExplorerIntegrationEnhancedHangDetection | Configure enhanced hang detection for Internet Explorer mode |
InternetExplorerIntegrationLevel | Configure Internet Explorer integration |
InternetExplorerIntegrationLocalFileAllowed | Allow launching of local files in Internet Explorer mode |
InternetExplorerIntegrationLocalFileExtensionAllowList | Open local files in Internet Explorer mode file extension allow list |
InternetExplorerIntegrationLocalFileShowContextMenu | Show context menu to open a file:// link in Internet Explorer mode |
InternetExplorerIntegrationLocalMhtFileAllowed | Allow local MHTML files to open automatically in Internet Explorer mode |
InternetExplorerIntegrationLocalSiteListExpirationDays | Specify the number of days that a site remains on the local IE mode site list |
InternetExplorerIntegrationReloadInIEModeAllowed | Allow unconfigured sites to be reloaded in Internet Explorer mode |
InternetExplorerIntegrationSiteList | Configure the Enterprise Mode Site List |
InternetExplorerIntegrationSiteListRefreshInterval | Configure how frequently the Enterprise Mode Site List is refreshed |
InternetExplorerIntegrationSiteRedirect | Specify how "in-page" navigations to unconfigured sites behave when started from Internet Explorer mode pages |
InternetExplorerIntegrationTestingAllowed | Allow Internet Explorer mode testing (obsolete) |
InternetExplorerIntegrationWindowOpenHeightAdjustment | Configure the pixel adjustment between window.open heights sourced from IE mode pages vs. Edge mode pages |
InternetExplorerIntegrationWindowOpenWidthAdjustment | Configure the pixel adjustment between window.open widths sourced from IE mode pages vs. Edge mode pages |
InternetExplorerIntegrationZoneIdentifierMhtFileAllowed | Automatically open downloaded MHT or MHTML files from the web in Internet Explorer mode |
InternetExplorerModeClearDataOnExitEnabled | Clear history for IE and IE mode every time you exit |
InternetExplorerModeEnableSavePageAs | Allow Save page as in Internet Explorer mode |
InternetExplorerModeTabInEdgeModeAllowed | Allow sites configured for Internet Explorer mode to open in Microsoft Edge |
InternetExplorerModeToolbarButtonEnabled | Show the Reload in Internet Explorer mode button in the toolbar |
InternetExplorerSetForegroundWhenActive | Keep the active Microsoft Edge window with an Internet Explorer mode tab always in the foreground. |
InternetExplorerZoomDisplay | Display zoom in IE Mode tabs with DPI Scale included like it is in Internet Explorer |
IntranetRedirectBehavior | Intranet Redirection Behavior |
IsolateOrigins | Enable site isolation for specific origins |
KeyboardFocusableScrollersEnabled | Enable keyboard focusable scrollers |
LiveCaptionsAllowed | Live captions allowed |
LiveTranslationAllowed | Live translation allowed |
LocalBrowserDataShareEnabled | Enable Windows to search local Microsoft Edge browsing data |
LocalProvidersEnabled | Allow suggestions from local providers |
MAUEnabled | Always use Microsoft AutoUpdate as the updater for Microsoft Edge |
MSAWebSiteSSOUsingThisProfileAllowed | Allow single sign-on for Microsoft personal sites using this profile |
ManagedConfigurationPerOrigin | Sets managed configuration values for websites to specific origins |
ManagedFavorites | Configure favorites |
ManagedSearchEngines | Manage Search Engines |
MathSolverEnabled | Let users snip a Math problem and get the solution with a step-by-step explanation in Microsoft Edge (obsolete) |
MaxConnectionsPerProxy | Maximum number of concurrent connections to the proxy server |
MediaRouterCastAllowAllIPs | Allow Google Cast to connect to Cast devices on all IP addresses |
MetricsReportingEnabled | Enable usage and crash-related data reporting (obsolete) |
MicrosoftEdgeInsiderPromotionEnabled | Microsoft Edge Insider Promotion Enabled |
MicrosoftEditorProofingEnabled | Spell checking provided by Microsoft Editor |
MicrosoftEditorSynonymsEnabled | Synonyms are provided when using Microsoft Editor spell checker |
MicrosoftOfficeMenuEnabled | Allow users to access the Microsoft Office menu (deprecated) |
MicrosoftRootStoreEnabled | Determines whether the Microsoft Root Store and built-in certificate verifier will be used to verify server certificates (obsolete) |
MouseGestureEnabled | Mouse Gesture Enabled |
MutationEventsEnabled | Enable deprecated/removed Mutation Events (deprecated) |
NativeHostsExecutablesLaunchDirectly | Force Windows executable Native Messaging hosts to launch directly |
NativeWindowOcclusionEnabled | Enable Native Window Occlusion (deprecated) |
NavigationDelayForInitialSiteListDownloadTimeout | Set a timeout for delay of tab navigation for the Enterprise Mode Site List |
NetworkPredictionOptions | Enable network prediction |
NetworkServiceSandboxEnabled | Enable the network service sandbox |
NewBaseUrlInheritanceBehaviorAllowed | Allows enabling the feature NewBaseUrlInheritanceBehavior (deprecated) |
NewPDFReaderEnabled | Microsoft Edge built-in PDF reader powered by Adobe Acrobat enabled |
NonRemovableProfileEnabled | Configure whether a user always has a default profile automatically signed in with their work or school account |
OrganizationLogoOverlayOnAppIconEnabled | Allow your organization's logo from Microsoft Entra to be overlaid on the Microsoft Edge app icon of a work profile |
OrganizationalBrandingOnWorkProfileUIEnabled | Allow the use of your organization's branding assets from Microsoft Entra on the profile-related UI of a work profile |
OriginAgentClusterDefaultEnabled | Origin-keyed agent clustering enabled by default |
OutlookHubMenuEnabled | Allow users to access the Outlook menu (obsolete) |
OverrideSecurityRestrictionsOnInsecureOrigin | Control where security restrictions on insecure origins apply |
PDFSecureMode | Secure mode and Certificate-based Digital Signature validation in native PDF reader |
PDFXFAEnabled | XFA support in native PDF reader enabled |
PaymentMethodQueryEnabled | Allow websites to query for available payment methods |
PersonalizationReportingEnabled | Allow personalization of ads, Microsoft Edge, search, news and other Microsoft services by sending browsing history, favorites and collections, usage and other browsing data to Microsoft |
PersonalizeTopSitesInCustomizeSidebarEnabled | Personalize my top sites in Customize Sidebar enabled by default |
PictureInPictureOverlayEnabled | Enable Picture in Picture overlay feature on supported webpages in Microsoft Edge |
PinningWizardAllowed | Allow Pin to taskbar wizard |
PostQuantumKeyAgreementEnabled | Enable post-quantum key agreement for TLS |
ProactiveAuthEnabled | Enable Proactive Authentication (obsolete) |
PromotionalTabsEnabled | Enable full-tab promotional content (deprecated) |
PromptForDownloadLocation | Ask where to save downloaded files |
PromptOnMultipleMatchingCertificates | Prompt the user to select a certificate when multiple certificates match |
QRCodeGeneratorEnabled | Enable QR Code Generator |
QuicAllowed | Allow QUIC protocol |
QuickSearchShowMiniMenu | Enables Microsoft Edge mini menu |
QuickViewOfficeFilesEnabled | Manage QuickView Office files capability in Microsoft Edge |
RSAKeyUsageForLocalAnchorsEnabled | Check RSA key usage for server certificates issued by local trust anchors (deprecated) |
ReadAloudEnabled | Enable Read Aloud feature in Microsoft Edge |
RedirectSitesFromInternetExplorerPreventBHOInstall | Prevent install of the BHO to redirect incompatible sites from Internet Explorer to Microsoft Edge |
RedirectSitesFromInternetExplorerRedirectMode | Redirect incompatible sites from Internet Explorer to Microsoft Edge |
RelatedMatchesCloudServiceEnabled | Configure Related Matches in Find on Page |
RelaunchNotification | Notify a user that a browser restart is recommended or required for pending updates |
RelaunchNotificationPeriod | Set the time period for update notifications |
RelaunchWindow | Set the time interval for relaunch |
RemoteDebuggingAllowed | Allow remote debugging |
RendererAppContainerEnabled | Enable renderer in app container |
RendererCodeIntegrityEnabled | Enable renderer code integrity (deprecated) |
RequireOnlineRevocationChecksForLocalAnchors | Specify if online OCSP/CRL checks are required for local trust anchors |
ResolveNavigationErrorsUseWebService | Enable resolution of navigation errors using a web service |
RestorePdfView | Restore PDF view |
RestrictSigninToPattern | Restrict which accounts can be used to sign in to Microsoft Edge |
RoamingProfileLocation | Set the roaming profile directory |
RoamingProfileSupportEnabled | Enable using roaming copies for Microsoft Edge profile data |
RunAllFlashInAllowMode | Extend Adobe Flash content setting to all content (obsolete) |
SSLErrorOverrideAllowed | Allow users to proceed from the HTTPS warning page |
SSLErrorOverrideAllowedForOrigins | Allow users to proceed from the HTTPS warning page for specific origins |
SSLVersionMin | Minimum TLS version enabled (obsolete) |
SandboxExternalProtocolBlocked | Allow Microsoft Edge to block navigations to external protocols in a sandboxed iframe |
SaveCookiesOnExit | Save cookies when Microsoft Edge closes |
SavingBrowserHistoryDisabled | Disable saving browser history |
ScreenCaptureAllowed | Allow or deny screen capture |
ScreenCaptureWithoutGestureAllowedForOrigins | Allow screen capture without prior user gesture |
ScrollToTextFragmentEnabled | Enable scrolling to text specified in URL fragments |
SearchFiltersEnabled | Search Filters Enabled |
SearchForImageEnabled | Search for image enabled |
SearchInSidebarEnabled | Search in Sidebar enabled |
SearchSuggestEnabled | Enable search suggestions |
SearchbarAllowed | Enable the Search bar |
SearchbarIsEnabledOnStartup | Allow the Search bar at Windows startup |
SecurityKeyPermitAttestation | Websites or domains that don't need permission to use direct Security Key attestation |
SelectParserRelaxationEnabled | Controls whether the new HTML parser behavior for the <select> element is enabled |
SendIntranetToInternetExplorer | Send all intranet sites to Internet Explorer |
SendMouseEventsDisabledFormControlsEnabled | Control the new behavior for event dispatching on disabled form controls (obsolete) |
SendSiteInfoToImproveServices | Send site information to improve Microsoft services (obsolete) |
SensorsAllowedForUrls | Allow access to sensors on specific sites |
SensorsBlockedForUrls | Block access to sensors on specific sites |
SerialAskForUrls | Allow the Serial API on specific sites |
SerialBlockedForUrls | Block the Serial API on specific sites |
SetTimeoutWithout1MsClampEnabled | Control Javascript setTimeout() function minimum timeout (obsolete) |
ShadowStackCrashRollbackBehavior | Configure ShadowStack crash rollback behavior (obsolete) |
SharedArrayBufferUnrestrictedAccessAllowed | Specifies whether SharedArrayBuffers can be used in a non cross-origin-isolated context |
SharedLinksEnabled | Show links shared from Microsoft 365 apps in History |
ShowAcrobatSubscriptionButton | Shows button on native PDF viewer in Microsoft Edge that allows users to sign up for Adobe Acrobat subscription |
ShowDownloadsToolbarButton | Show Downloads button on the toolbar |
ShowHistoryThumbnails | Show thumbnail images for browsing history |
ShowMicrosoftRewards | Show Microsoft Rewards experiences |
ShowOfficeShortcutInFavoritesBar | Show Microsoft Office shortcut in favorites bar (deprecated) |
ShowRecommendationsEnabled | Allow feature recommendations and browser assistance notifications from Microsoft Edge |
SignedHTTPExchangeEnabled | Enable Signed HTTP Exchange (SXG) support |
SitePerProcess | Enable site isolation for every site |
SiteSafetyServicesEnabled | Allow users to configure Site safety services (obsolete) |
SmartActionsBlockList | Block smart actions for a list of services |
SpeechRecognitionEnabled | Configure Speech Recognition |
SpellcheckEnabled | Enable spellcheck |
SpellcheckLanguage | Enable specific spellcheck languages |
SpellcheckLanguageBlocklist | Force disable spellcheck languages |
SplitScreenEnabled | Enable split screen feature in Microsoft Edge |
StandaloneHubsSidebarEnabled | Standalone Sidebar Enabled |
StricterMixedContentTreatmentEnabled | Enable stricter treatment for mixed content (obsolete) |
SuperDragDropEnabled | Super Drag Drop Enabled |
SuppressUnsupportedOSWarning | Suppress the unsupported OS warning |
SyncDisabled | Disable synchronization of data using Microsoft sync services |
SyncTypesListDisabled | Configure the list of types that are excluded from synchronization |
TLS13HardeningForLocalAnchorsEnabled | Enable a TLS 1.3 security feature for local trust anchors (obsolete) |
TLSCipherSuiteDenyList | Specify the TLS cipher suites to disable |
TabFreezingEnabled | Allow freezing of background tabs (obsolete) |
TabServicesEnabled | Enable tab organization suggestions |
TargetBlankImpliesNoOpener | Do not set window.opener for links targeting _blank (obsolete) |
TaskManagerEndProcessEnabled | Enable ending processes in the Browser task manager |
TextPredictionEnabled | Text prediction enabled by default |
ThrottleNonVisibleCrossOriginIframesAllowed | Allows enabling throttling of non-visible, cross-origin iframes (obsolete) |
TotalMemoryLimitMb | Set limit on megabytes of memory a single Microsoft Edge instance can use |
TrackingPrevention | Block tracking of users' web-browsing activity |
TranslateEnabled | Enable Translate |
TravelAssistanceEnabled | Enable travel assistance (obsolete) |
TripleDESEnabled | Enable 3DES cipher suites in TLS (obsolete) |
U2fSecurityKeyApiEnabled | Allow using the deprecated U2F Security Key API (obsolete) |
URLAllowlist | Define a list of allowed URLs |
URLBlocklist | Block access to a list of URLs |
UnthrottledNestedTimeoutEnabled | JavaScript setTimeout will not be clamped until a higher nesting threshold is set (deprecated) |
UpdatePolicyOverride | Specifies how Microsoft Edge Update handles available updates from Microsoft Edge |
UploadFromPhoneEnabled | Enable upload files from mobile in Microsoft Edge desktop |
UrlDiagnosticDataEnabled | URL reporting in Edge diagnostic data enabled |
UserAgentClientHintsEnabled | Enable the User-Agent Client Hints feature (obsolete) |
UserAgentClientHintsGREASEUpdateEnabled | Control the User-Agent Client Hints GREASE Update feature (deprecated) |
UserAgentReduction | Enable or disable the User-Agent Reduction |
UserDataDir | Set the user data directory |
UserDataSnapshotRetentionLimit | Limits the number of user data snapshots retained for use in case of emergency rollback |
UserFeedbackAllowed | Allow user feedback |
VerticalTabsAllowed | Configures availability of a vertical layout for tabs on the side of the browser |
VideoCaptureAllowed | Allow or block video capture |
VideoCaptureAllowedUrls | Sites that can access video capture devices without requesting permission |
VisualSearchEnabled | Visual search enabled |
WPADQuickCheckEnabled | Set WPAD optimization |
WalletDonationEnabled | Wallet Donation Enabled |
WebAppInstallForceList | Configure list of force-installed Web Apps |
WebAppSettings | Web App management settings |
WebCaptureEnabled | Enable the Screenshot (previously named Web Capture) feature in Microsoft Edge |
WebComponentsV0Enabled | Re-enable Web Components v0 API until M84 (obsolete) |
WebDriverOverridesIncompatiblePolicies | Allow WebDriver to Override Incompatible Policies (obsolete) |
WebRtcAllowLegacyTLSProtocols | Allow legacy TLS/DTLS downgrade in WebRTC (obsolete) |
WebRtcLocalIpsAllowedUrls | Manage exposure of local IP addressess by WebRTC |
WebRtcLocalhostIpHandling | Restrict exposure of local IP address by WebRTC |
WebRtcRespectOsRoutingTableEnabled | Enable support for Windows OS routing table rules when making peer to peer connections via WebRTC |
WebRtcUdpPortRange | Restrict the range of local UDP ports used by WebRTC |
WebSQLAccess | Force WebSQL to be enabled (obsolete) |
WebSQLInThirdPartyContextEnabled | Force WebSQL in third-party contexts to be re-enabled (obsolete) |
WebSQLNonSecureContextEnabled | Force WebSQL in non-secure contexts to be enabled (obsolete) |
WebSelectEnabled | Web Select Enabled (obsolete) |
WebWidgetAllowed | Enable the Search bar (deprecated) |
WebWidgetIsEnabledOnStartup | Allow the Search bar at Windows startup (obsolete) |
WinHttpProxyResolverEnabled | Use Windows proxy resolver |
WindowOcclusionEnabled | Enable Window Occlusion |
Application Guard settings policies
ApplicationGuardContainerProxy
Application Guard Container Proxy
Supported versions:
- On Windows since 84 or later
Description
Configures the proxy settings for Microsoft Edge Application Guard. If you enable this policy, Microsoft Edge Application Guard ignores other sources of proxy configurations.
If you don't configure this policy, Microsoft Edge Application Guard uses the proxy configuration of the host.
This policy does not affect the proxy configuration of Microsoft Edge outside of Application Guard (on the host).
The ProxyMode field lets you specify the proxy server used by Microsoft Edge Application Guard.
The ProxyPacUrl field is a URL to a proxy .pac file.
The ProxyServer field is a URL for the proxy server.
If you choose the 'direct' value as 'ProxyMode', all other fields are ignored.
If you choose the 'auto_detect' value as 'ProxyMode', all other fields are ignored.
If you choose the 'fixed_servers' value as 'ProxyMode', the 'ProxyServer' field is used.
If you choose the 'pac_script' value as 'ProxyMode', the 'ProxyPacUrl' field is used.
For more information about identifying Application Guard traffic via dual proxy, visit https://go.microsoft.com/fwlink/?linkid=2134653.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Dictionary
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ApplicationGuardContainerProxy
- GP name: Application Guard Container Proxy
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Application Guard settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: ApplicationGuardContainerProxy
- Value Type: REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\ApplicationGuardContainerProxy = {
"ProxyMode": "direct",
"ProxyPacUrl": "https://internal.site/example.pac",
"ProxyServer": "123.123.123.123:8080"
}
Compact example value:
SOFTWARE\Policies\Microsoft\Edge\ApplicationGuardContainerProxy = {"ProxyMode": "direct", "ProxyPacUrl": "https://internal.site/example.pac", "ProxyServer": "123.123.123.123:8080"}
ApplicationGuardFavoritesSyncEnabled
Application Guard Favorites Sync Enabled
Supported versions:
- On Windows since 90 or later
Description
This policy allows Microsoft Edge computers/devices that have application guard enabled to sync favorites from the host to the container so the favorites match.
If ManagedFavorites are configured, those favorites will also be synced to the container.
If you enable this policy, editing favorites in the container is disabled. So, the add favorites and add favorites folder buttons will be blurred out in the UI of the container browser.
If you disable or don't configure this policy, favorites on the host will not be shared to the container.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ApplicationGuardFavoritesSyncEnabled
- GP name: Application Guard Favorites Sync Enabled
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Application Guard settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: ApplicationGuardFavoritesSyncEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
ApplicationGuardPassiveModeEnabled
Ignore Application Guard site list configuration and browse Edge normally
Supported versions:
- On Windows since 94 or later
Description
Set whether Edge should ignore the Application Guard site list configuration for trusted and untrusted sites.
If you enable this policy, all navigations from Edge, including navigations to untrusted sites, will be accessed normally within Edge without redirecting to the Application Guard container. Note: this policy ONLY impacts Edge, so navigations from other browsers might get redirected to the Application Guard Container if you have the corresponding extensions enabled.
If you disable or don't configure this policy, Edge does not ignore the Application Guard site list. If users try to navigate to an untrusted site in the host, the site will open in the container.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ApplicationGuardPassiveModeEnabled
- GP name: Ignore Application Guard site list configuration and browse Edge normally
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Application Guard settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: ApplicationGuardPassiveModeEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
ApplicationGuardTrafficIdentificationEnabled
Application Guard Traffic Identification
Supported versions:
- On Windows since 91 or later
Description
If you enable or don't configure this policy, Application Guard will add an extra HTTP header (X-MS-ApplicationGuard-Initiated) to all outbound HTTP requests made from the Application Guard container.
If you disable this policy, the extra header is not added to the traffic.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ApplicationGuardTrafficIdentificationEnabled
- GP name: Application Guard Traffic Identification
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Application Guard settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: ApplicationGuardTrafficIdentificationEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
ApplicationGuardUploadBlockingEnabled
Prevents files from being uploaded while in Application Guard
Supported versions:
- On Windows since 96 or later
Description
Sets whether files can be uploaded while in Application Guard.
If you enable this policy, users will not be able to upload files in Application Guard.
If you disable or don't configure this policy, users will be able to upload files while in Application Guard.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ApplicationGuardUploadBlockingEnabled
- GP name: Prevents files from being uploaded while in Application Guard
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Application Guard settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: ApplicationGuardUploadBlockingEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Cast policies
EdgeDisableDialProtocolForCastDiscovery
Disable DIAL protocol for cast device discovery
Supported versions:
- On Windows and macOS since 121 or later
Description
Enable this policy to disable the DIAL (Discovery And Launch) protocol for cast device discovery. (If EnableMediaRouter is disabled, this policy will have no effect).
Enable this policy to disable DIAL protocol.
By default, Cast device discovery will use DIAL protocol.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: EdgeDisableDialProtocolForCastDiscovery
- GP name: Disable DIAL protocol for cast device discovery
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Cast
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: EdgeDisableDialProtocolForCastDiscovery
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: EdgeDisableDialProtocolForCastDiscovery
- Example value:
<true/>
EnableMediaRouter
Enable Google Cast
Supported versions:
- On Windows and macOS since 77 or later
Description
Enable this policy to enable Google Cast. Users will be able to launch it from the app menu, page context menus, media controls on Cast-enabled websites, and (if shown) the Cast toolbar icon.
Disable this policy to disable Google Cast.
By default, Google Cast is enabled.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: EnableMediaRouter
- GP name: Enable Google Cast
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Cast
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: EnableMediaRouter
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: EnableMediaRouter
- Example value:
<true/>
ShowCastIconInToolbar
Show the cast icon in the toolbar
Supported versions:
- On Windows and macOS since 77 or later
Description
Set this policy to true to show the Cast toolbar icon on the toolbar or the overflow menu. Users won't be able to remove it.
If you don't configure this policy or if you disable it, users can pin or remove the icon by using its contextual menu.
If you've also set the EnableMediaRouter policy to false, then this policy is ignored, and the toolbar icon isn't shown.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ShowCastIconInToolbar
- GP name: Show the cast icon in the toolbar
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Cast
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: ShowCastIconInToolbar
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: ShowCastIconInToolbar
- Example value:
<false/>
Content settings policies
AutoSelectCertificateForUrls
Automatically select client certificates for these sites
Supported versions:
- On Windows and macOS since 77 or later
Description
Setting the policy lets you make a list of URL patterns that specify sites for which Microsoft Edge can automatically select a client certificate. The value is an array of stringified JSON dictionaries, each with the form { "pattern": "$URL_PATTERN", "filter" : $FILTER }, where $URL_PATTERN is a content setting pattern. $FILTER restricts the client certificates the browser automatically selects from. Independent of the filter, only certificates that match the server's certificate request are selected.
Examples for the usage of the $FILTER section:
When $FILTER is set to { "ISSUER": { "CN": "$ISSUER_CN" } }, only client certificates issued by a certificate with the CommonName $ISSUER_CN are selected.
When $FILTER contains both the "ISSUER" and the "SUBJECT" sections, only client certificates that satisfy both conditions are selected.
When $FILTER contains a "SUBJECT" section with the "O" value, a certificate needs at least one organization matching the specified value to be selected.
When $FILTER contains a "SUBJECT" section with a "OU" value, a certificate needs at least one organizational unit matching the specified value to be selected.
When $FILTER is set to {}, the selection of client certificates is not additionally restricted. Note that filters provided by the web server still apply.
If you leave the policy unset, there's no autoselection for any site.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AutoSelectCertificateForUrls
- GP name: Automatically select client certificates for these sites
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\AutoSelectCertificateForUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\AutoSelectCertificateForUrls\1 = "{\"pattern\":\"https://www.contoso.com\",\"filter\":{\"ISSUER\":{\"CN\":\"certificate issuer name\", \"L\": \"certificate issuer location\", \"O\": \"certificate issuer org\", \"OU\": \"certificate issuer org unit\"}, \"SUBJECT\":{\"CN\":\"certificate subject name\", \"L\": \"certificate subject location\", \"O\": \"certificate subject org\", \"OU\": \"certificate subject org unit\"}}}"
Mac information and settings
- Preference Key Name: AutoSelectCertificateForUrls
- Example value:
<array>
<string>{"pattern":"https://www.contoso.com","filter":{"ISSUER":{"CN":"certificate issuer name", "L": "certificate issuer location", "O": "certificate issuer org", "OU": "certificate issuer org unit"}, "SUBJECT":{"CN":"certificate subject name", "L": "certificate subject location", "O": "certificate subject org", "OU": "certificate subject org unit"}}}</string>
</array>
AutomaticDownloadsAllowedForUrls
Allow multiple automatic downloads in quick succession on specific sites
Supported versions:
- On Windows and macOS since 110 or later
Description
Define a list of sites, based on URL patterns, that are allowed to perform multiple successive automatic downloads. If you don't configure this policy, DefaultAutomaticDownloadsSetting applies for all sites, if it's set. If it isn't set, then the user's personal setting applies. For more detailed information about valid URL patterns, see https://go.microsoft.com/fwlink/?linkid=2095322.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AutomaticDownloadsAllowedForUrls
- GP name: Allow multiple automatic downloads in quick succession on specific sites
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\AutomaticDownloadsAllowedForUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\AutomaticDownloadsAllowedForUrls\1 = "https://contoso.com"
SOFTWARE\Policies\Microsoft\Edge\AutomaticDownloadsAllowedForUrls\2 = "[*.]contoso.edu"
Mac information and settings
- Preference Key Name: AutomaticDownloadsAllowedForUrls
- Example value:
<array>
<string>https://contoso.com</string>
<string>[*.]contoso.edu</string>
</array>
AutomaticDownloadsBlockedForUrls
Block multiple automatic downloads in quick succession on specific sites
Supported versions:
- On Windows and macOS since 110 or later
Description
Define a list of sites, based on URL patterns, where multiple successive automatic downloads aren't allowed. If you don't configure this policy, DefaultAutomaticDownloadsSetting applies for all sites, if it's set. If it isn't set, then the user's personal setting applies. For more detailed information about valid URL patterns, see https://go.microsoft.com/fwlink/?linkid=2095322.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AutomaticDownloadsBlockedForUrls
- GP name: Block multiple automatic downloads in quick succession on specific sites
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\AutomaticDownloadsBlockedForUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\AutomaticDownloadsBlockedForUrls\1 = "https://contoso.com"
SOFTWARE\Policies\Microsoft\Edge\AutomaticDownloadsBlockedForUrls\2 = "[*.]contoso.com"
Mac information and settings
- Preference Key Name: AutomaticDownloadsBlockedForUrls
- Example value:
<array>
<string>https://contoso.com</string>
<string>[*.]contoso.com</string>
</array>
AutomaticFullscreenAllowedForUrls
Allow automatic full screen on specified sites
Supported versions:
- On Windows and macOS since 132 or later
Description
For security reasons, the requestFullscreen() web API requires a prior user gesture ("transient activation") to be called or it will fail. Users' personal settings may allow certain origins to call this API without a prior user gesture.
This policy supersedes users' personal settings and allows matching origins to call the API without a prior user gesture.
For detailed information about valid URL patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards (*) are allowed.
Origins matching both blocked and allowed policy patterns will be blocked. Origins not specified by policy or user settings will require a prior user gesture to call this API.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AutomaticFullscreenAllowedForUrls
- GP name: Allow automatic full screen on specified sites
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\AutomaticFullscreenAllowedForUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\AutomaticFullscreenAllowedForUrls\1 = "https://www.example.com"
SOFTWARE\Policies\Microsoft\Edge\AutomaticFullscreenAllowedForUrls\2 = "[*.]example.edu"
Mac information and settings
- Preference Key Name: AutomaticFullscreenAllowedForUrls
- Example value:
<array>
<string>https://www.example.com</string>
<string>[*.]example.edu</string>
</array>
AutomaticFullscreenBlockedForUrls
Block automatic full screen on specified sites
Supported versions:
- On Windows and macOS since 132 or later
Description
For security reasons, the requestFullscreen() web API requires a prior user gesture ("transient activation") to be called or it will fail. Users' personal settings may allow certain origins to call this API without a prior user gesture.
This policy supersedes users' personal settings and blocks matching origins from calling the API without a prior user gesture.
For detailed information about valid URL patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards (*) are allowed.
Origins matching both blocked and allowed policy patterns will be blocked. Origins not specified by policy or user settings will require a prior user gesture to call this API.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AutomaticFullscreenBlockedForUrls
- GP name: Block automatic full screen on specified sites
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\AutomaticFullscreenBlockedForUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\AutomaticFullscreenBlockedForUrls\1 = "https://www.example.com"
SOFTWARE\Policies\Microsoft\Edge\AutomaticFullscreenBlockedForUrls\2 = "[*.]example.edu"
Mac information and settings
- Preference Key Name: AutomaticFullscreenBlockedForUrls
- Example value:
<array>
<string>https://www.example.com</string>
<string>[*.]example.edu</string>
</array>
CookiesAllowedForUrls
Allow cookies on specific sites
Supported versions:
- On Windows and macOS since 77 or later
Description
Define a list of sites, based on URL patterns, that are allowed to set cookies. URL patterns may be a single URL indicating that the site may use cookies on all top-level sites. Patterns may also be two URLs delimited by a comma. The first specifies the site that should be allowed to use cookies. The second specifies the top-level site that the first value should be applied on. If you use a pair of URLs, the first value in the pair supports * but the second value does not. Using * for the first value indicates that all sites may use cookies when the second URL is the top-level site.
If you don't configure this policy, the global default value from the DefaultCookiesSetting policy (if set) or the user's personal configuration is used for all sites.
See the CookiesBlockedForUrls and CookiesSessionOnlyForUrls policies for more information.
Note there cannot be conflicting URL patterns set between these three policies:
CookiesAllowedForUrls
For detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. * is not an accepted value for this policy.
To allow third-party cookies to be set, specify a pair of URL patterns delimited by a comma. The first value in the pair specifies the third-party site that should be allowed to use cookies. The second value in the pair specifies the top-level site that the first value should be applied on. The first value in the pair supports * but the second value does not.
To exclude cookies from being deleted on exit, configure the SaveCookiesOnExit policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: CookiesAllowedForUrls
- GP name: Allow cookies on specific sites
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\CookiesAllowedForUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\CookiesAllowedForUrls\1 = "https://www.contoso.com"
SOFTWARE\Policies\Microsoft\Edge\CookiesAllowedForUrls\2 = "[*.]contoso.edu"
SOFTWARE\Policies\Microsoft\Edge\CookiesAllowedForUrls\3 = "https://loaded-as-third-party.fabrikam.com,https://www.contoso.com"
SOFTWARE\Policies\Microsoft\Edge\CookiesAllowedForUrls\4 = "*,https://www.contoso.com"
Mac information and settings
- Preference Key Name: CookiesAllowedForUrls
- Example value:
<array>
<string>https://www.contoso.com</string>
<string>[*.]contoso.edu</string>
<string>https://loaded-as-third-party.fabrikam.com,https://www.contoso.com</string>
<string>*,https://www.contoso.com</string>
</array>
CookiesBlockedForUrls
Block cookies on specific sites
Supported versions:
- On Windows and macOS since 77 or later
Description
Define a list of sites, based on URL patterns, that can't set cookies.
If you don't configure this policy, the global default value from the DefaultCookiesSetting policy (if set) or the user's personal configuration is used for all sites.
See the CookiesAllowedForUrls and CookiesSessionOnlyForUrls policies for more information.
Note there cannot be conflicting URL patterns set between these three policies:
CookiesBlockedForUrls
For detailed information on valid url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322. * is not an accepted value for this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: CookiesBlockedForUrls
- GP name: Block cookies on specific sites
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\CookiesBlockedForUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\CookiesBlockedForUrls\1 = "https://www.contoso.com"
SOFTWARE\Policies\Microsoft\Edge\CookiesBlockedForUrls\2 = "[*.]contoso.edu"
Mac information and settings
- Preference Key Name: CookiesBlockedForUrls
- Example value:
<array>
<string>https://www.contoso.com</string>
<string>[*.]contoso.edu</string>
</array>
CookiesSessionOnlyForUrls
Limit cookies from specific websites to the current session
Supported versions:
- On Windows and macOS since 77 or later
Description
Cookies created by websites that match a URL pattern you define are deleted when the session ends (when the window closes).
Cookies created by websites that don't match the pattern are controlled by the DefaultCookiesSetting policy (if set) or by the user's personal configuration. This is also the default behavior if you don't configure this policy.
You can also use the CookiesAllowedForUrls and CookiesBlockedForUrls policies to control which websites can create cookies.
Note there cannot be conflicting URL patterns set between these three policies:
CookiesSessionOnlyForUrls
For detailed information on valid url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322. * is not an accepted value for this policy.
If you set the RestoreOnStartup policy to restore URLs from previous sessions, this policy is ignored, and cookies are stored permanently for those sites.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: CookiesSessionOnlyForUrls
- GP name: Limit cookies from specific websites to the current session
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\CookiesSessionOnlyForUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\CookiesSessionOnlyForUrls\1 = "https://www.contoso.com"
SOFTWARE\Policies\Microsoft\Edge\CookiesSessionOnlyForUrls\2 = "[*.]contoso.edu"
Mac information and settings
- Preference Key Name: CookiesSessionOnlyForUrls
- Example value:
<array>
<string>https://www.contoso.com</string>
<string>[*.]contoso.edu</string>
</array>
DataUrlInSvgUseEnabled
Data URL support for SVGUseElement
Supported versions:
- On Windows and macOS since 118 or later
Description
This policy enables Data URL support for SVGUseElement, which will be disabled by default starting in Edge stable version 119. If this policy is Enabled, Data URLs will keep working in SVGUseElement. If this policy is Disabled or left not set, Data URLs won't work in SVGUseElement.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: DataUrlInSvgUseEnabled
- GP name: Data URL support for SVGUseElement
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: DataUrlInSvgUseEnabled
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: DataUrlInSvgUseEnabled
- Example value:
<false/>
DefaultAutomaticDownloadsSetting
Default automatic downloads setting
Supported versions:
- On Windows and macOS since 110 or later
Description
Set whether websites can perform multiple downloads successively without user interaction. You can enable it for all sites (AllowAutomaticDownloads) or block it for all sites (BlockAutomaticDownloads). If you don't configure this policy, multiple automatic downloads can be performed in all sites, and the user can change this setting.
Policy options mapping:
AllowAutomaticDownloads (1) = Allow all websites to perform automatic downloads
BlockAutomaticDownloads (2) = Don't allow any website to perform automatic downloads
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: DefaultAutomaticDownloadsSetting
- GP name: Default automatic downloads setting
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: DefaultAutomaticDownloadsSetting
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: DefaultAutomaticDownloadsSetting
- Example value:
<integer>1</integer>
DefaultCookiesSetting
Configure cookies
Supported versions:
- On Windows and macOS since 77 or later
Description
Control whether websites can create cookies on the user's device. This policy is all or nothing - you can let all websites create cookies, or no websites create cookies. You can't use this policy to enable cookies from specific websites.
Set the policy to 'SessionOnly' to clear cookies when the session closes.
If you don't configure this policy, the default 'AllowCookies' is used, and users can change this setting in Microsoft Edge Settings. (If you don't want users to be able to change this setting, set the policy.)
Policy options mapping:
AllowCookies (1) = Let all sites create cookies
BlockCookies (2) = Don't let any site create cookies
SessionOnly (4) = Keep cookies for the duration of the session, except ones listed in SaveCookiesOnExit
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: DefaultCookiesSetting
- GP name: Configure cookies
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: DefaultCookiesSetting
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: DefaultCookiesSetting
- Example value:
<integer>1</integer>
DefaultFileSystemReadGuardSetting
Control use of the File System API for reading
Supported versions:
- On Windows and macOS since 86 or later
Description
If you set this policy to 3, websites can ask for read access to the host operating system's filesystem using the File System API. If you set this policy to 2, access is denied.
If you don't set this policy, websites can ask for access. Users can change this setting.
Policy options mapping:
BlockFileSystemRead (2) = Don't allow any site to request read access to files and directories via the File System API
AskFileSystemRead (3) = Allow sites to ask the user to grant read access to files and directories via the File System API
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: DefaultFileSystemReadGuardSetting
- GP name: Control use of the File System API for reading
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: DefaultFileSystemReadGuardSetting
- Value Type: REG_DWORD
Example value:
0x00000002
Mac information and settings
- Preference Key Name: DefaultFileSystemReadGuardSetting
- Example value:
<integer>2</integer>
DefaultFileSystemWriteGuardSetting
Control use of the File System API for writing
Supported versions:
- On Windows and macOS since 86 or later
Description
If you set this policy to 3, websites can ask for write access to the host operating system's filesystem using the File System API. If you set this policy to 2, access is denied.
If you don't set this policy, websites can ask for access. Users can change this setting.
Policy options mapping:
BlockFileSystemWrite (2) = Don't allow any site to request write access to files and directories
AskFileSystemWrite (3) = Allow sites to ask the user to grant write access to files and directories
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: DefaultFileSystemWriteGuardSetting
- GP name: Control use of the File System API for writing
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: DefaultFileSystemWriteGuardSetting
- Value Type: REG_DWORD
Example value:
0x00000002
Mac information and settings
- Preference Key Name: DefaultFileSystemWriteGuardSetting
- Example value:
<integer>2</integer>
DefaultGeolocationSetting
Default geolocation setting
Supported versions:
- On Windows and macOS since 77 or later
Description
Set whether websites can track users' physical locations. You can allow tracking by default ('AllowGeolocation'), deny it by default ('BlockGeolocation'), or ask the user each time a website requests their location ('AskGeolocation').
If you don't configure this policy, 'AskGeolocation' is used and the user can change it.
Policy options mapping:
AllowGeolocation (1) = Allow sites to track users' physical location
BlockGeolocation (2) = Don't allow any site to track users' physical location
AskGeolocation (3) = Ask whenever a site wants to track users' physical location
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: DefaultGeolocationSetting
- GP name: Default geolocation setting
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: DefaultGeolocationSetting
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: DefaultGeolocationSetting
- Example value:
<integer>1</integer>
DefaultImagesSetting
Default images setting
Supported versions:
- On Windows and macOS since 77 or later
Description
Set whether websites can display images. You can allow images on all sites ('AllowImages') or block them on all sites ('BlockImages').
If you don't configure this policy, images are allowed by default, and the user can change this setting.
Policy options mapping:
AllowImages (1) = Allow all sites to show all images
BlockImages (2) = Don't allow any site to show images
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: DefaultImagesSetting
- GP name: Default images setting
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: DefaultImagesSetting
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: DefaultImagesSetting
- Example value:
<integer>1</integer>
DefaultInsecureContentSetting
Control use of insecure content exceptions
Supported versions:
- On Windows and macOS since 80 or later
Description
Allows you to set whether users can add exceptions to allow mixed content for specific sites.
This policy can be overridden for specific URL patterns using the InsecureContentAllowedForUrls and InsecureContentBlockedForUrls policies.
If this policy isn't set, users will be allowed to add exceptions to allow blockable mixed content and disable autoupgrades for optionally blockable mixed content.
Policy options mapping:
BlockInsecureContent (2) = Do not allow any site to load mixed content
AllowExceptionsInsecureContent (3) = Allow users to add exceptions to allow mixed content
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: DefaultInsecureContentSetting
- GP name: Control use of insecure content exceptions
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: DefaultInsecureContentSetting
- Value Type: REG_DWORD
Example value:
0x00000002
Mac information and settings
- Preference Key Name: DefaultInsecureContentSetting
- Example value:
<integer>2</integer>
DefaultJavaScriptJitSetting
Control use of JavaScript JIT
Supported versions:
- On Windows and macOS since 93 or later
Description
Allows you to set whether Microsoft Edge will run the v8 JavaScript engine with JIT (Just In Time) compiler enabled or not.
Disabling the JavaScript JIT will mean that Microsoft Edge may render web content more slowly, and may also disable parts of JavaScript including WebAssembly. Disabling the JavaScript JIT may allow Microsoft Edge to render web content in a more secure configuration.
This policy can be overridden for specific URL patterns using the JavaScriptJitAllowedForSites and JavaScriptJitBlockedForSites policies.
If you don't configure this policy, JavaScript JIT is enabled.
Policy options mapping:
AllowJavaScriptJit (1) = Allow any site to run JavaScript JIT
BlockJavaScriptJit (2) = Do not allow any site to run JavaScript JIT
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: DefaultJavaScriptJitSetting
- GP name: Control use of JavaScript JIT
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: DefaultJavaScriptJitSetting
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: DefaultJavaScriptJitSetting
- Example value:
<integer>1</integer>
DefaultJavaScriptSetting
Default JavaScript setting
Supported versions:
- On Windows and macOS since 77 or later
Description
Set whether websites can run JavaScript. You can allow it for all sites ('AllowJavaScript') or block it for all sites ('BlockJavaScript').
If you don't configure this policy, all sites can run JavaScript by default, and the user can change this setting.
Policy options mapping:
AllowJavaScript (1) = Allow all sites to run JavaScript
BlockJavaScript (2) = Don't allow any site to run JavaScript
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: DefaultJavaScriptSetting
- GP name: Default JavaScript setting
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: DefaultJavaScriptSetting
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: DefaultJavaScriptSetting
- Example value:
<integer>1</integer>
DefaultNotificationsSetting
Default notification setting
Supported versions:
- On Windows and macOS since 77 or later
Description
Set whether websites can display desktop notifications. You can allow them by default ('AllowNotifications'), deny them by default ('BlockNotifications'), or have the user be asked each time a website wants to show a notification ('AskNotifications').
If you don't configure this policy, notifications are allowed by default, and the user can change this setting.
Policy options mapping:
AllowNotifications (1) = Allow sites to show desktop notifications
BlockNotifications (2) = Don't allow any site to show desktop notifications
AskNotifications (3) = Ask every time a site wants to show desktop notifications
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: DefaultNotificationsSetting
- GP name: Default notification setting
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: DefaultNotificationsSetting
- Value Type: REG_DWORD
Example value:
0x00000002
Mac information and settings
- Preference Key Name: DefaultNotificationsSetting
- Example value:
<integer>2</integer>
DefaultPluginsSetting
Default Adobe Flash setting (obsolete)
OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 87.
Supported versions:
- On Windows and macOS since 77, until 87
Description
This policy doesn't work because Flash is no longer supported by Microsoft Edge.
PluginsAllowedForUrls and PluginsBlockedForUrls are checked first, then this policy. The options are 'ClickToPlay' and 'BlockPlugins'. If you set this policy to 'BlockPlugins', this plugin is denied for all websites. 'ClickToPlay' lets the Flash plugin run, but users click the placeholder to start it.
If you don't configure this policy, the user can change this setting manually.
Note: Automatic playback is only for domains explicitly listed in the PluginsAllowedForUrls policy. To turn automatic playback on for all sites, add http://* and https://* to the allowed list of URLs.
Policy options mapping:
BlockPlugins (2) = Block the Adobe Flash plugin
ClickToPlay (3) = Click to play
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: DefaultPluginsSetting
- GP name: Default Adobe Flash setting (obsolete)
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: DefaultPluginsSetting
- Value Type: REG_DWORD
Example value:
0x00000002
Mac information and settings
- Preference Key Name: DefaultPluginsSetting
- Example value:
<integer>2</integer>
DefaultPopupsSetting
Default pop-up window setting
Supported versions:
- On Windows and macOS since 77 or later
Description
Set whether websites can show pop-up windows. You can allow them on all websites ('AllowPopups') or block them on all sites ('BlockPopups').
If you don't configure this policy, pop-up windows are blocked by default, and users can change this setting.
Policy options mapping:
AllowPopups (1) = Allow all sites to show pop-ups
BlockPopups (2) = Do not allow any site to show popups
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: DefaultPopupsSetting
- GP name: Default pop-up window setting
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: DefaultPopupsSetting
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: DefaultPopupsSetting
- Example value:
<integer>1</integer>
DefaultThirdPartyStoragePartitioningSetting
Default setting for third-party storage partitioning
Supported versions:
- On Windows and macOS since 115 or later
Description
This policy controls whether third-party storage partitioning is allowed by default.
If this policy is set to 1 - AllowPartitioning, or unset, third-party storage partitioning will be allowed by default. This default may be overridden for specific top-level origins by other means.
If this policy is set to 2 - BlockPartitioning, third-party storage partitioning will be disabled for all contexts.
Use ThirdPartyStoragePartitioningBlockedForOrigins to disable third-party storage partitioning for specific top-level origins.
Policy options mapping:
AllowPartitioning (1) = Allow third-party storage partitioning by default.
BlockPartitioning (2) = Disable third-party storage partitioning.
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: DefaultThirdPartyStoragePartitioningSetting
- GP name: Default setting for third-party storage partitioning
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: DefaultThirdPartyStoragePartitioningSetting
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: DefaultThirdPartyStoragePartitioningSetting
- Example value:
<integer>1</integer>
DefaultWebBluetoothGuardSetting
Control use of the Web Bluetooth API
Supported versions:
- On Windows and macOS since 77 or later
Description
Control whether websites can access nearby Bluetooth devices. You can completely block access or require the site to ask the user each time it wants to access a Bluetooth device.
If you don't configure this policy, the default value ('AskWebBluetooth', meaning users are asked each time) is used and users can change it.
Policy options mapping:
BlockWebBluetooth (2) = Do not allow any site to request access to Bluetooth devices via the Web Bluetooth API
AskWebBluetooth (3) = Allow sites to ask the user to grant access to a nearby Bluetooth device
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: DefaultWebBluetoothGuardSetting
- GP name: Control use of the Web Bluetooth API
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: DefaultWebBluetoothGuardSetting
- Value Type: REG_DWORD
Example value:
0x00000002
Mac information and settings
- Preference Key Name: DefaultWebBluetoothGuardSetting
- Example value:
<integer>2</integer>
DefaultWebHidGuardSetting
Control use of the WebHID API
Supported versions:
- On Windows and macOS since 100 or later
Description
Setting the policy to 3 lets websites ask for access to HID devices. Setting the policy to 2 denies access to HID devices.
Leaving it unset lets websites ask for access, but users can change this setting.
This policy can be overridden for specific url patterns using the WebHidAskForUrls and WebHidBlockedForUrls policies.
Policy options mapping:
BlockWebHid (2) = Do not allow any site to request access to HID devices via the WebHID API
AskWebHid (3) = Allow sites to ask the user to grant access to a HID device
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: DefaultWebHidGuardSetting
- GP name: Control use of the WebHID API
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: DefaultWebHidGuardSetting
- Value Type: REG_DWORD
Example value:
0x00000002
Mac information and settings
- Preference Key Name: DefaultWebHidGuardSetting
- Example value:
<integer>2</integer>
DefaultWebUsbGuardSetting
Control use of the WebUSB API
Supported versions:
- On Windows and macOS since 77 or later
Description
Set whether websites can access connected USB devices. You can completely block access or ask the user each time a website wants to get access to connected USB devices.
You can override this policy for specific URL patterns by using the WebUsbAskForUrls and WebUsbBlockedForUrls policies.
If you don't configure this policy, sites can ask users whether they can access the connected USB devices ('AskWebUsb') by default, and users can change this setting.
Policy options mapping:
BlockWebUsb (2) = Do not allow any site to request access to USB devices via the WebUSB API
AskWebUsb (3) = Allow sites to ask the user to grant access to a connected USB device
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: DefaultWebUsbGuardSetting
- GP name: Control use of the WebUSB API
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: DefaultWebUsbGuardSetting
- Value Type: REG_DWORD
Example value:
0x00000002
Mac information and settings
- Preference Key Name: DefaultWebUsbGuardSetting
- Example value:
<integer>2</integer>
DefaultWindowManagementSetting
Default Window Management permission setting
Supported versions:
- On Windows and macOS since 123 or later
Description
Setting the policy to "BlockWindowManagement" (value 2) automatically denies the window management permission to sites by default. This limits the ability of sites to see information about the device's screens and use that information to open and place windows or request fullscreen on specific screens.
Setting the policy to "AskWindowManagement" (value 3) by default prompts the user when the window management permission is requested. If users allow the permission, it extends the ability of sites to see information about the device's screens and use that information to open and place windows or request fullscreen on specific screens.
Not configuring the policy means the "AskWindowManagement" policy applies, but users can change this setting.
Policy options mapping:
BlockWindowManagement (2) = Denies the Window Management permission on all sites by default
AskWindowManagement (3) = Ask every time a site wants obtain the Window Management permission
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: DefaultWindowManagementSetting
- GP name: Default Window Management permission setting
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: DefaultWindowManagementSetting
- Value Type: REG_DWORD
Example value:
0x00000002
Mac information and settings
- Preference Key Name: DefaultWindowManagementSetting
- Example value:
<integer>2</integer>
FileSystemReadAskForUrls
Allow read access via the File System API on these sites
Supported versions:
- On Windows and macOS since 86 or later
Description
Setting the policy lets you list the URL patterns that specify which sites can ask users to grant them read access to files or directories in the host operating system's file system via the File System API.
Leaving the policy unset means DefaultFileSystemReadGuardSetting applies for all sites, if it's set. If not, users' personal settings apply.
URL patterns can't conflict with FileSystemReadBlockedForUrls. Neither policy takes precedence if a URL matches with both.
For detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. * is not an accepted value for this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: FileSystemReadAskForUrls
- GP name: Allow read access via the File System API on these sites
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\FileSystemReadAskForUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\FileSystemReadAskForUrls\1 = "https://www.example.com"
SOFTWARE\Policies\Microsoft\Edge\FileSystemReadAskForUrls\2 = "[*.]example.edu"
Mac information and settings
- Preference Key Name: FileSystemReadAskForUrls
- Example value:
<array>
<string>https://www.example.com</string>
<string>[*.]example.edu</string>
</array>
FileSystemReadBlockedForUrls
Block read access via the File System API on these sites
Supported versions:
- On Windows and macOS since 86 or later
Description
If you set this policy, you can list the URL patterns that specify which sites can't ask users to grant them read access to files or directories in the host operating system's file system via the File System API.
If you don't set this policy, DefaultFileSystemReadGuardSetting applies for all sites, if it's set. If not, users' personal settings apply.
URL patterns can't conflict with FileSystemReadAskForUrls. Neither policy takes precedence if a URL matches with both.
For detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. * is not an accepted value for this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: FileSystemReadBlockedForUrls
- GP name: Block read access via the File System API on these sites
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\FileSystemReadBlockedForUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\FileSystemReadBlockedForUrls\1 = "https://www.example.com"
SOFTWARE\Policies\Microsoft\Edge\FileSystemReadBlockedForUrls\2 = "[*.]example.edu"
Mac information and settings
- Preference Key Name: FileSystemReadBlockedForUrls
- Example value:
<array>
<string>https://www.example.com</string>
<string>[*.]example.edu</string>
</array>
FileSystemWriteAskForUrls
Allow write access to files and directories on these sites
Supported versions:
- On Windows and macOS since 86 or later
Description
If you set this policy, you can list the URL patterns that specify which sites can ask users to grant them write access to files or directories in the host operating system's file system.
If you don't set this policy, DefaultFileSystemWriteGuardSetting applies for all sites, if it's set. If not, users' personal settings apply.
URL patterns can't conflict with FileSystemWriteBlockedForUrls. Neither policy takes precedence if a URL matches with both.
For detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. * is not an accepted value for this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: FileSystemWriteAskForUrls
- GP name: Allow write access to files and directories on these sites
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\FileSystemWriteAskForUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\FileSystemWriteAskForUrls\1 = "https://www.example.com"
SOFTWARE\Policies\Microsoft\Edge\FileSystemWriteAskForUrls\2 = "[*.]example.edu"
Mac information and settings
- Preference Key Name: FileSystemWriteAskForUrls
- Example value:
<array>
<string>https://www.example.com</string>
<string>[*.]example.edu</string>
</array>
FileSystemWriteBlockedForUrls
Block write access to files and directories on these sites
Supported versions:
- On Windows and macOS since 86 or later
Description
If you set this policy, you can list the URL patterns that specify which sites can't ask users to grant them write access to files or directories in the host operating system's file system.
If you don't set this policy, DefaultFileSystemWriteGuardSetting applies for all sites, if it's set. If not, users' personal settings apply.
URL patterns can't conflict with FileSystemWriteAskForUrls. Neither policy takes precedence if a URL matches with both.
For detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. * is not an accepted value for this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: FileSystemWriteBlockedForUrls
- GP name: Block write access to files and directories on these sites
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\FileSystemWriteBlockedForUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\FileSystemWriteBlockedForUrls\1 = "https://www.example.com"
SOFTWARE\Policies\Microsoft\Edge\FileSystemWriteBlockedForUrls\2 = "[*.]example.edu"
Mac information and settings
- Preference Key Name: FileSystemWriteBlockedForUrls
- Example value:
<array>
<string>https://www.example.com</string>
<string>[*.]example.edu</string>
</array>
ImagesAllowedForUrls
Allow images on these sites
Supported versions:
- On Windows and macOS since 77 or later
Description
Define a list of sites, based on URL patterns, that can display images.
If you don't configure this policy, the global default value is used for all sites either from the DefaultImagesSetting policy (if set) or the user's personal configuration.
For detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards (*) are allowed.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ImagesAllowedForUrls
- GP name: Allow images on these sites
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\ImagesAllowedForUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\ImagesAllowedForUrls\1 = "https://www.contoso.com"
SOFTWARE\Policies\Microsoft\Edge\ImagesAllowedForUrls\2 = "[*.]contoso.edu"
Mac information and settings
- Preference Key Name: ImagesAllowedForUrls
- Example value:
<array>
<string>https://www.contoso.com</string>
<string>[*.]contoso.edu</string>
</array>
ImagesBlockedForUrls
Block images on specific sites
Supported versions:
- On Windows and macOS since 77 or later
Description
Define a list of sites, based on URL patterns, that aren't allowed to display images.
If you don't configure this policy, the global default value from the DefaultImagesSetting policy (if set) or the user's personal configuration is used for all sites.
For detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards (*) are allowed.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ImagesBlockedForUrls
- GP name: Block images on specific sites
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\ImagesBlockedForUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\ImagesBlockedForUrls\1 = "https://www.contoso.com"
SOFTWARE\Policies\Microsoft\Edge\ImagesBlockedForUrls\2 = "[*.]contoso.edu"
Mac information and settings
- Preference Key Name: ImagesBlockedForUrls
- Example value:
<array>
<string>https://www.contoso.com</string>
<string>[*.]contoso.edu</string>
</array>
InsecureContentAllowedForUrls
Allow insecure content on specified sites
Supported versions:
- On Windows and macOS since 80 or later
Description
Create a list of URL patterns to specify sites that can display or, as of version 94, download insecure mixed content (that is, HTTP content on HTTPS sites).
If you don't configure this policy, blockable mixed content will be blocked and optionally blockable mixed content will be upgraded. However, users will be allowed to set exceptions to allow insecure mixed content for specific sites.
For detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards (*) are allowed.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: InsecureContentAllowedForUrls
- GP name: Allow insecure content on specified sites
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\InsecureContentAllowedForUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\InsecureContentAllowedForUrls\1 = "https://www.example.com"
SOFTWARE\Policies\Microsoft\Edge\InsecureContentAllowedForUrls\2 = "[*.]example.edu"
Mac information and settings
- Preference Key Name: InsecureContentAllowedForUrls
- Example value:
<array>
<string>https://www.example.com</string>
<string>[*.]example.edu</string>
</array>
InsecureContentBlockedForUrls
Block insecure content on specified sites
Supported versions:
- On Windows and macOS since 80 or later
Description
Create a list of URL patterns to specify sites that aren't allowed to display blockable (i.e. active) mixed content (that is, HTTP content on HTTPS sites) and for which optionally blockable mixed content upgrades will be disabled.
If you don't configure this policy, blockable mixed content will be blocked and optionally blockable mixed content will be upgraded. However, users will be allowed to set exceptions to allow insecure mixed content for specific sites.
For detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards (*) are allowed.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: InsecureContentBlockedForUrls
- GP name: Block insecure content on specified sites
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\InsecureContentBlockedForUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\InsecureContentBlockedForUrls\1 = "https://www.example.com"
SOFTWARE\Policies\Microsoft\Edge\InsecureContentBlockedForUrls\2 = "[*.]example.edu"
Mac information and settings
- Preference Key Name: InsecureContentBlockedForUrls
- Example value:
<array>
<string>https://www.example.com</string>
<string>[*.]example.edu</string>
</array>
IntranetFileLinksEnabled
Allow intranet zone file URL links from Microsoft Edge to open in Windows File Explorer
Supported versions:
- On Windows since 95 or later
Description
This setting allows file URL links to intranet zone files from intranet zone HTTPS websites to open Windows File Explorer for that file or directory.
If you enable this policy, intranet zone file URL links originating from intranet zone HTTPS pages will open Windows File Explorer to the parent directory of the file and select the file. Intranet zone directory URL links originating from intranet zone HTTPS pages will open Windows File Explorer to the directory with no items in the directory selected.
If you disable or don't configure this policy, file URL links will not open.
Microsoft Edge uses the definition of intranet zone as configured for Internet Explorer. Note that https://localhost/ is specifically blocked as an exception of allowed intranet zone host, while loopback addresses (127.0.0.*, [::1]) are considered internet zone by default.
Users may opt out of prompts on a per-protocol/per-site basis unless the ExternalProtocolDialogShowAlwaysOpenCheckbox policy is disabled.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: IntranetFileLinksEnabled
- GP name: Allow intranet zone file URL links from Microsoft Edge to open in Windows File Explorer
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: IntranetFileLinksEnabled
- Value Type: REG_DWORD
Example value:
0x00000000
JavaScriptAllowedForUrls
Allow JavaScript on specific sites
Supported versions:
- On Windows and macOS since 77 or later
Description
Define a list of sites, based on URL patterns, that are allowed to run JavaScript.
If you don't configure this policy, DefaultJavaScriptSetting applies for all sites, if it's set. If not, the user's personal setting applies.
For detailed information about valid url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards, *, are allowed.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: JavaScriptAllowedForUrls
- GP name: Allow JavaScript on specific sites
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\JavaScriptAllowedForUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\JavaScriptAllowedForUrls\1 = "https://www.contoso.com"
SOFTWARE\Policies\Microsoft\Edge\JavaScriptAllowedForUrls\2 = "[*.]contoso.edu"
Mac information and settings
- Preference Key Name: JavaScriptAllowedForUrls
- Example value:
<array>
<string>https://www.contoso.com</string>
<string>[*.]contoso.edu</string>
</array>
JavaScriptBlockedForUrls
Block JavaScript on specific sites
Supported versions:
- On Windows and macOS since 77 or later
Description
Define a list of sites, based on URL patterns, that aren't allowed to run JavaScript.
If you don't configure this policy, DefaultJavaScriptSetting applies for all sites, if it's set. If not, the user's personal setting applies.
For detailed information on valid url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards, *, are allowed.
Note that this policy blocks JavaScript based on whether the origin of the top-level document (usually the page URL that is also displayed in the address bar) matches any of the patterns. Therefore this policy is not appropriate for mitigating web supply-chain attacks. For example, supplying the pattern "https://[*.]foo.com/" will not prevent a page hosted on, say, https://contoso.com
from running a script loaded from https://www.foo.com/example.js
. Furthermore, supplying the pattern "https://contoso.com/" will not prevent a document from https://contoso.com
from running scripts if it is not the top-level document, but embedded as a sub-frame into a page hosted on another origin, say, https://www.fabrikam.com
.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: JavaScriptBlockedForUrls
- GP name: Block JavaScript on specific sites
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\JavaScriptBlockedForUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\JavaScriptBlockedForUrls\1 = "https://www.contoso.com"
SOFTWARE\Policies\Microsoft\Edge\JavaScriptBlockedForUrls\2 = "[*.]contoso.edu"
Mac information and settings
- Preference Key Name: JavaScriptBlockedForUrls
- Example value:
<array>
<string>https://www.contoso.com</string>
<string>[*.]contoso.edu</string>
</array>
JavaScriptJitAllowedForSites
Allow JavaScript to use JIT on these sites
Supported versions:
- On Windows and macOS since 93 or later
Description
Allows you to set a list of site url patterns that specify sites which are allowed to run JavaScript with JIT (Just In Time) compiler enabled.
For detailed information on valid site url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards, *, are allowed.
JavaScript JIT policy exceptions will only be enforced at a site granularity (eTLD+1). A policy set for only subdomain.contoso.com will not correctly apply to contoso.com or subdomain.contoso.com since they both resolve to the same eTLD+1 (contoso.com) for which there is no policy. In this case, policy must be set on contoso.com to apply correctly for both contoso.com and subdomain.contoso.com.
This policy applies on a frame-by-frame basis and not based on top level origin url alone, so e.g. if contoso.com is listed in the JavaScriptJitAllowedForSites policy but contoso.com loads a frame containing fabrikam.com then contoso.com will have JavaScript JIT enabled, but fabrikam.com will use the policy from DefaultJavaScriptJitSetting, if set, or default to JavaScript JIT enabled.
If you don't configure this policy for a site then the policy from DefaultJavaScriptJitSetting applies to the site, if set, otherwise Javascript JIT is enabled for the site.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: JavaScriptJitAllowedForSites
- GP name: Allow JavaScript to use JIT on these sites
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\JavaScriptJitAllowedForSites
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\JavaScriptJitAllowedForSites\1 = "[*.]example.edu"
Mac information and settings
- Preference Key Name: JavaScriptJitAllowedForSites
- Example value:
<array>
<string>[*.]example.edu</string>
</array>
JavaScriptJitBlockedForSites
Block JavaScript from using JIT on these sites
Supported versions:
- On Windows and macOS since 93 or later
Description
Allows you to set a list of site url patterns that specify sites which are not allowed to run JavaScript JIT (Just In Time) compiler enabled.
Disabling the JavaScript JIT will mean that Microsoft Edge may render web content more slowly, and may also disable parts of JavaScript including WebAssembly. Disabling the JavaScript JIT may allow Microsoft Edge to render web content in a more secure configuration.
For detailed information on valid url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards, *, are allowed.
JavaScript JIT policy exceptions will only be enforced at a site granularity (eTLD+1). A policy set for only subdomain.contoso.com will not correctly apply to contoso.com or subdomain.contoso.com since they both resolve to the same eTLD+1 (contoso.com) for which there is no policy. In this case, policy must be set on contoso.com to apply correctly for both contoso.com and subdomain.contoso.com.
This policy applies on a frame-by-frame basis and not based on top level origin url alone, so e.g. if contoso.com is listed in the JavaScriptJitBlockedForSites policy but contoso.com loads a frame containing fabrikam.com then contoso.com will have JavaScript JIT disabled, but fabrikam.com will use the policy from DefaultJavaScriptJitSetting, if set, or default to JavaScript JIT enabled.
If you don't configure this policy for a site then the policy from DefaultJavaScriptJitSetting applies to the site, if set, otherwise JavaScript JIT is enabled for the site.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: JavaScriptJitBlockedForSites
- GP name: Block JavaScript from using JIT on these sites
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\JavaScriptJitBlockedForSites
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\JavaScriptJitBlockedForSites\1 = "[*.]example.edu"
Mac information and settings
- Preference Key Name: JavaScriptJitBlockedForSites
- Example value:
<array>
<string>[*.]example.edu</string>
</array>
LegacySameSiteCookieBehaviorEnabled
Enable default legacy SameSite cookie behavior setting (obsolete)
OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 94.
Supported versions:
- On Windows and macOS since 80, until 94
Description
This policy doesn't work because it was only intended to serve only as a short-term mechanism to give enterprises more time to update their environments if they were found to be incompatible with the SameSite behavior change.
If you still require legacy cookie behavior, please use LegacySameSiteCookieBehaviorEnabledForDomainList to configure behavior on a per-domain basis.
Lets you revert all cookies to legacy SameSite behavior. Reverting to legacy behavior causes cookies that don't specify a SameSite attribute to be treated as if they were "SameSite=None", removes the requirement for "SameSite=None" cookies to carry the "Secure" attribute, and skips the scheme comparison when evaluating if two sites are same-site.
If you don't set this policy, the default SameSite behavior for cookies will depend on other configuration sources for the SameSite-by-default feature, the Cookies-without-SameSite-must-be-secure feature, and the Schemeful Same-Site feature. These features can also be configured by a field trial or the same-site-by-default-cookies flag, the cookies-without-same-site-must-be-secure flag, or the schemeful-same-site flag in edge://flags.
Policy options mapping:
DefaultToLegacySameSiteCookieBehavior (1) = Revert to legacy SameSite behavior for cookies on all sites
DefaultToSameSiteByDefaultCookieBehavior (2) = Use SameSite-by-default behavior for cookies on all sites
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: LegacySameSiteCookieBehaviorEnabled
- GP name: Enable default legacy SameSite cookie behavior setting (obsolete)
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: LegacySameSiteCookieBehaviorEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: LegacySameSiteCookieBehaviorEnabled
- Example value:
<integer>1</integer>
LegacySameSiteCookieBehaviorEnabledForDomainList
Revert to legacy SameSite behavior for cookies on specified sites
Supported versions:
- On Windows and macOS since 80 or later
Description
Cookies set for domains match specified patterns will revert to legacy SameSite behavior.
Reverting to legacy behavior causes cookies that don't specify a SameSite attribute to be treated as if they were "SameSite=None", removes the requirement for "SameSite=None" cookies to carry the "Secure" attribute, and skips the scheme comparison when evaluating if two sites are same-site.
If you don't set this policy, the global default value will be used. The global default will also be used for cookies on domains not covered by the patterns you specify.
The global default value can be configured using the LegacySameSiteCookieBehaviorEnabled policy. If LegacySameSiteCookieBehaviorEnabled is unset, the global default value falls back to other configuration sources.
For detailed information about valid URL patterns, see https://go.microsoft.com/fwlink/?linkid=2095322.
Note that patterns you list in this policy are treated as domains, not URLs, so you should not specify a scheme or port.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: LegacySameSiteCookieBehaviorEnabledForDomainList
- GP name: Revert to legacy SameSite behavior for cookies on specified sites
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\LegacySameSiteCookieBehaviorEnabledForDomainList
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\LegacySameSiteCookieBehaviorEnabledForDomainList\1 = "www.example.com"
SOFTWARE\Policies\Microsoft\Edge\LegacySameSiteCookieBehaviorEnabledForDomainList\2 = "[*.]example.edu"
Mac information and settings
- Preference Key Name: LegacySameSiteCookieBehaviorEnabledForDomainList
- Example value:
<array>
<string>www.example.com</string>
<string>[*.]example.edu</string>
</array>
NotificationsAllowedForUrls
Allow notifications on specific sites
Supported versions:
- On Windows and macOS since 77 or later
Description
Allows you to create a list of url patterns to specify sites that are allowed to display notifications.
If you don't set this policy, the global default value will be used for all sites. This default value will be from the DefaultNotificationsSetting policy if it's set, or from the user's personal configuration. For detailed information on valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: NotificationsAllowedForUrls
- GP name: Allow notifications on specific sites
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\NotificationsAllowedForUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\NotificationsAllowedForUrls\1 = "https://www.contoso.com"
SOFTWARE\Policies\Microsoft\Edge\NotificationsAllowedForUrls\2 = "[*.]contoso.edu"
Mac information and settings
- Preference Key Name: NotificationsAllowedForUrls
- Example value:
<array>
<string>https://www.contoso.com</string>
<string>[*.]contoso.edu</string>
</array>
NotificationsBlockedForUrls
Block notifications on specific sites
Supported versions:
- On Windows and macOS since 77 or later
Description
Allows you to create a list of url patterns to specify sites that are not allowed to display notifications.
If you don't set this policy, the global default value will be used for all sites. This default value will be from the DefaultNotificationsSetting policy if it's set, or from the user's personal configuration. For detailed information on valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: NotificationsBlockedForUrls
- GP name: Block notifications on specific sites
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\NotificationsBlockedForUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\NotificationsBlockedForUrls\1 = "https://www.contoso.com"
SOFTWARE\Policies\Microsoft\Edge\NotificationsBlockedForUrls\2 = "[*.]contoso.edu"
Mac information and settings
- Preference Key Name: NotificationsBlockedForUrls
- Example value:
<array>
<string>https://www.contoso.com</string>
<string>[*.]contoso.edu</string>
</array>
PluginsAllowedForUrls
Allow the Adobe Flash plug-in on specific sites (obsolete)
OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 87.
Supported versions:
- On Windows and macOS since 77, until 87
Description
This policy doesn't work because Flash is no longer supported by Microsoft Edge.
Define a list of sites, based on URL patterns, that can run the Adobe Flash plug-in.
If you don't configure this policy, the global default value from the DefaultPluginsSetting policy (if set) or the user's personal configuration is used for all sites.
For detailed information on valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. However, starting in M85, patterns with '*' and '[*.]' wildcards in the host are no longer supported for this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: PluginsAllowedForUrls
- GP name: Allow the Adobe Flash plug-in on specific sites (obsolete)
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\PluginsAllowedForUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\PluginsAllowedForUrls\1 = "https://www.contoso.com"
SOFTWARE\Policies\Microsoft\Edge\PluginsAllowedForUrls\2 = "http://contoso.edu:8080"
Mac information and settings
- Preference Key Name: PluginsAllowedForUrls
- Example value:
<array>
<string>https://www.contoso.com</string>
<string>http://contoso.edu:8080</string>
</array>
PluginsBlockedForUrls
Block the Adobe Flash plug-in on specific sites (obsolete)
OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 87.
Supported versions:
- On Windows and macOS since 77, until 87
Description
This policy doesn't work because Flash is no longer supported by Microsoft Edge.
Define a list of sites, based on URL patterns, that are blocked from running Adobe Flash.
If you don't configure this policy, the global default value from the DefaultPluginsSetting policy (if set) or the user's personal configuration is used for all sites.
For detailed information on valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. However, starting in M85, patterns with '*' and '[*.]' wildcards in the host are no longer supported for this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: PluginsBlockedForUrls
- GP name: Block the Adobe Flash plug-in on specific sites (obsolete)
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\PluginsBlockedForUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\PluginsBlockedForUrls\1 = "https://www.contoso.com"
SOFTWARE\Policies\Microsoft\Edge\PluginsBlockedForUrls\2 = "http://contoso.edu:8080"
Mac information and settings
- Preference Key Name: PluginsBlockedForUrls
- Example value:
<array>
<string>https://www.contoso.com</string>
<string>http://contoso.edu:8080</string>
</array>
PopupsAllowedForUrls
Allow pop-up windows on specific sites
Supported versions:
- On Windows and macOS since 77 or later
Description
Define a list of sites, based on URL patterns, that can open pop-up windows. Wildcards (*) are allowed.
If you don't configure this policy, the global default value from the DefaultPopupsSetting policy (if set) or the user's personal configuration is used for all sites.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: PopupsAllowedForUrls
- GP name: Allow pop-up windows on specific sites
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\PopupsAllowedForUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\PopupsAllowedForUrls\1 = "https://www.contoso.com"
SOFTWARE\Policies\Microsoft\Edge\PopupsAllowedForUrls\2 = "[*.]contoso.edu"
Mac information and settings
- Preference Key Name: PopupsAllowedForUrls
- Example value:
<array>
<string>https://www.contoso.com</string>
<string>[*.]contoso.edu</string>
</array>
PopupsBlockedForUrls
Block pop-up windows on specific sites
Supported versions:
- On Windows and macOS since 77 or later
Description
Define a list of sites, based on URL patterns, that are blocked from opening pop-up windows. Wildcards (*) are allowed.
If you don't configure this policy, the global default value from the DefaultPopupsSetting policy (if set) or the user's personal configuration is used for all sites.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: PopupsBlockedForUrls
- GP name: Block pop-up windows on specific sites
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\PopupsBlockedForUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\PopupsBlockedForUrls\1 = "https://www.contoso.com"
SOFTWARE\Policies\Microsoft\Edge\PopupsBlockedForUrls\2 = "[*.]contoso.edu"
Mac information and settings
- Preference Key Name: PopupsBlockedForUrls
- Example value:
<array>
<string>https://www.contoso.com</string>
<string>[*.]contoso.edu</string>
</array>
RegisteredProtocolHandlers
Register protocol handlers
Supported versions:
- On Windows and macOS since 77 or later
Description
Set this policy (recommended only) to register a list of protocol handlers. This list is merged with ones registered by the user and both are available to use.
To register a protocol handler:
- Set the protocol property to the scheme (for example, "mailto")
- Set the URL property to the URL property of the application that handlers the scheme specified in the "protocol" field. The pattern can include a "%s" placeholder, which the handled URL replaces.
Users can't remove a protocol handler registered by this policy. However, they can install a new default protocol handler to override the existing protocol handlers.
Supported features:
- Can be mandatory: No
- Can be recommended: Yes
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Dictionary
Windows information and settings
Group Policy (ADMX) info
- GP unique name: RegisteredProtocolHandlers
- GP name: Register protocol handlers
- GP path (Mandatory): N/A
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Content settings
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): N/A
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: RegisteredProtocolHandlers
- Value Type: REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\RegisteredProtocolHandlers = [
{
"default": true,
"protocol": "mailto",
"url": "https://mail.contoso.com/mail/?extsrc=mailto&url=%s"
}
]
Compact example value:
SOFTWARE\Policies\Microsoft\Edge\RegisteredProtocolHandlers = [{"default": true, "protocol": "mailto", "url": "https://mail.contoso.com/mail/?extsrc=mailto&url=%s"}]
Mac information and settings
- Preference Key Name: RegisteredProtocolHandlers
- Example value:
<key>RegisteredProtocolHandlers</key>
<array>
<dict>
<key>default</key>
<true/>
<key>protocol</key>
<string>mailto</string>
<key>url</key>
<string>https://mail.contoso.com/mail/?extsrc=mailto&url=%s</string>
</dict>
</array>
SerialAllowAllPortsForUrls
Automatically grant sites permission to connect all serial ports
Supported versions:
- On Windows and macOS since 97 or later
Description
Setting the policy allows you to list sites which are automatically granted permission to access all available serial ports.
The URLs must be valid, or the policy is ignored. Only the origin (scheme, host, and port) of the URL is considered.
This policy overrides DefaultSerialGuardSetting, SerialAskForUrls, SerialBlockedForUrls and the user's preferences.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: SerialAllowAllPortsForUrls
- GP name: Automatically grant sites permission to connect all serial ports
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\SerialAllowAllPortsForUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\SerialAllowAllPortsForUrls\1 = "https://www.example.com"
Mac information and settings
- Preference Key Name: SerialAllowAllPortsForUrls
- Example value:
<array>
<string>https://www.example.com</string>
</array>
SerialAllowUsbDevicesForUrls
Automatically grant sites permission to connect to USB serial devices
Supported versions:
- On Windows and macOS since 97 or later
Description
Setting the policy lets you list sites that are automatically granted permission to access USB serial devices with vendor and product IDs that match the vendor_id and product_id fields.
Optionally you can omit the product_id field. This enables site access to all the vendor's devices. When you provide a product ID, then you give the site access to a specific device from the vendor but not all devices.
The URLs must be valid, or the policy is ignored. Only the origin (scheme, host, and port) of the URL is considered.
This policy overrides DefaultSerialGuardSetting, SerialAskForUrls, SerialBlockedForUrls and the user's preferences.
This policy only affects access to USB devices through the Web Serial API. To grant access to USB devices through the WebUSB API see the WebUsbAllowDevicesForUrls policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Dictionary
Windows information and settings
Group Policy (ADMX) info
- GP unique name: SerialAllowUsbDevicesForUrls
- GP name: Automatically grant sites permission to connect to USB serial devices
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: SerialAllowUsbDevicesForUrls
- Value Type: REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\SerialAllowUsbDevicesForUrls = [
{
"devices": [
{
"product_id": 5678,
"vendor_id": 1234
}
],
"urls": [
"https://specific-device.example.com"
]
},
{
"devices": [
{
"vendor_id": 1234
}
],
"urls": [
"https://all-vendor-devices.example.com"
]
}
]
Compact example value:
SOFTWARE\Policies\Microsoft\Edge\SerialAllowUsbDevicesForUrls = [{"devices": [{"product_id": 5678, "vendor_id": 1234}], "urls": ["https://specific-device.example.com"]}, {"devices": [{"vendor_id": 1234}], "urls": ["https://all-vendor-devices.example.com"]}]
Mac information and settings
- Preference Key Name: SerialAllowUsbDevicesForUrls
- Example value:
<key>SerialAllowUsbDevicesForUrls</key>
<array>
<dict>
<key>devices</key>
<array>
<dict>
<key>product_id</key>
<integer>5678</integer>
<key>vendor_id</key>
<integer>1234</integer>
</dict>
</array>
<key>urls</key>
<array>
<string>https://specific-device.example.com</string>
</array>
</dict>
<dict>
<key>devices</key>
<array>
<dict>
<key>vendor_id</key>
<integer>1234</integer>
</dict>
</array>
<key>urls</key>
<array>
<string>https://all-vendor-devices.example.com</string>
</array>
</dict>
</array>
ShowPDFDefaultRecommendationsEnabled
Allow notifications to set Microsoft Edge as default PDF reader
Supported versions:
- On Windows and macOS since 93 or later
Description
This policy setting lets you decide whether employees should receive recommendations to set Microsoft Edge as PDF handler.
If you enable or don't configure this setting, employees receive recommendations from Microsoft Edge to set itself as the default PDF handler.
If you disable this setting, employees will not receive any notifications from Microsoft Edge to set itself as the default PDF handler.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ShowPDFDefaultRecommendationsEnabled
- GP name: Allow notifications to set Microsoft Edge as default PDF reader
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: ShowPDFDefaultRecommendationsEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: ShowPDFDefaultRecommendationsEnabled
- Example value:
<true/>
SpotlightExperiencesAndRecommendationsEnabled
Choose whether users can receive customized background images and text, suggestions, notifications, and tips for Microsoft services
Supported versions:
- On Windows since 86 or later
Description
Choose whether users can receive customized background images and text, suggestions, notifications, and tips for Microsoft services.
If you enable or don't configure this setting, spotlight experiences and recommendations are turned on.
If you disable this setting, spotlight experiences and recommendations are turned off.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: SpotlightExperiencesAndRecommendationsEnabled
- GP name: Choose whether users can receive customized background images and text, suggestions, notifications, and tips for Microsoft services
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: SpotlightExperiencesAndRecommendationsEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
ThirdPartyStoragePartitioningBlockedForOrigins
Disable third-party storage partitioning for specific top-level origins
Supported versions:
- On Windows and macOS since 115 or later
Description
This policy lets you set a list of URL patterns that specify top-level origins for which third-party storage partitioning (partitioning of cross-origin iframe storage) should be disabled.
If this policy isn't set or a top-level origin doesn't match one of the URL patterns, then the value from DefaultThirdPartyStoragePartitioningSetting will be used.
Note that the patterns you list are treated as origins, not URLs, so you shouldn't specify a path. For detailed information about valid origin patterns, see https://go.microsoft.com/fwlink/?linkid=2095322.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ThirdPartyStoragePartitioningBlockedForOrigins
- GP name: Disable third-party storage partitioning for specific top-level origins
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\ThirdPartyStoragePartitioningBlockedForOrigins
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\ThirdPartyStoragePartitioningBlockedForOrigins\1 = "www.example.com"
SOFTWARE\Policies\Microsoft\Edge\ThirdPartyStoragePartitioningBlockedForOrigins\2 = "[*.]example.edu"
Mac information and settings
- Preference Key Name: ThirdPartyStoragePartitioningBlockedForOrigins
- Example value:
<array>
<string>www.example.com</string>
<string>[*.]example.edu</string>
</array>
WebHidAllowAllDevicesForUrls
Allow listed sites to connect to any HID device
Supported versions:
- On Windows and macOS since 109 or later
Description
This setting allows you to list sites which are automatically granted permission to access all available devices.
The URLs must be valid or the policy is ignored. Only the origin (scheme, host and port) of the URL is evaluated.
For detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. * is not an accepted value for this policy.
This policy overrides DefaultWebHidGuardSetting, WebHidAskForUrls, WebHidBlockedForUrls and the user's preferences.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: WebHidAllowAllDevicesForUrls
- GP name: Allow listed sites to connect to any HID device
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\WebHidAllowAllDevicesForUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\WebHidAllowAllDevicesForUrls\1 = "https://microsoft.com"
SOFTWARE\Policies\Microsoft\Edge\WebHidAllowAllDevicesForUrls\2 = "https://chromium.org"
Mac information and settings
- Preference Key Name: WebHidAllowAllDevicesForUrls
- Example value:
<array>
<string>https://microsoft.com</string>
<string>https://chromium.org</string>
</array>
WebHidAllowDevicesForUrls
Allow listed sites connect to specific HID devices
Supported versions:
- On Windows and macOS since 109 or later
Description
This setting lets you list the URLs that specify which sites are automatically granted permission to access a HID device with the given vendor and product IDs.
Setting the policy Each item in the list requires both devices and urls fields for the item to be valid, otherwise the item is ignored.
Each item in the devices field must have a vendor_id and may have a product_id field.
Omitting the product_id field will create a policy matching any device with the specified vendor ID.
An item which has a product_id field without a vendor_id field is invalid and is ignored.
If you don't set this policy, that means DefaultWebHidGuardSetting applies, if it's set. If not, the user's personal setting applies.
For detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. * is not an accepted value for this policy.
URLs in this policy shouldn't conflict with those configured through WebHidBlockedForUrls. If they do, this policy takes precedence over WebHidBlockedForUrls.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Dictionary
Windows information and settings
Group Policy (ADMX) info
- GP unique name: WebHidAllowDevicesForUrls
- GP name: Allow listed sites connect to specific HID devices
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: WebHidAllowDevicesForUrls
- Value Type: REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\WebHidAllowDevicesForUrls = [
{
"devices": [
{
"product_id": 5678,
"vendor_id": 1234
}
],
"urls": [
"https://microsoft.com",
"https://chromium.org"
]
}
]
Compact example value:
SOFTWARE\Policies\Microsoft\Edge\WebHidAllowDevicesForUrls = [{"devices": [{"product_id": 5678, "vendor_id": 1234}], "urls": ["https://microsoft.com", "https://chromium.org"]}]
Mac information and settings
- Preference Key Name: WebHidAllowDevicesForUrls
- Example value:
<key>WebHidAllowDevicesForUrls</key>
<array>
<dict>
<key>devices</key>
<array>
<dict>
<key>product_id</key>
<integer>5678</integer>
<key>vendor_id</key>
<integer>1234</integer>
</dict>
</array>
<key>urls</key>
<array>
<string>https://microsoft.com</string>
<string>https://chromium.org</string>
</array>
</dict>
</array>
WebHidAllowDevicesWithHidUsagesForUrls
Automatically grant permission to these sites to connect to HID devices containing top-level collections with the given HID usage
Supported versions:
- On Windows and macOS since 109 or later
Description
This setting allows you to list the URLs that specify which sites are automatically granted permission to access a HID device containing a top-level collection with the given HID usage.
Each item in the list requires both usages and urls fields for the policy to be valid.
Each item in the usages field must have a usage_page and may have a usage field.
Omitting the usage field will create a policy matching any device containing a top-level collection with a usage from the specified usage page.
An item which has a usage field without a usage_page field is invalid and is ignored.
If you don't set this policy, that means DefaultWebHidGuardSetting applies, if it's set. If not, the user's personal setting applies.
For detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. * is not an accepted value for this policy.
URLs in this policy shouldn't conflict with those configured through WebHidBlockedForUrls. If they do, this policy takes precedence over WebHidBlockedForUrls.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Dictionary
Windows information and settings
Group Policy (ADMX) info
- GP unique name: WebHidAllowDevicesWithHidUsagesForUrls
- GP name: Automatically grant permission to these sites to connect to HID devices containing top-level collections with the given HID usage
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: WebHidAllowDevicesWithHidUsagesForUrls
- Value Type: REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\WebHidAllowDevicesWithHidUsagesForUrls = [
{
"urls": [
"https://microsoft.com",
"https://chromium.org"
],
"usages": [
{
"usage": 5678,
"usage_page": 1234
}
]
}
]
Compact example value:
SOFTWARE\Policies\Microsoft\Edge\WebHidAllowDevicesWithHidUsagesForUrls = [{"urls": ["https://microsoft.com", "https://chromium.org"], "usages": [{"usage": 5678, "usage_page": 1234}]}]
Mac information and settings
- Preference Key Name: WebHidAllowDevicesWithHidUsagesForUrls
- Example value:
<key>WebHidAllowDevicesWithHidUsagesForUrls</key>
<array>
<dict>
<key>urls</key>
<array>
<string>https://microsoft.com</string>
<string>https://chromium.org</string>
</array>
<key>usages</key>
<array>
<dict>
<key>usage</key>
<integer>5678</integer>
<key>usage_page</key>
<integer>1234</integer>
</dict>
</array>
</dict>
</array>
WebHidAskForUrls
Allow the WebHID API on these sites
Supported versions:
- On Windows and macOS since 100 or later
Description
Setting the policy lets you list the URL patterns that specify which sites can ask users to grant them access to a HID device.
Leaving the policy unset means DefaultWebHidGuardSetting applies for all sites, if it's set. If not, users' personal settings apply.
For URL patterns that don't match the policy, the following values are applied in order of precedence:
WebHidBlockedForUrls (if there is a match),
DefaultWebHidGuardSetting (if set), or
Users' personal settings.
URL patterns must not conflict with WebHidBlockedForUrls. Neither policy takes precedence if a URL matches both patterns.
For detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. * is not an accepted value for this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: WebHidAskForUrls
- GP name: Allow the WebHID API on these sites
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\WebHidAskForUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\WebHidAskForUrls\1 = "https://microsoft.com"
SOFTWARE\Policies\Microsoft\Edge\WebHidAskForUrls\2 = "https://chromium.org"
Mac information and settings
- Preference Key Name: WebHidAskForUrls
- Example value:
<array>
<string>https://microsoft.com</string>
<string>https://chromium.org</string>
</array>
WebHidBlockedForUrls
Block the WebHID API on these sites
Supported versions:
- On Windows and macOS since 100 or later
Description
Setting the policy lets you list the URL patterns that specify which sites can't ask users to grant them access to a HID device.
Leaving the policy unset means DefaultWebHidGuardSetting applies for all sites, if it's set. If not, users' personal settings apply.
For URL patterns that don't match the policy, the following values are applied in order of precedence:
WebHidAskForUrls (if there is a match),
DefaultWebHidGuardSetting (if set), or
Users' personal settings.
URL patterns can't conflict with WebHidAskForUrls. Neither policy takes precedence if a URL matches both patterns.
For detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. * is not an accepted value for this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: WebHidBlockedForUrls
- GP name: Block the WebHID API on these sites
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\WebHidBlockedForUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\WebHidBlockedForUrls\1 = "https://microsoft.com"
SOFTWARE\Policies\Microsoft\Edge\WebHidBlockedForUrls\2 = "https://chromium.org"
Mac information and settings
- Preference Key Name: WebHidBlockedForUrls
- Example value:
<array>
<string>https://microsoft.com</string>
<string>https://chromium.org</string>
</array>
WebUsbAllowDevicesForUrls
Grant access to specific sites to connect to specific USB devices
Supported versions:
- On Windows and macOS since 77 or later
Description
Allows you to set a list of urls that specify which sites will automatically be granted permission to access a USB device with the given vendor and product IDs. Each item in the list must contain both devices and urls in order for the policy to be valid. Each item in devices can contain a vendor ID and product ID field. Any ID that is omitted is treated as a wildcard with one exception, and that exception is that a product ID cannot be specified without a vendor ID also being specified. Otherwise, the policy will not be valid and will be ignored.
The USB permission model uses the URL of the requesting site ("requesting URL") and the URL of the top-level frame site ("embedding URL") to grant permission to the requesting URL to access the USB device. The requesting URL may be different than the embedding URL when the requesting site is loaded in an iframe. Therefore, the "urls" field can contain up to two URL strings delimited by a comma to specify the requesting and embedding URL respectively. If only one URL is specified, then access to the corresponding USB devices will be granted when the requesting site's URL matches this URL regardless of embedding status. The URLs in "urls" must be valid URLs, otherwise the policy will be ignored.
This is deprecated and only supported for backwards compatibility in the following manner. If both a requesting and embedding URL is specified, then the embedding URL will be granted the permission as top-level origin and the requesting URL will be ignored entirely.
If this policy is left not set, the global default value will be used for all sites either from the DefaultWebUsbGuardSetting policy if it is set, or the user's personal configuration otherwise.
URL patterns in this policy should not clash with the ones configured via WebUsbBlockedForUrls. If there is a clash, this policy will take precedence over WebUsbBlockedForUrls and WebUsbAskForUrls.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Dictionary
Windows information and settings
Group Policy (ADMX) info
- GP unique name: WebUsbAllowDevicesForUrls
- GP name: Grant access to specific sites to connect to specific USB devices
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: WebUsbAllowDevicesForUrls
- Value Type: REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\WebUsbAllowDevicesForUrls = [
{
"devices": [
{
"product_id": 5678,
"vendor_id": 1234
}
],
"urls": [
"https://contoso.com",
"https://fabrikam.com"
]
}
]
Compact example value:
SOFTWARE\Policies\Microsoft\Edge\WebUsbAllowDevicesForUrls = [{"devices": [{"product_id": 5678, "vendor_id": 1234}], "urls": ["https://contoso.com", "https://fabrikam.com"]}]
Mac information and settings
- Preference Key Name: WebUsbAllowDevicesForUrls
- Example value:
<key>WebUsbAllowDevicesForUrls</key>
<array>
<dict>
<key>devices</key>
<array>
<dict>
<key>product_id</key>
<integer>5678</integer>
<key>vendor_id</key>
<integer>1234</integer>
</dict>
</array>
<key>urls</key>
<array>
<string>https://contoso.com</string>
<string>https://fabrikam.com</string>
</array>
</dict>
</array>
WebUsbAskForUrls
Allow WebUSB on specific sites
Supported versions:
- On Windows and macOS since 77 or later
Description
Define a list of sites, based on URL patterns, that can ask the user for access to a USB device.
If you don't configure this policy, the global default value from the DefaultWebUsbGuardSetting policy (if set) or the user's personal configuration is used for all sites.
The URL patterns defined in this policy can't conflict with those configured in the WebUsbBlockedForUrls policy - you can't both allow and block a URL. For detailed information on valid url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: WebUsbAskForUrls
- GP name: Allow WebUSB on specific sites
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\WebUsbAskForUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\WebUsbAskForUrls\1 = "https://www.contoso.com"
SOFTWARE\Policies\Microsoft\Edge\WebUsbAskForUrls\2 = "[*.]contoso.edu"
Mac information and settings
- Preference Key Name: WebUsbAskForUrls
- Example value:
<array>
<string>https://www.contoso.com</string>
<string>[*.]contoso.edu</string>
</array>
WebUsbBlockedForUrls
Block WebUSB on specific sites
Supported versions:
- On Windows and macOS since 77 or later
Description
Define a list of sites, based on URL patterns, that can't ask the user to grant them access to a USB device.
If you don't configure this policy, the global default value from the DefaultWebUsbGuardSetting policy (if set) or the user's personal configuration is used for all sites.
URL patterns in this policy can't conflict with those configured in the WebUsbAskForUrls policy. You can't both allow and block a URL. For detailed information on valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: WebUsbBlockedForUrls
- GP name: Block WebUSB on specific sites
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\WebUsbBlockedForUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\WebUsbBlockedForUrls\1 = "https://www.contoso.com"
SOFTWARE\Policies\Microsoft\Edge\WebUsbBlockedForUrls\2 = "[*.]contoso.edu"
Mac information and settings
- Preference Key Name: WebUsbBlockedForUrls
- Example value:
<array>
<string>https://www.contoso.com</string>
<string>[*.]contoso.edu</string>
</array>
WindowManagementAllowedForUrls
Allow Window Management permission on specified sites
Supported versions:
- On Windows and macOS since 123 or later
Description
Lets you configure a list of site url patterns that specify sites which will automatically grant the window management permission. This extends the ability of sites to see information about the device's screens. This information can be used to open and place windows or request fullscreen on specific screens.
For detailed information on valid site url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards, *, are allowed. This policy only matches based on site origin, so any path in the URL pattern is ignored.
If this policy isn't configured for a site, then the policy from DefaultWindowManagementSetting applies to the site, if configured. Otherwise the permission will follow the browser's defaults and let users choose this permission per site.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: WindowManagementAllowedForUrls
- GP name: Allow Window Management permission on specified sites
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\WindowManagementAllowedForUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\WindowManagementAllowedForUrls\1 = "https://www.example.com"
SOFTWARE\Policies\Microsoft\Edge\WindowManagementAllowedForUrls\2 = "[*.]example.edu"
Mac information and settings
- Preference Key Name: WindowManagementAllowedForUrls
- Example value:
<array>
<string>https://www.example.com</string>
<string>[*.]example.edu</string>
</array>
WindowManagementBlockedForUrls
Block Window Management permission on specified sites
Supported versions:
- On Windows and macOS since 123 or later
Description
Lets you configure a list of site url patterns that specify sites which will automatically deny the window management permission. This limits the ability of sites to see information about the device's screens. This information can be used to open and place windows or request fullscreen on specific screens.
For detailed information on valid site url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards, *, are allowed. This policy only matches based on site origin, so any path in the URL pattern is ignored.
If this policy isn't configured for a site, then the policy from DefaultWindowManagementSetting applies to the site, if configured. Otherwise the permission will follow the browser's defaults and let users choose this permission per site.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: WindowManagementBlockedForUrls
- GP name: Block Window Management permission on specified sites
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Content settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\WindowManagementBlockedForUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\WindowManagementBlockedForUrls\1 = "https://www.example.com"
SOFTWARE\Policies\Microsoft\Edge\WindowManagementBlockedForUrls\2 = "[*.]example.edu"
Mac information and settings
- Preference Key Name: WindowManagementBlockedForUrls
- Example value:
<array>
<string>https://www.example.com</string>
<string>[*.]example.edu</string>
</array>
Default search provider policies
DefaultSearchProviderEnabled
Enable the default search provider
Supported versions:
- On Windows and macOS since 77 or later
Description
Enables the ability to use a default search provider.
If you enable this policy, a user can search for a term by typing in the address bar (as long as what they type isn't a URL).
You can specify the default search provider to use by enabling the rest of the default search policies. If these are left empty (not configured) or configured incorrectly, the user can choose the default provider.
If you disable this policy, the user can't search from the address bar.
If you enable or disable this policy, users can't change or override it.
If you don't configure this policy, the default search provider is enabled, and the user can choose the default search provider and set the search provider list.
This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, joined to Microsoft Azure Active Directory, or instances that enrolled for device management. On macOS, this policy is available only on instances that are managed via MDM or joined to a domain via MCX.
Starting in Microsoft Edge 84, you can set this policy as a recommended policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: DefaultSearchProviderEnabled
- GP name: Enable the default search provider
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Default search provider
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Default search provider
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: DefaultSearchProviderEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: DefaultSearchProviderEnabled
- Example value:
<true/>
DefaultSearchProviderEncodings
Default search provider encodings
Supported versions:
- On Windows and macOS since 77 or later
Description
Specify the character encodings supported by the search provider. Encodings are code page names like UTF-8, GB2312, and ISO-8859-1. They are tried in the order provided.
This policy is optional. If not configured, the default, UTF-8, is used.
This policy is applied only if you enable the DefaultSearchProviderEnabled and DefaultSearchProviderSearchURL policies.
Starting in Microsoft Edge 84, you can set this policy as a recommended policy. If the user has already set a default search provider, the default search provider configured by this recommended policy will not be added to the list of search providers the user can choose from. If this is the desired behavior, use the ManagedSearchEngines policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: DefaultSearchProviderEncodings
- GP name: Default search provider encodings
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Default search provider
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Default search provider
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\DefaultSearchProviderEncodings
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended\DefaultSearchProviderEncodings
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\DefaultSearchProviderEncodings\1 = "UTF-8"
SOFTWARE\Policies\Microsoft\Edge\DefaultSearchProviderEncodings\2 = "UTF-16"
SOFTWARE\Policies\Microsoft\Edge\DefaultSearchProviderEncodings\3 = "GB2312"
SOFTWARE\Policies\Microsoft\Edge\DefaultSearchProviderEncodings\4 = "ISO-8859-1"
Mac information and settings
- Preference Key Name: DefaultSearchProviderEncodings
- Example value:
<array>
<string>UTF-8</string>
<string>UTF-16</string>
<string>GB2312</string>
<string>ISO-8859-1</string>
</array>
DefaultSearchProviderImageURL
Specifies the search-by-image feature for the default search provider
Supported versions:
- On Windows and macOS since 77 or later
Description
Specifies the URL to the search engine used for image search. Search requests are sent using the GET method.
This policy is optional. If you don't configure it, image search isn't available.
Specify Bing's Image Search URL as: '{bing:baseURL}images/detail/search?iss=sbiupload&FORM=ANCMS1#enterInsights'.
Specify Google's Image Search URL as: '{google:baseURL}searchbyimage/upload'.
See DefaultSearchProviderImageURLPostParams policy to finish configuring image search.
This policy is applied only if you enable the DefaultSearchProviderEnabled and DefaultSearchProviderSearchURL policies.
Starting in Microsoft Edge 84, you can set this policy as a recommended policy. If the user has already set a default search provider, the default search provider configured by this recommended policy will not be added to the list of search providers the user can choose from. If this is the desired behavior, use the ManagedSearchEngines policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- String
Windows information and settings
Group Policy (ADMX) info
- GP unique name: DefaultSearchProviderImageURL
- GP name: Specifies the search-by-image feature for the default search provider
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Default search provider
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Default search provider
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: DefaultSearchProviderImageURL
- Value Type: REG_SZ
Example value:
"https://search.contoso.com/searchbyimage/upload"
Mac information and settings
- Preference Key Name: DefaultSearchProviderImageURL
- Example value:
<string>https://search.contoso.com/searchbyimage/upload</string>
DefaultSearchProviderImageURLPostParams
Parameters for an image URL that uses POST
Supported versions:
- On Windows and macOS since 77 or later
Description
If you enable this policy, it specifies the parameters used when an image search that uses POST is performed. The policy consists of comma-separated name/value pairs. If a value is a template parameter, like {imageThumbnail} in the preceding example, it's replaced with real image thumbnail data. This policy is applied only if you enable the DefaultSearchProviderEnabled and DefaultSearchProviderSearchURL policies.
Specify Bing's Image Search URL Post Params as: 'imageBin={google:imageThumbnailBase64}'.
Specify Google's Image Search URL Post Params as: 'encoded_image={google:imageThumbnail},image_url={google:imageURL},sbisrc={google:imageSearchSource},original_width={google:imageOriginalWidth},original_height={google:imageOriginalHeight}'.
If you don't set this policy, image search requests are sent using the GET method.
Starting in Microsoft Edge 84, you can set this policy as a recommended policy. If the user has already set a default search provider, the default search provider configured by this recommended policy will not be added to the list of search providers the user can choose from. If this is the desired behavior, use the ManagedSearchEngines policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- String
Windows information and settings
Group Policy (ADMX) info
- GP unique name: DefaultSearchProviderImageURLPostParams
- GP name: Parameters for an image URL that uses POST
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Default search provider
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Default search provider
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: DefaultSearchProviderImageURLPostParams
- Value Type: REG_SZ
Example value:
"content={imageThumbnail},url={imageURL},sbisrc={SearchSource}"
Mac information and settings
- Preference Key Name: DefaultSearchProviderImageURLPostParams
- Example value:
<string>content={imageThumbnail},url={imageURL},sbisrc={SearchSource}</string>
DefaultSearchProviderKeyword
Default search provider keyword
Supported versions:
- On Windows and macOS since 77 or later
Description
Specifies the keyword, which is the shortcut used in the Address Bar to trigger the search for this provider.
This policy is optional. If you don't configure it, no keyword activates the search provider.
This policy is applied only if you enable the DefaultSearchProviderEnabled and DefaultSearchProviderSearchURL policies.
Starting in Microsoft Edge 84, you can set this policy as a recommended policy. If the user has already set a default search provider, the default search provider configured by this recommended policy will not be added to the list of search providers the user can choose from. If this is the desired behavior, use the ManagedSearchEngines policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- String
Windows information and settings
Group Policy (ADMX) info
- GP unique name: DefaultSearchProviderKeyword
- GP name: Default search provider keyword
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Default search provider
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Default search provider
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: DefaultSearchProviderKeyword
- Value Type: REG_SZ
Example value:
"mis"
Mac information and settings
- Preference Key Name: DefaultSearchProviderKeyword
- Example value:
<string>mis</string>
DefaultSearchProviderName
Default search provider name
Supported versions:
- On Windows and macOS since 77 or later
Description
Specifies the name of the default search provider.
If you enable this policy, you set the name of the default search provider.
If you don't enable this policy or if you leave it empty, the host name specified by the search URL is used.
'DefaultSearchProviderName' should be set to an organization-approved encrypted search provider that corresponds to the encrypted search provider set in DTBC-0008. This policy is applied only if you enable the DefaultSearchProviderEnabled and DefaultSearchProviderSearchURL policies.
Starting in Microsoft Edge 84, you can set this policy as a recommended policy. If the user has already set a default search provider, the default search provider configured by this recommended policy will not be added to the list of search providers the user can choose from. If this is the desired behavior, use the ManagedSearchEngines policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- String
Windows information and settings
Group Policy (ADMX) info
- GP unique name: DefaultSearchProviderName
- GP name: Default search provider name
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Default search provider
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Default search provider
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: DefaultSearchProviderName
- Value Type: REG_SZ
Example value:
"My Intranet Search"
Mac information and settings
- Preference Key Name: DefaultSearchProviderName
- Example value:
<string>My Intranet Search</string>
DefaultSearchProviderSearchURL
Default search provider search URL
Supported versions:
- On Windows and macOS since 77 or later
Description
Specifies the URL of the search engine used for a default search. The URL contains the string '{searchTerms}', which is replaced at query time by the terms the user is searching for.
Specify Bing's search URL as:
'{bing:baseURL}search?q={searchTerms}'.
Specify Google's search URL as: '{google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}ie={inputEncoding}'.
This policy is required when you enable the DefaultSearchProviderEnabled policy; if you don't enable the latter policy, this policy is ignored.
Starting in Microsoft Edge 84, you can set this policy as a recommended policy. If the user has already set a default search provider, the default search provider configured by this recommended policy will not be added to the list of search providers the user can choose from. If this is the desired behavior, use the ManagedSearchEngines policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- String
Windows information and settings
Group Policy (ADMX) info
- GP unique name: DefaultSearchProviderSearchURL
- GP name: Default search provider search URL
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Default search provider
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Default search provider
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: DefaultSearchProviderSearchURL
- Value Type: REG_SZ
Example value:
"https://search.contoso.com/search?q={searchTerms}"
Mac information and settings
- Preference Key Name: DefaultSearchProviderSearchURL
- Example value:
<string>https://search.contoso.com/search?q={searchTerms}</string>
DefaultSearchProviderSuggestURL
Default search provider URL for suggestions
Supported versions:
- On Windows and macOS since 77 or later
Description
Specifies the URL for the search engine used to provide search suggestions. The URL contains the string '{searchTerms}', which is replaced at query time by the text the user has entered so far.
This policy is optional. If you don't configure it, users won't see search suggestions; they will see suggestions from their browsing history and favorites.
Bing's suggest URL can be specified as:
'{bing:baseURL}qbox?query={searchTerms}'.
Google's suggest URL can be specified as: '{google:baseURL}complete/search?output=chrome&q={searchTerms}'.
This policy is applied only if you enable the DefaultSearchProviderEnabled and DefaultSearchProviderSearchURL policies.
Starting in Microsoft Edge 84, you can set this policy as a recommended policy. If the user has already set a default search provider, the default search provider configured by this recommended policy will not be added to the list of search providers the user can choose from. If this is the desired behavior, use the ManagedSearchEngines policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- String
Windows information and settings
Group Policy (ADMX) info
- GP unique name: DefaultSearchProviderSuggestURL
- GP name: Default search provider URL for suggestions
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Default search provider
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Default search provider
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: DefaultSearchProviderSuggestURL
- Value Type: REG_SZ
Example value:
"https://search.contoso.com/suggest?q={searchTerms}"
Mac information and settings
- Preference Key Name: DefaultSearchProviderSuggestURL
- Example value:
<string>https://search.contoso.com/suggest?q={searchTerms}</string>
NewTabPageSearchBox
Configure the new tab page search box experience
Supported versions:
- On Windows and macOS since 85 or later
Description
You can configure the new tab page search box to use "Search box (Recommended)" or "Address bar" to search on new tabs. This policy only works if you set the search engine to a value other than Bing by setting the following two policies: DefaultSearchProviderEnabled and DefaultSearchProviderSearchURL.
If you disable or don't configure this policy and:
- If the address bar default search engine is Bing, the new tab page uses the search box to search on new tabs.
- If the address bar default search engine is not Bing, users are offered an additional choice (use "Address bar") when searching on new tabs.
If you enable this policy and set it to:
- "Search box (Recommended)" ('bing'), the new tab page uses the search box to search on new tabs.
- "Address bar" ('redirect'), the new tab page search box uses the address bar to search on new tabs.
Policy options mapping:
bing (bing) = Search box (Recommended)
redirect (redirect) = Address bar
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- String
Windows information and settings
Group Policy (ADMX) info
- GP unique name: NewTabPageSearchBox
- GP name: Configure the new tab page search box experience
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Default search provider
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Default search provider
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: NewTabPageSearchBox
- Value Type: REG_SZ
Example value:
"bing"
Mac information and settings
- Preference Key Name: NewTabPageSearchBox
- Example value:
<string>bing</string>
Downloads policies
ShowDownloadsInsecureWarningsEnabled
Enable insecure download warnings
Supported versions:
- On Windows and macOS since 128 or later
Description
Enables warnings when potentially dangerous content is downloaded over HTTP.
If you enable or don't configure this policy, when a user tries to download potentially dangerous content from an HTTP site, the user will receive a UI warning, such as "Insecure download blocked." The user will still have an option to proceed and download the item.
If you disable this policy, the warnings for insecure downloads will be suppressed.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ShowDownloadsInsecureWarningsEnabled
- GP name: Enable insecure download warnings
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Downloads
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Downloads
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: ShowDownloadsInsecureWarningsEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: ShowDownloadsInsecureWarningsEnabled
- Example value:
<true/>
Edge Website Typo Protection settings policies
PreventTyposquattingPromptOverride
Prevent bypassing Edge Website Typo Protection prompts for sites
Supported versions:
- On Windows and macOS since 121 or later
Description
This policy setting lets you decide whether users can override the Edge Website Typo Protection warnings about potential typosquatting websites.
If you enable this setting, users can't ignore Edge Website Typo Protection warnings and they are blocked from continuing to the site.
If you disable or don't configure this setting, users can ignore Edge Website Typo Protection warnings and continue to the site.
This will only take effect when TyposquattingCheckerEnabled policy is not set or set to enabled.
This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, Windows 10 Pro or Enterprise instances that enrolled for device management, or macOS instances that are that are managed via MDM or joined to a domain via MCX.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: PreventTyposquattingPromptOverride
- GP name: Prevent bypassing Edge Website Typo Protection prompts for sites
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Edge Website Typo Protection settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: PreventTyposquattingPromptOverride
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: PreventTyposquattingPromptOverride
- Example value:
<true/>
TyposquattingAllowListDomains
Configure the list of domains for which Edge Website Typo Protection won't trigger warnings
Supported versions:
- On Windows and macOS since 121 or later
Description
Configure the list of Edge Website Typo Protection trusted domains. This means: Edge Website Typo Protection won't check for potentially malicious typosquatting websites.
If you enable this policy, Edge Website Typo Protection trusts these domains. If you disable or don't set this policy, default Edge Website Typo Protection protection is applied to all resources.
This will only take effect when TyposquattingCheckerEnabled policy is not set or set to enabled.
This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, Windows 10/11 Pro or Enterprise instances that enrolled for device management, or macOS instances that are that are managed via MDM or joined to a domain via MCX. Also note that this policy does not apply if your organization has enabled Microsoft Defender for Endpoint. You must configure your allow and block lists in Microsoft 365 Defender portal using Indicators (Settings > Endpoints > Indicators).
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: TyposquattingAllowListDomains
- GP name: Configure the list of domains for which Edge Website Typo Protection won't trigger warnings
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Edge Website Typo Protection settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\TyposquattingAllowListDomains
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\TyposquattingAllowListDomains\1 = "mydomain.com"
SOFTWARE\Policies\Microsoft\Edge\TyposquattingAllowListDomains\2 = "myuniversity.edu"
Mac information and settings
- Preference Key Name: TyposquattingAllowListDomains
- Example value:
<array>
<string>mydomain.com</string>
<string>myuniversity.edu</string>
</array>
TyposquattingCheckerEnabled
Configure Edge Website Typo Protection
Supported versions:
- On Windows and macOS since 96 or later
Description
This policy setting lets you configure whether to turn on Edge Website Typo Protection. Edge Website Typo Protection provides warning messages to help protect your users from potential typosquatting sites. By default, Edge Website Typo Protection is turned on.
If you enable this policy, Edge Website Typo Protection is turned on.
If you disable this policy, Edge Website Typo Protection is turned off.
If you don't configure this policy, Edge Website Typo Protection is turned on but users can choose whether to use Edge Website Typo Protection.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: TyposquattingCheckerEnabled
- GP name: Configure Edge Website Typo Protection
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Edge Website Typo Protection settings
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Edge Website Typo Protection settings
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: TyposquattingCheckerEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: TyposquattingCheckerEnabled
- Example value:
<true/>
Edge Workspaces settings policies
EdgeWorkspacesEnabled
Enable Workspaces
Supported versions:
- On Windows and macOS since 106 or later
Description
Microsoft Edge Workspaces helps improve productivity for users in your organization.
If you enable or don't configure this policy, users will be able to access the Microsoft Edge Workspaces feature. If you disable this policy, users will not be able to access the Microsoft Edge Workspaces feature.
To learn more about the feature, see https://go.microsoft.com/fwlink/?linkid=2209950
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: EdgeWorkspacesEnabled
- GP name: Enable Workspaces
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Edge Workspaces settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: EdgeWorkspacesEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: EdgeWorkspacesEnabled
- Example value:
<true/>
WorkspacesNavigationSettings
Configure navigation settings per groups of URLs in Microsoft Edge Workspaces
Supported versions:
- On Windows and macOS since 110 or later
Description
This setting lets you to define groups of URLs, and apply specific Microsoft Edge Workspaces navigation settings to each group.
If this policy is configured, Microsoft Edge Workspaces will use the configured settings when deciding whether and how to share navigations among collaborators in a Microsoft Edge Workspace.
If this policy is not configured, Microsoft Edge Workspaces will use only default and internally configured navigation settings.
For more information about configuration options, see https://go.microsoft.com/fwlink/?linkid=2218655
Note, format url_patterns according to https://go.microsoft.com/fwlink/?linkid=2095322. You can configure the url_regex_patterns in this policy to match multiple URLs using a Perl style regular expression for the pattern. Note that pattern matches are case sensitive. For more information about the regular expression rules that are used, refer to https://go.microsoft.com/fwlink/p/?linkid=2133903.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Dictionary
Windows information and settings
Group Policy (ADMX) info
- GP unique name: WorkspacesNavigationSettings
- GP name: Configure navigation settings per groups of URLs in Microsoft Edge Workspaces
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Edge Workspaces settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: WorkspacesNavigationSettings
- Value Type: REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\WorkspacesNavigationSettings = [
{
"navigation_options": {
"do_not_send_to": true,
"remove_all_query_parameters": true
},
"url_patterns": [
"https://contoso.com",
"https://www.fabrikam.com",
".exact.hostname.com"
]
},
{
"navigation_options": {
"query_parameters_to_remove": [
"username",
"login_hint"
]
},
"url_patterns": [
"https://adatum.com"
]
},
{
"navigation_options": {
"do_not_send_from": true,
"prefer_initial_url": true
},
"url_regex_patterns": [
"\\Ahttps://.*?tafe\\..*?trs.*?\\.fabrikam.com/Sts"
]
}
]
Compact example value:
SOFTWARE\Policies\Microsoft\Edge\WorkspacesNavigationSettings = [{"navigation_options": {"do_not_send_to": true, "remove_all_query_parameters": true}, "url_patterns": ["https://contoso.com", "https://www.fabrikam.com", ".exact.hostname.com"]}, {"navigation_options": {"query_parameters_to_remove": ["username", "login_hint"]}, "url_patterns": ["https://adatum.com"]}, {"navigation_options": {"do_not_send_from": true, "prefer_initial_url": true}, "url_regex_patterns": ["\\Ahttps://.*?tafe\\..*?trs.*?\\.fabrikam.com/Sts"]}]
Mac information and settings
- Preference Key Name: WorkspacesNavigationSettings
- Example value:
<key>WorkspacesNavigationSettings</key>
<array>
<dict>
<key>navigation_options</key>
<dict>
<key>do_not_send_to</key>
<true/>
<key>remove_all_query_parameters</key>
<true/>
</dict>
<key>url_patterns</key>
<array>
<string>https://contoso.com</string>
<string>https://www.fabrikam.com</string>
<string>.exact.hostname.com</string>
</array>
</dict>
<dict>
<key>navigation_options</key>
<dict>
<key>query_parameters_to_remove</key>
<array>
<string>username</string>
<string>login_hint</string>
</array>
</dict>
<key>url_patterns</key>
<array>
<string>https://adatum.com</string>
</array>
</dict>
<dict>
<key>navigation_options</key>
<dict>
<key>do_not_send_from</key>
<true/>
<key>prefer_initial_url</key>
<true/>
</dict>
<key>url_regex_patterns</key>
<array>
<string>\Ahttps://.*?tafe\..*?trs.*?\.fabrikam.com/Sts</string>
</array>
</dict>
</array>
Experimentation policies
FeatureFlagOverridesControl
Configure users ability to override feature flags
Supported versions:
- On Windows and macOS since 93 or later
Description
Configures users ability to override state of feature flags. If you set this policy to 'CommandLineOverridesEnabled', users can override state of feature flags using command line arguments but not edge://flags page.
If you set this policy to 'OverridesEnabled', users can override state of feature flags using command line arguments or edge://flags page.
If you set this policy to 'OverridesDisabled', users can't override state of feature flags using command line arguments or edge://flags page.
If you don't configure this policy, the behavior is the same as the 'OverridesEnabled'.
Policy options mapping:
CommandLineOverridesEnabled (2) = Allow users to override feature flags using command line arguments only
OverridesEnabled (1) = Allow users to override feature flags
OverridesDisabled (0) = Prevent users from overriding feature flags
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: FeatureFlagOverridesControl
- GP name: Configure users ability to override feature flags
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Experimentation
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: FeatureFlagOverridesControl
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: FeatureFlagOverridesControl
- Example value:
<integer>1</integer>
Extensions policies
BlockExternalExtensions
Blocks external extensions from being installed
Supported versions:
- On Windows and macOS since 88 or later
Description
Control the installation of external extensions.
If you enable this setting, external extensions are blocked from being installed.
If you disable this setting or leave it unset, external extensions are allowed to be installed.
External extensions and their installation are documented at Alternate extension distribution methods.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: BlockExternalExtensions
- GP name: Blocks external extensions from being installed
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Extensions
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: BlockExternalExtensions
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: BlockExternalExtensions
- Example value:
<true/>
ControlDefaultStateOfAllowExtensionFromOtherStoresSettingEnabled
Configure default state of Allow extensions from other stores setting
Supported versions:
- On Windows and macOS since 101 or later
Description
This policy allows you to control the default state of the Allow extensions from other stores setting. This policy can't be used to stop installation of extensions from other stores such as Chrome Web Store. To stop installation of extensions from other stores, use the Extension Settings policy: https://go.microsoft.com/fwlink/?linkid=2187098.
When enabled, Allow extensions from other stores will be turned on. So, users won't have to turn on the flag manually while installing extensions from other supported stores such as Chrome Web Store. However a user can override this setting. If the user has already turned on the setting and then turned it off, this setting may not work. If the Admin first sets the policy as Enabled, but then changes it to not configured or disabled, it will have no impact on user settings and the setting will remain as it is.
When disabled or not configured, the user can manage the Allow extensions from other store setting.
Supported features:
- Can be mandatory: No
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ControlDefaultStateOfAllowExtensionFromOtherStoresSettingEnabled
- GP name: Configure default state of Allow extensions from other stores setting
- GP path (Mandatory): N/A
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Extensions
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): N/A
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: ControlDefaultStateOfAllowExtensionFromOtherStoresSettingEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: ControlDefaultStateOfAllowExtensionFromOtherStoresSettingEnabled
- Example value:
<true/>
ExtensionAllowedTypes
Configure allowed extension types
Supported versions:
- On Windows and macOS since 77 or later
Description
Setting the policy controls which apps and extensions may be installed in Microsoft Edge, which hosts they can interact with, and limits runtime access.
If you don't set this policy, there aren't any restrictions on acceptable extension and app types.
Extensions and apps which have a type that's not on the list won't be installed. Each value should be one of these strings:
"extension"
"theme"
"user_script"
"hosted_app"
See the Microsoft Edge extensions documentation for more information about these types.
Note: This policy also affects extensions and apps to be force-installed using ExtensionInstallForcelist.
Policy options mapping:
extension (extension) = Extension
theme (theme) = Theme
user_script (user_script) = User script
hosted_app (hosted_app) = Hosted app
legacy_packaged_app (legacy_packaged_app) = Legacy packaged app
platform_app (platform_app) = Platform app
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ExtensionAllowedTypes
- GP name: Configure allowed extension types
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Extensions
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\ExtensionAllowedTypes
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\ExtensionAllowedTypes\1 = "hosted_app"
Mac information and settings
- Preference Key Name: ExtensionAllowedTypes
- Example value:
<array>
<string>hosted_app</string>
</array>
ExtensionDeveloperModeSettings
Control the availability of developer mode on extensions page
Supported versions:
- On Windows and macOS since 128 or later
Description
Control if users can turn on Developer Mode on edge://extensions.
If the policy isn't set, users can turn on developer mode on the extension page unless DeveloperToolsAvailability policy is set to DeveloperToolsDisallowed (2). If the policy is set to Allow (0), users can turn on developer mode on the extensions page. If the policy is set to Disallow (1), users cannot turn on developer mode on the extensions page.
If this policy is set, DeveloperToolsAvailability can no longer control extensions developer mode.
Policy options mapping:
Allow (0) = Allow the usage of developer mode on extensions page
Disallow (1) = Do not allow the usage of developer mode on extensions page
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ExtensionDeveloperModeSettings
- GP name: Control the availability of developer mode on extensions page
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Extensions
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: ExtensionDeveloperModeSettings
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: ExtensionDeveloperModeSettings
- Example value:
<integer>1</integer>
ExtensionExtendedBackgroundLifetimeForPortConnectionsToUrls
Configure a list of origins that grant an extended background lifetime to connecting extensions.
Supported versions:
- On Windows and macOS since 128 or later
Description
Extensions that connect to one of these origins will keep running as long as the port is connected. If unset, the policy's default values are used. These are the app origins that offer SDKs that are known to not offer the possibility to restart a closed connection to a previous state:
- Smart Card Connector
- Citrix Receiver (stable, beta, back-up)
- VMware Horizon (stable, beta)
If set, the default value list is extended with the newly configured values. The defaults and policy-provided entries will grant the exception to the connecting extensions, as long as the port is connected.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ExtensionExtendedBackgroundLifetimeForPortConnectionsToUrls
- GP name: Configure a list of origins that grant an extended background lifetime to connecting extensions.
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Extensions
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\ExtensionExtendedBackgroundLifetimeForPortConnectionsToUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\ExtensionExtendedBackgroundLifetimeForPortConnectionsToUrls\1 = "chrome-extension://abcdefghijklmnopabcdefghijklmnop/"
SOFTWARE\Policies\Microsoft\Edge\ExtensionExtendedBackgroundLifetimeForPortConnectionsToUrls\2 = "chrome-extension://bcdefghijklmnopabcdefghijklmnopa/"
Mac information and settings
- Preference Key Name: ExtensionExtendedBackgroundLifetimeForPortConnectionsToUrls
- Example value:
<array>
<string>chrome-extension://abcdefghijklmnopabcdefghijklmnop/</string>
<string>chrome-extension://bcdefghijklmnopabcdefghijklmnopa/</string>
</array>
ExtensionInstallAllowlist
Allow specific extensions to be installed
Supported versions:
- On Windows and macOS since 77 or later
Description
Setting this policy specifies which extensions are not subject to the blocklist.
A blocklist value of * means all extensions are blocked and users can only install extensions listed in the allow list.
By default, all extensions are allowed. However, if you prohibited extensions by policy, you can use the list of allowed extensions to change that policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ExtensionInstallAllowlist
- GP name: Allow specific extensions to be installed
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Extensions
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallAllowlist
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallAllowlist\1 = "extension_id1"
SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallAllowlist\2 = "extension_id2"
Mac information and settings
- Preference Key Name: ExtensionInstallAllowlist
- Example value:
<array>
<string>extension_id1</string>
<string>extension_id2</string>
</array>
ExtensionInstallBlocklist
Control which extensions cannot be installed
Supported versions:
- On Windows and macOS since 77 or later
Description
Lets you specify which extensions the users CANNOT install. Extensions already installed will be disabled if blocked, without a way for the user to enable them. After a disabled extension is removed from the blocklist it will automatically get re-enabled.
A blocklist value of '*' means all extensions are blocked unless they are explicitly listed in the allowlist.
If this policy isn't set, the user can install any extension in Microsoft Edge.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ExtensionInstallBlocklist
- GP name: Control which extensions cannot be installed
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Extensions
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallBlocklist
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallBlocklist\1 = "extension_id1"
SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallBlocklist\2 = "extension_id2"
Mac information and settings
- Preference Key Name: ExtensionInstallBlocklist
- Example value:
<array>
<string>extension_id1</string>
<string>extension_id2</string>
</array>
ExtensionInstallForcelist
Control which extensions are installed silently
Supported versions:
- On Windows and macOS since 77 or later
Description
Set this policy to specify a list of apps and extensions that install silently, without user interaction. Users can't uninstall or turn off this setting. Permissions are granted implicitly, including the enterprise.deviceAttributes and enterprise.platformKeys extension APIs. Note: These 2 APIs aren't available to apps and extensions that aren't force-installed.
If you don't set this policy, no apps or extensions are autoinstalled and users can uninstall any app in Microsoft Edge.
This policy supercedes ExtensionInstallBlocklist policy. If a previously force-installed app or extension is removed from this list, Microsoft Edge automatically uninstalls it.
For Windows instances not joined to a Microsoft Active Directory domain, forced installation is limited to apps and extensions listed in the Microsoft Edge Add-ons website.
On macOS instances, apps and extensions from outside the Microsoft Edge Add-ons website can only be force installed if the instance is managed via MDM, or joined to a domain via MCX.
The source code of any extension can be altered by users with developer tools, potentially rendering the extension unfunctional. If this is a concern, configure the DeveloperToolsAvailability policy.
Each list item of the policy is a string that contains an extension ID and, optionally, an "update" URL separated by a semicolon (;). The extension ID is the 32-letter string found, for example, on edge://extensions when in Developer mode. If specified, the "update" URL should point to an Update Manifest XML document ( https://go.microsoft.com/fwlink/?linkid=2095043 ). By default, the Microsoft Edge Add-ons website's update URL is used. The "update" URL set in this policy is only used for the initial installation; subsequent updates of the extension use the update URL in the extension's manifest.
Note: This policy doesn't apply to InPrivate mode. Read about hosting extensions at Publish and update extensions in the Microsoft Edge Add-ons website.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ExtensionInstallForcelist
- GP name: Control which extensions are installed silently
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Extensions
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist\1 = "gbchcmhmhahfdphkhkmpfmihenigjmpp;https://edge.microsoft.com/extensionwebstorebase/v1/crx"
SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist\2 = "abcdefghijklmnopabcdefghijklmnop"
Mac information and settings
- Preference Key Name: ExtensionInstallForcelist
- Example value:
<array>
<string>gbchcmhmhahfdphkhkmpfmihenigjmpp;https://edge.microsoft.com/extensionwebstorebase/v1/crx</string>
<string>abcdefghijklmnopabcdefghijklmnop</string>
</array>
ExtensionInstallSources
Configure extension and user script install sources
Supported versions:
- On Windows and macOS since 77 or later
Description
Define URLs that can install extensions and themes.
Define URLs that can install extensions and themes directly without having to drag and drop the packages to the edge://extensions page.
Each item in this list is an extension-style match pattern (see https://go.microsoft.com/fwlink/?linkid=2095039). Users can easily install items from any URL that matches an item in this list. Both the location of the *.crx file and the page where the download is started from (in other words, the referrer) must be allowed by these patterns. Do not host the files at a location that requires authentication.
The ExtensionInstallBlocklist policy takes precedence over this policy. Any extensions that's on the block list won't be installed, even if it comes from a site on this list.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ExtensionInstallSources
- GP name: Configure extension and user script install sources
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Extensions
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallSources
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallSources\1 = "https://corp.contoso.com/*"
Mac information and settings
- Preference Key Name: ExtensionInstallSources
- Example value:
<array>
<string>https://corp.contoso.com/*</string>
</array>
ExtensionInstallTypeBlocklist
Blocklist for extension install types
Supported versions:
- On Windows and macOS since 123 or later
Description
The blocklist controls which extension install types are disallowed.
Setting the "command_line" will block an extension from being loaded from command line.
Policy options mapping:
- command_line (command_line) = Blocks extensions from being loaded from command line
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ExtensionInstallTypeBlocklist
- GP name: Blocklist for extension install types
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Extensions
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallTypeBlocklist
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallTypeBlocklist\1 = "command_line"
Mac information and settings
- Preference Key Name: ExtensionInstallTypeBlocklist
- Example value:
<array>
<string>command_line</string>
</array>
ExtensionManifestV2Availability
Control Manifest v2 extension availability
Supported versions:
- On Windows and macOS since 123 or later
Description
Control if Manifest v2 extensions can be used by browser.
Manifest v2 extensions support will be deprecated and all extensions need to be migrated to v3 in the future. More information about, and the timeline of the migration has not been established.
If the policy is set to Default or not set, v2 extension loading is decided by browser. This will follow the preceding timeline when it's established.
If the policy is set to Disable, v2 extensions installation are blocked, and existing ones are disabled. This option is going to be treated the same as if the policy is unset after v2 support is turned off by default.
If the policy is set to Enable, v2 extensions are allowed. The option is going to be treated the same as if the policy isn't set before v2 support is turned off by default.
If the policy is set to EnableForForcedExtensions, force installed v2 extensions are allowed. This includes extensions that are listed by ExtensionInstallForcelist or ExtensionSettings with installation_mode "force_installed" or "normal_installed". All other v2 extensions are disabled. The option is always available regardless of the manifest migration state.
Extensions availabilities are still controlled by other policies.
Policy options mapping:
Default (0) = Default browser behavior
Disable (1) = Manifest v2 is disabled
Enable (2) = Manifest v2 is enabled
EnableForForcedExtensions (3) = Manifest v2 is enabled for forced extensions only
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ExtensionManifestV2Availability
- GP name: Control Manifest v2 extension availability
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Extensions
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: ExtensionManifestV2Availability
- Value Type: REG_DWORD
Example value:
0x00000002
Mac information and settings
- Preference Key Name: ExtensionManifestV2Availability
- Example value:
<integer>2</integer>
ExtensionSettings
Configure extension management settings
Supported versions:
- On Windows and macOS since 77 or later
Description
Setting this policy controls extension management settings for Microsoft Edge, including any controlled by existing extension-related policies. This policy supersedes any legacy policies that might be set.
This policy maps an extension ID or an update URL to its specific setting only. A default configuration can be set for the special ID "*", which applies to all extensions without a custom configuration in this policy. With an update URL, configuration applies to extensions with the exact update URL stated in the extension manifest. If the 'override_update_url' flag is set to true, the extension is installed and updated using the update URL specified in the ExtensionInstallForcelist policy or in 'update_url' field in this policy. The flag 'override_update_url' is ignored if the 'update_url' is the Edge Add-ons website update URL. For more details, check out the detailed guide to ExtensionSettings policy available at https://go.microsoft.com/fwlink/?linkid=2161555.
To block extensions from a particular third party store, you only need to block the update_url for that store. For example, if you want to block extensions from Chrome Web Store, you can use the following JSON.
{"update_url:https://clients2.google.com/service/update2/crx":{"installation_mode":"blocked"}}
Note that you can still use ExtensionInstallForcelist and ExtensionInstallAllowlist to allow / force install specific extensions even if the store is blocked using the JSON in the previous example.
If the 'sidebar_auto_open_blocked' flag is set to true in an extension's configuration, the hub-app (sidebar app) corresponding to the specified extension will be prevented from automatically opening.
On Windows instances, apps and extensions from outside the Microsoft Edge Add-ons website can only be forced installed if the instance is joined to a Microsoft Active Directory domain or joined to Microsoft Azure Active Directory®`.
On macOS instances, apps and extensions from outside the Microsoft Edge Add-ons website can only be force installed if the instance is managed via MDM, joined to a domain via MCX.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Dictionary
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ExtensionSettings
- GP name: Configure extension management settings
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Extensions
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: ExtensionSettings
- Value Type: REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\ExtensionSettings = {
"*": {
"allowed_types": [
"hosted_app"
],
"blocked_install_message": "Custom error message.",
"blocked_permissions": [
"downloads",
"bookmarks"
],
"install_sources": [
"https://company-intranet/apps"
],
"installation_mode": "blocked",
"runtime_allowed_hosts": [
"*://good.contoso.com"
],
"runtime_blocked_hosts": [
"*://*.contoso.com"
]
},
"abcdefghijklmnopabcdefghijklmnop": {
"blocked_permissions": [
"history"
],
"file_url_navigation_allowed": true,
"installation_mode": "allowed",
"minimum_version_required": "1.0.1"
},
"bcdefghijklmnopabcdefghijklmnopa": {
"allowed_permissions": [
"downloads"
],
"installation_mode": "force_installed",
"override_update_url": true,
"runtime_allowed_hosts": [
"*://good.contoso.com"
],
"runtime_blocked_hosts": [
"*://*.contoso.com"
],
"sidebar_auto_open_blocked": true,
"toolbar_state": "force_shown",
"update_url": "https://contoso.com/update_url"
},
"cdefghijklmnopabcdefghijklmnopab": {
"blocked_install_message": "Custom error message.",
"installation_mode": "blocked"
},
"defghijklmnopabcdefghijklmnopabc,efghijklmnopabcdefghijklmnopabcd": {
"blocked_install_message": "Custom error message.",
"installation_mode": "blocked"
},
"fghijklmnopabcdefghijklmnopabcde": {
"blocked_install_message": "Custom removal message.",
"installation_mode": "removed"
},
"update_url:https://www.contoso.com/update.xml": {
"allowed_permissions": [
"downloads"
],
"blocked_permissions": [
"wallpaper"
],
"installation_mode": "allowed"
}
}
Compact example value:
SOFTWARE\Policies\Microsoft\Edge\ExtensionSettings = {"*": {"allowed_types": ["hosted_app"], "blocked_install_message": "Custom error message.", "blocked_permissions": ["downloads", "bookmarks"], "install_sources": ["https://company-intranet/apps"], "installation_mode": "blocked", "runtime_allowed_hosts": ["*://good.contoso.com"], "runtime_blocked_hosts": ["*://*.contoso.com"]}, "abcdefghijklmnopabcdefghijklmnop": {"blocked_permissions": ["history"], "file_url_navigation_allowed": true, "installation_mode": "allowed", "minimum_version_required": "1.0.1"}, "bcdefghijklmnopabcdefghijklmnopa": {"allowed_permissions": ["downloads"], "installation_mode": "force_installed", "override_update_url": true, "runtime_allowed_hosts": ["*://good.contoso.com"], "runtime_blocked_hosts": ["*://*.contoso.com"], "sidebar_auto_open_blocked": true, "toolbar_state": "force_shown", "update_url": "https://contoso.com/update_url"}, "cdefghijklmnopabcdefghijklmnopab": {"blocked_install_message": "Custom error message.", "installation_mode": "blocked"}, "defghijklmnopabcdefghijklmnopabc,efghijklmnopabcdefghijklmnopabcd": {"blocked_install_message": "Custom error message.", "installation_mode": "blocked"}, "fghijklmnopabcdefghijklmnopabcde": {"blocked_install_message": "Custom removal message.", "installation_mode": "removed"}, "update_url:https://www.contoso.com/update.xml": {"allowed_permissions": ["downloads"], "blocked_permissions": ["wallpaper"], "installation_mode": "allowed"}}
Mac information and settings
- Preference Key Name: ExtensionSettings
- Example value:
<key>ExtensionSettings</key>
<dict>
<key>*</key>
<dict>
<key>allowed_types</key>
<array>
<string>hosted_app</string>
</array>
<key>blocked_install_message</key>
<string>Custom error message.</string>
<key>blocked_permissions</key>
<array>
<string>downloads</string>
<string>bookmarks</string>
</array>
<key>install_sources</key>
<array>
<string>https://company-intranet/apps</string>
</array>
<key>installation_mode</key>
<string>blocked</string>
<key>runtime_allowed_hosts</key>
<array>
<string>*://good.contoso.com</string>
</array>
<key>runtime_blocked_hosts</key>
<array>
<string>*://*.contoso.com</string>
</array>
</dict>
<key>abcdefghijklmnopabcdefghijklmnop</key>
<dict>
<key>blocked_permissions</key>
<array>
<string>history</string>
</array>
<key>file_url_navigation_allowed</key>
<true/>
<key>installation_mode</key>
<string>allowed</string>
<key>minimum_version_required</key>
<string>1.0.1</string>
</dict>
<key>bcdefghijklmnopabcdefghijklmnopa</key>
<dict>
<key>allowed_permissions</key>
<array>
<string>downloads</string>
</array>
<key>installation_mode</key>
<string>force_installed</string>
<key>override_update_url</key>
<true/>
<key>runtime_allowed_hosts</key>
<array>
<string>*://good.contoso.com</string>
</array>
<key>runtime_blocked_hosts</key>
<array>
<string>*://*.contoso.com</string>
</array>
<key>sidebar_auto_open_blocked</key>
<true/>
<key>toolbar_state</key>
<string>force_shown</string>
<key>update_url</key>
<string>https://contoso.com/update_url</string>
</dict>
<key>cdefghijklmnopabcdefghijklmnopab</key>
<dict>
<key>blocked_install_message</key>
<string>Custom error message.</string>
<key>installation_mode</key>
<string>blocked</string>
</dict>
<key>defghijklmnopabcdefghijklmnopabc,efghijklmnopabcdefghijklmnopabcd</key>
<dict>
<key>blocked_install_message</key>
<string>Custom error message.</string>
<key>installation_mode</key>
<string>blocked</string>
</dict>
<key>fghijklmnopabcdefghijklmnopabcde</key>
<dict>
<key>blocked_install_message</key>
<string>Custom removal message.</string>
<key>installation_mode</key>
<string>removed</string>
</dict>
<key>update_url:https://www.contoso.com/update.xml</key>
<dict>
<key>allowed_permissions</key>
<array>
<string>downloads</string>
</array>
<key>blocked_permissions</key>
<array>
<string>wallpaper</string>
</array>
<key>installation_mode</key>
<string>allowed</string>
</dict>
</dict>
Games settings policies
GamerModeEnabled
Enable Gamer Mode
Supported versions:
- On Windows since 117 or later
Description
Microsoft Edge Gamer Mode allows gamers to personalize their browser with gaming themes and gives them the option of enabling Efficiency Mode for PC gaming, the Gaming feed on new tabs, sidebar apps for gamers, and more.
If you enable or don't configure this policy, users can opt into Gamer Mode. If you disable this policy, Gamer Mode will be disabled.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: GamerModeEnabled
- GP name: Enable Gamer Mode
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Games settings
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Games settings
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: GamerModeEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Generative AI policies
GenAILocalFoundationalModelSettings
Settings for GenAI local foundational model
Supported versions:
- On Windows and macOS since 132 or later
Description
Configure how Microsoft Edge downloads the foundational GenAI model and uses it for inference locally.
When the policy is set to Allowed (0) or not set, the model is downloaded automatically, and used for inference.
When the policy is set to Disabled (1), the model will not be downloaded.
Model downloading can also be disabled by ComponentUpdatesEnabled.
Policy options mapping:
Allowed (0) = Downloads model automatically
Disabled (1) = Do not download model
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: GenAILocalFoundationalModelSettings
- GP name: Settings for GenAI local foundational model
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Generative AI
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: GenAILocalFoundationalModelSettings
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: GenAILocalFoundationalModelSettings
- Example value:
<integer>1</integer>
HTTP authentication policies
AllHttpAuthSchemesAllowedForOrigins
List of origins that allow all HTTP authentication
Supported versions:
- On Windows and macOS since 102 or later
Description
Set this policy to specify which origins allow all the HTTP authentication schemes Microsoft Edge supports regardless of the AuthSchemes policy.
Format the origin pattern according to this format (https://support.google.com/chrome/a?p=url_blocklist_filter_format). Up to 1,000 exceptions can be defined in AllHttpAuthSchemesAllowedForOrigins. Wildcards are allowed for the whole origin or parts of the origin. Parts include the scheme, host, or port.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AllHttpAuthSchemesAllowedForOrigins
- GP name: List of origins that allow all HTTP authentication
- GP path (Mandatory): Administrative Templates/Microsoft Edge/HTTP authentication
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\AllHttpAuthSchemesAllowedForOrigins
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\AllHttpAuthSchemesAllowedForOrigins\1 = "*.example.com"
Mac information and settings
- Preference Key Name: AllHttpAuthSchemesAllowedForOrigins
- Example value:
<array>
<string>*.example.com</string>
</array>
AllowCrossOriginAuthPrompt
Allow cross-origin HTTP Authentication prompts
Supported versions:
- On Windows and macOS since 77 or later
Description
Controls whether third-party images on a page can show an authentication prompt.
Typically, this is disabled as a phishing defense. If you don't configure this policy, it's disabled and third-party images can't show an authentication prompt.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AllowCrossOriginAuthPrompt
- GP name: Allow cross-origin HTTP Authentication prompts
- GP path (Mandatory): Administrative Templates/Microsoft Edge/HTTP authentication
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: AllowCrossOriginAuthPrompt
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: AllowCrossOriginAuthPrompt
- Example value:
<false/>
AuthNegotiateDelegateAllowlist
Specifies a list of servers that Microsoft Edge can delegate user credentials to
Supported versions:
- On Windows and macOS since 77 or later
Description
Configure the list of servers that Microsoft Edge can delegate to.
Separate multiple server names with commas. Wildcards (*) are allowed.
If you don't configure this policy Microsoft Edge won't delegate user credentials even if a server is detected as Intranet.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- String
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AuthNegotiateDelegateAllowlist
- GP name: Specifies a list of servers that Microsoft Edge can delegate user credentials to
- GP path (Mandatory): Administrative Templates/Microsoft Edge/HTTP authentication
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: AuthNegotiateDelegateAllowlist
- Value Type: REG_SZ
Example value:
"contoso.com"
Mac information and settings
- Preference Key Name: AuthNegotiateDelegateAllowlist
- Example value:
<string>contoso.com</string>
AuthSchemes
Supported authentication schemes
Supported versions:
- On Windows and macOS since 77 or later
Description
Specifies which HTTP authentication schemes are supported.
You can configure the policy by using these values: 'basic', 'digest', 'ntlm', and 'negotiate'. Separate multiple values with commas.
Note: All values for this policy are case sensitive.
If you don't configure this policy, all four schemes are used.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- String
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AuthSchemes
- GP name: Supported authentication schemes
- GP path (Mandatory): Administrative Templates/Microsoft Edge/HTTP authentication
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: AuthSchemes
- Value Type: REG_SZ
Example value:
"basic,digest,ntlm,negotiate"
Mac information and settings
- Preference Key Name: AuthSchemes
- Example value:
<string>basic,digest,ntlm,negotiate</string>
AuthServerAllowlist
Configure list of allowed authentication servers
Supported versions:
- On Windows and macOS since 77 or later
Description
Specifies which servers to enable for integrated authentication. Integrated authentication is only enabled when Microsoft Edge receives an authentication challenge from a proxy or from a server in this list.
Separate multiple server names with commas. Wildcards (*) are allowed.
If you don't configure this policy, Microsoft Edge tries to detect if a server is on the intranet - only then will it respond to IWA requests. If the server is on the internet, IWA requests from it are ignored by Microsoft Edge.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- String
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AuthServerAllowlist
- GP name: Configure list of allowed authentication servers
- GP path (Mandatory): Administrative Templates/Microsoft Edge/HTTP authentication
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: AuthServerAllowlist
- Value Type: REG_SZ
Example value:
"*contoso.com,contoso.com"
Mac information and settings
- Preference Key Name: AuthServerAllowlist
- Example value:
<string>*contoso.com,contoso.com</string>
BasicAuthOverHttpEnabled
Allow Basic authentication for HTTP
Supported versions:
- On Windows and macOS since 88 or later
Description
If you enable this policy or leave it unset, Basic authentication challenges received over non-secure HTTP will be allowed.
If you disable this policy, non-secure HTTP requests from the Basic authentication scheme are blocked, and only secure HTTPS is allowed.
This policy setting is ignored (and Basic is always forbidden) if the AuthSchemes policy is set and does not include Basic.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: BasicAuthOverHttpEnabled
- GP name: Allow Basic authentication for HTTP
- GP path (Mandatory): Administrative Templates/Microsoft Edge/HTTP authentication
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: BasicAuthOverHttpEnabled
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: BasicAuthOverHttpEnabled
- Example value:
<false/>
DisableAuthNegotiateCnameLookup
Disable CNAME lookup when negotiating Kerberos authentication
Supported versions:
- On Windows and macOS since 77 or later
Description
Determines whether the generated Kerberos SPN is based on the canonical DNS name (CNAME) or on the original name entered.
If you enable this policy, CNAME lookup is skipped and the server name (as entered) is used.
If you disable this policy or don't configure it, the canonical name of the server is used. This is determined through CNAME lookup.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: DisableAuthNegotiateCnameLookup
- GP name: Disable CNAME lookup when negotiating Kerberos authentication
- GP path (Mandatory): Administrative Templates/Microsoft Edge/HTTP authentication
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: DisableAuthNegotiateCnameLookup
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: DisableAuthNegotiateCnameLookup
- Example value:
<false/>
EnableAuthNegotiatePort
Include non-standard port in Kerberos SPN
Supported versions:
- On Windows and macOS since 77 or later
Description
Specifies whether the generated Kerberos SPN should include a non-standard port.
If you enable this policy, and a user includes a non-standard port (a port other than 80 or 443) in a URL, that port is included in the generated Kerberos SPN.
If you don't configure or disable this policy, the generated Kerberos SPN won't include a port in any case.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: EnableAuthNegotiatePort
- GP name: Include non-standard port in Kerberos SPN
- GP path (Mandatory): Administrative Templates/Microsoft Edge/HTTP authentication
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: EnableAuthNegotiatePort
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: EnableAuthNegotiatePort
- Example value:
<false/>
NtlmV2Enabled
Control whether NTLMv2 authentication is enabled
Supported versions:
- On macOS since 77 or later
Description
Controls whether NTLMv2 is enabled.
All recent versions of Samba and Windows servers support NTLMv2. You should only disable NTLMv2 to address issues with backwards compatibility as it reduces the security of authentication.
If you don't configure this policy, NTLMv2 is enabled by default.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Mac information and settings
- Preference Key Name: NtlmV2Enabled
- Example value:
<true/>
WindowsHelloForHTTPAuthEnabled
Windows Hello For HTTP Auth Enabled
Supported versions:
- On Windows since 90 or later
Description
Indicates if Windows Credential UI should be used to respond to NTLM and Negotiate authentication challenges.
If you disable this policy, a basic username and password prompt will be used to respond to NTLM and Negotiate challenges. If you enable or don't configure this policy, Windows Credential UI will be used.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: WindowsHelloForHTTPAuthEnabled
- GP name: Windows Hello For HTTP Auth Enabled
- GP path (Mandatory): Administrative Templates/Microsoft Edge/HTTP authentication
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/HTTP authentication
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: WindowsHelloForHTTPAuthEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Identity and sign-in policies
AutomaticProfileSwitchingSiteList
Configure the automatic profile switching site list
Supported versions:
- On Windows and macOS since 120 or later
Description
Set this policy to control which profiles Microsoft Edge will use to open sites in. Switching configurations for sites listed in this policy take precedence over other heuristics Microsoft Edge uses for switching sites but note that sites not listed on this policy are still subject to switching by those heuristics. If this policy is not configured, Microsoft Edge will continue using its heuristics to automatically switch sites.
This policy maps a URL hostname to a profile that it should be opened in.
The 'site' field should take the form of a URL hostname.
The 'profile' field can take one of the following values:
'Work': The most recently used Microsoft Entra signed-in profile will be used to open 'site'.
'Personal': The most recently used MSA signed-in profile will be used to open 'site'.
'No preference': The currently used profile will be used to open 'site'.
Wildcard email address: This takes the form of '*@contoso.com'. A profile whose username ends with the contents following the '*' will be used to open 'site'.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Dictionary
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AutomaticProfileSwitchingSiteList
- GP name: Configure the automatic profile switching site list
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Identity and sign-in
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Identity and sign-in
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: AutomaticProfileSwitchingSiteList
- Value Type: REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\AutomaticProfileSwitchingSiteList = [
{
"profile": "Work",
"site": "work.com"
},
{
"profile": "Personal",
"site": "personal.com"
},
{
"profile": "No preference",
"site": "nopreference.com"
},
{
"profile": "*@contoso.com",
"site": "contoso.com"
}
]
Compact example value:
SOFTWARE\Policies\Microsoft\Edge\AutomaticProfileSwitchingSiteList = [{"profile": "Work", "site": "work.com"}, {"profile": "Personal", "site": "personal.com"}, {"profile": "No preference", "site": "nopreference.com"}, {"profile": "*@contoso.com", "site": "contoso.com"}]
Mac information and settings
- Preference Key Name: AutomaticProfileSwitchingSiteList
- Example value:
<key>AutomaticProfileSwitchingSiteList</key>
<array>
<dict>
<key>profile</key>
<string>Work</string>
<key>site</key>
<string>work.com</string>
</dict>
<dict>
<key>profile</key>
<string>Personal</string>
<key>site</key>
<string>personal.com</string>
</dict>
<dict>
<key>profile</key>
<string>No preference</string>
<key>site</key>
<string>nopreference.com</string>
</dict>
<dict>
<key>profile</key>
<string>*@contoso.com</string>
<key>site</key>
<string>contoso.com</string>
</dict>
</array>
EdgeDefaultProfileEnabled
Default Profile Setting Enabled
Supported versions:
- On Windows since 101 or later
Description
Configuring this policy will let you set a default profile in Microsoft Edge to be used when opening the browser rather than the last profile used. This policy won't affect when "--profile-directory" parameter has been specified. Set the value to "Default" to refer to the default profile. The value is case sensitive. The value of the policy is the name of the profile (case sensitive) and can be configured with string that is the name of a specific profile. The value "Edge Kids Mode" and "Guest Profile" are considered not useful values because they not supposed to be a default profile. This policy won't impact the following scenarios:
- Settings specified in "Profile preferences for sites" in "Profile preferences"
- Links opening from Outlook and Teams.
The following statements are under the condition of not specify the "--profile-directory" and configured value is not "Edge Kids Mode" or "Guest Profile": If you enable this policy and configure it with a specific profile name and the specified profile can be found, Microsoft Edge will use the specified profile when launching and the setting of "Default profile for external link" is changed to the specified profile name and greyed out. If you enable this policy and configure it with a specific profile name but it can't be found, the policy will behave like it's never been set before. If you enable this policy, but don't configure or disable it, the policy will behave like it's never been set before.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- String
Windows information and settings
Group Policy (ADMX) info
- GP unique name: EdgeDefaultProfileEnabled
- GP name: Default Profile Setting Enabled
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Identity and sign-in
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: EdgeDefaultProfileEnabled
- Value Type: REG_SZ
Example value:
"Default"
GuidedSwitchEnabled
Guided Switch Enabled
Supported versions:
- On Windows and macOS since 103 or later
Description
Allows Microsoft Edge to prompt the user to switch to the appropriate profile when Microsoft Edge detects that a link is a personal or work link.
If you enable this policy, you'll be prompted to switch to another account if the current profile doesn't work for the requesting link.
If you disable this policy, you won't be prompted to switch to another account when there's a profile and link mismatch.
If this policy isn't configured, guided switch is turned on by default. A user can override this value in the browser settings.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: GuidedSwitchEnabled
- GP name: Guided Switch Enabled
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Identity and sign-in
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: GuidedSwitchEnabled
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: GuidedSwitchEnabled
- Example value:
<false/>
ImplicitSignInEnabled
Enable implicit sign-in
Supported versions:
- On Windows since 93 or later
Description
Configure this policy to allow/disallow implicit sign-in.
If you have configured the BrowserSignin policy to 'Disable browser sign-in', this policy will not take any effect.
If you enable or don't configure this setting, implicit sign-in will be enabled, Edge will attempt to sign the user into their profile based on what and how they sign in to their OS.
If you disable this setting, implicit sign-in will be disabled.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ImplicitSignInEnabled
- GP name: Enable implicit sign-in
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Identity and sign-in
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: ImplicitSignInEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
LinkedAccountEnabled
Enable the linked account feature
Supported versions:
- On Windows and macOS since 107 or later
Description
Microsoft Edge guides a user to the account management page where they can link a Microsoft Account (MSA) to an Azure Active Directory (Azure AD) account.
If you enable or don't configure this policy, linked account information will be shown on a flyout. When the Azure AD profile doesn't have a linked account it will show "Add account".
If you disable this policy, linked accounts will be turned off and no extra information will be shown.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: LinkedAccountEnabled
- GP name: Enable the linked account feature
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Identity and sign-in
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: LinkedAccountEnabled
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: LinkedAccountEnabled
- Example value:
<false/>
OneAuthAuthenticationEnforced
OneAuth Authentication Flow Enforced for signin
Supported versions:
- On Windows since 93 or later
Description
This policy allows users to decide whether to use the OneAuth library for sign-in and token fetch in Microsoft Edge on Windows 10 RS3 and above.
If you disable or don't configure this policy, signin process will use Windows Account Manager. Microsoft Edge would be able to use accounts you logged in to Windows, Microsoft Office, or other Microsoft applications for login, without the needing of password. Or you can provide valid account and password to sign in, which will be stored in Windows Account Manager for future usage. You will be able to investigate all accounts stored in Windows Account Manager through Windows Settings -> Accounts -> Email and accounts page.
If you enable this policy, OneAuth authentication flow will be used for account signin. The OneAuth authentication flow has fewer dependencies and can work without Windows shell. The account you use would not be stored in the Email and accounts page.
This policy will only take effect on Windows 10 RS3 and above. On Windows 10 below RS3, OneAuth is used for authentication in Microsoft Edge by default.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: OneAuthAuthenticationEnforced
- GP name: OneAuth Authentication Flow Enforced for signin
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Identity and sign-in
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: OneAuthAuthenticationEnforced
- Value Type: REG_DWORD
Example value:
0x00000000
OnlyOnPremisesImplicitSigninEnabled
Only on-premises account enabled for implicit sign-in
Supported versions:
- On Windows since 94 or later
Description
Configure this policy to decide whether only on-premises accounts are enabled for implicit sign-in.
If you enable this policy, only on-premises accounts will be enabled for implicit sign-in. Microsoft Edge won't attempt to implicitly sign in to MSA or AAD accounts. Upgrade from on-premises accounts to AAD accounts will be stopped as well.
If you disable or don't configure this policy, all accounts will be enabled for implicit sign-in.
This policy will only take effect when policy ConfigureOnPremisesAccountAutoSignIn is enabled and set to 'SignInAndMakeDomainAccountNonRemovable'.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: OnlyOnPremisesImplicitSigninEnabled
- GP name: Only on-premises account enabled for implicit sign-in
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Identity and sign-in
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: OnlyOnPremisesImplicitSigninEnabled
- Value Type: REG_DWORD
Example value:
0x00000000
ProactiveAuthWorkflowEnabled
Enable proactive authentication
Supported versions:
- On Windows and macOS since 126 or later
Description
This policy controls the proactive authentication in Microsoft Edge, that connects the signed-in user identity with Microsoft Bing, MSN and Copilot services for a smooth and consistent sign-in experience.
If you enable or don't configure this policy, Microsoft Edge authentication requests are automatically sent to the services using the account that is signed-in to the browser.
If you disable this policy, Microsoft Edge does not send authentications requests to these services and users will need to manually sign-in.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ProactiveAuthWorkflowEnabled
- GP name: Enable proactive authentication
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Identity and sign-in
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: ProactiveAuthWorkflowEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: ProactiveAuthWorkflowEnabled
- Example value:
<true/>
SignInCtaOnNtpEnabled
Enable sign in click to action dialog (obsolete)
OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 130.
Supported versions:
- On Windows and macOS since 99, until 130
Description
Configure this policy to show sign in click to action dialog on New tab page.
If you enable or don't configure this policy, sign in click to action dialog is shown on New tab page.
If you disable this policy, sign in click to action dialog isn't shown on the New tab page.
This policy is obsoleted as the feature has not been enabled in Microsoft Edge, and this policy will not be supported for Microsoft Edge in the future.
Supported features:
- Can be mandatory: No
- Can be recommended: Yes
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: SignInCtaOnNtpEnabled
- GP name: Enable sign in click to action dialog (obsolete)
- GP path (Mandatory): N/A
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Identity and sign-in
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): N/A
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: SignInCtaOnNtpEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: SignInCtaOnNtpEnabled
- Example value:
<true/>
SwitchIntranetSitesToWorkProfile
Switch intranet sites to a work profile
Supported versions:
- On Windows and macOS since 119 or later
Description
Allows Microsoft Edge to switch to the appropriate profile when Microsoft Edge detects that a URL is the intranet.
If you enable or don't configure this policy, navigations to intranet URLs will switch to the most recently used work profile if one exists.
If you disable this policy, navigations to intranet URLs will remain in the current browser profile.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: SwitchIntranetSitesToWorkProfile
- GP name: Switch intranet sites to a work profile
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Identity and sign-in
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: SwitchIntranetSitesToWorkProfile
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: SwitchIntranetSitesToWorkProfile
- Example value:
<false/>
SwitchSitesOnIEModeSiteListToWorkProfile
Switch sites on the IE mode site list to a work profile
Supported versions:
- On Windows since 119 or later
Description
Allows Microsoft Edge to switch to the appropriate profile when navigating to a site that matches an entry on the IE mode site list. Only sites that specify IE mode or Edge mode will be switched to the work profile.
If you enable or don't configure this policy, navigations to URLs matching a site on the IE mode site list will switch to the most recently used work profile if one exists.
If you disable this policy, navigations to URLs matching a site on the IE mode site list will remain in the current browser profile.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: SwitchSitesOnIEModeSiteListToWorkProfile
- GP name: Switch sites on the IE mode site list to a work profile
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Identity and sign-in
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: SwitchSitesOnIEModeSiteListToWorkProfile
- Value Type: REG_DWORD
Example value:
0x00000000
WAMAuthBelowWin10RS3Enabled
WAM for authentication below Windows 10 RS3 enabled
Supported versions:
- On Windows since 93 or later
Description
Configure this policy to decide whether WAM is used for authentication in Microsoft Edge on Windows 10 RS1 and RS2.
If you enable this setting, WAM will be used in the authentication flow on Windows 10 RS1 and RS2.
If you disable or don't configure this setting, OneAuth libraries will be used instead of WAM on Windows 10 RS1 and RS2.
Note that if this policy is enabled, then previous sign-in sessions (which used OneAuth by default) cannot be used. Please sign out of those profiles.
This policy will only take effect on Windows 10 RS1 and RS2. On Windows 10 RS3 and above, WAM is used for authentication in Microsoft Edge by default.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: WAMAuthBelowWin10RS3Enabled
- GP name: WAM for authentication below Windows 10 RS3 enabled
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Identity and sign-in
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: WAMAuthBelowWin10RS3Enabled
- Value Type: REG_DWORD
Example value:
0x00000001
Idle Browser Actions policies
Immersive Reader settings policies
ImmersiveReaderGrammarToolsEnabled
Enable Grammar Tools feature within Immersive Reader in Microsoft Edge (obsolete)
OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 125.
Supported versions:
- On Windows and macOS since 110, until 125
Description
This policy is obsoleted because Grammar Tools is deprecated from Edge. This policy won't work in Microsoft Edge version 126. Enables the Grammar Tools feature within Immersive Reader in Microsoft Edge. This helps improve reading comprehension by splitting words into syllables and highlighting nouns, verbs, adverbs, and adjectives.
If you enable this policy or don't configure it, the Grammar Tools option shows up within Immersive Reader. If you disable this policy, users can't access the Grammar Tools feature within Immersive Reader.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ImmersiveReaderGrammarToolsEnabled
- GP name: Enable Grammar Tools feature within Immersive Reader in Microsoft Edge (obsolete)
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Immersive Reader settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: ImmersiveReaderGrammarToolsEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: ImmersiveReaderGrammarToolsEnabled
- Example value:
<true/>
ImmersiveReaderPictureDictionaryEnabled
Enable Picture Dictionary feature within Immersive Reader in Microsoft Edge (obsolete)
OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 126.
Supported versions:
- On Windows and macOS since 110, until 126
Description
This Policy is obsoleted because Picture Dictionary is deprecated from Edge as of Sept, 2023. This policy won't work in Microsoft Edge Version 127. Enables the Picture Dictionary feature within Immersive Reader in Microsoft Edge. This feature helps in reading comprehension by letting a user to click on any single word and see an illustration related to the meaning.
If you enable this policy or don't configure it, the Picture Dictionary option shows up within Immersive Reader. If you disable this policy, users can't access the Picture Dictionary feature within Immersive Reader.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ImmersiveReaderPictureDictionaryEnabled
- GP name: Enable Picture Dictionary feature within Immersive Reader in Microsoft Edge (obsolete)
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Immersive Reader settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: ImmersiveReaderPictureDictionaryEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: ImmersiveReaderPictureDictionaryEnabled
- Example value:
<true/>
Kiosk Mode settings policies
KioskAddressBarEditingEnabled
Configure address bar editing for kiosk mode public browsing experience
Supported versions:
- On Windows since 87 or later
Description
This policy only applies to Microsoft Edge kiosk mode while using the public browsing experience.
If you enable or don't configure this policy, users can change the URL in the address bar.
If you disable this policy, it prevents users from changing the URL in the address bar.
For detailed information on configuring kiosk Mode, see https://go.microsoft.com/fwlink/?linkid=2137578.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: KioskAddressBarEditingEnabled
- GP name: Configure address bar editing for kiosk mode public browsing experience
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Kiosk Mode settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: KioskAddressBarEditingEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
KioskDeleteDownloadsOnExit
Delete files downloaded as part of kiosk session when Microsoft Edge closes
Supported versions:
- On Windows since 87 or later
Description
This policy only applies to Microsoft Edge kiosk mode.
If you enable this policy, files downloaded as part of the kiosk session are deleted each time Microsoft Edge closes.
If you disable this policy or don't configure it, files downloaded as part of the kiosk session are not deleted when Microsoft Edge closes.
For detailed information on configuring kiosk Mode, see https://go.microsoft.com/fwlink/?linkid=2137578.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: KioskDeleteDownloadsOnExit
- GP name: Delete files downloaded as part of kiosk session when Microsoft Edge closes
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Kiosk Mode settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: KioskDeleteDownloadsOnExit
- Value Type: REG_DWORD
Example value:
0x00000001
KioskSwipeGesturesEnabled
Swipe gestures in Microsoft Edge kiosk mode enabled
Supported versions:
- On Windows since 101 or later
Description
This policy only applies to Microsoft Edge kiosk mode.
If you enable this policy or don't configure it, swipe gestures will behave as expected.
If you disable this policy, the user will not be able to use swipe gestures (for example navigate forwards and backwards, refresh page).
For detailed information on configuring kiosk mode, see https://go.microsoft.com/fwlink/?linkid=2137578.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: KioskSwipeGesturesEnabled
- GP name: Swipe gestures in Microsoft Edge kiosk mode enabled
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Kiosk Mode settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: KioskSwipeGesturesEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Manageability policies
EdgeManagementEnabled
Microsoft Edge management enabled
Supported versions:
- On Windows since 115 or later
Description
Microsoft Edge management service in Microsoft 365 Admin Center lets you set policy and manage users through a Microsoft Edge focused cloud-based management experience. This policy lets you control whether Microsoft Edge management is enabled.
If you enable or don't configure this policy, Microsoft Edge will attempt to connect to the Microsoft Edge management service to download and apply policy assigned to the Azure AD account of the user.
If you disable this policy, Microsoft Edge will not attempt to connect to the Microsoft Edge management service.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: EdgeManagementEnabled
- GP name: Microsoft Edge management enabled
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Manageability
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: EdgeManagementEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
EdgeManagementEnrollmentToken
Microsoft Edge management enrollment token
Supported versions:
- On Windows since 115 or later
Description
Microsoft Edge management service in Microsoft 365 Admin Center lets you set policy and manage users through a Microsoft Edge focused cloud-based management experience. This policy lets you specify an enrollment token that's used to register with Microsoft Edge management service and deploy the associated policies. The user must be signed into Microsoft Edge with a valid work or school account otherwise Microsoft Edge will not download the policy.
If you enable this policy, Microsoft Edge will attempt to use the specified enrollment token to register with the Microsoft Edge management service and download the published policy.
If you disable or don't configure this policy, Microsoft Edge will not attempt to connect to the Microsoft Edge management service.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- String
Windows information and settings
Group Policy (ADMX) info
- GP unique name: EdgeManagementEnrollmentToken
- GP name: Microsoft Edge management enrollment token
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Manageability
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: EdgeManagementEnrollmentToken
- Value Type: REG_SZ
Example value:
"RgAAAACBbzoQDmUrRfq3WeKUoFeEBwBOqK2QPYsBT5V3lQFoKND-AAAAAAEVAAAOqK2QPYvBT5V4lQFoKMD-AAADTXvzAAAA0"
EdgeManagementExtensionsFeedbackEnabled
Microsoft Edge management extensions feedback enabled
Supported versions:
- On Windows and macOS since 115 or later
Description
This setting controls whether Microsoft Edge sends data about blocked extensions to the Microsoft Edge management service.
The 'EdgeManagementEnabled' policy must also be enabled for this setting to take effect.
If you enable this policy, Microsoft Edge will send data to the Microsoft Edge service when a user tries to install a blocked extension.
If you disable or don't configure this policy, Microsoft Edge won't send any data to the Microsoft Edge service about blocked extensions.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: EdgeManagementExtensionsFeedbackEnabled
- GP name: Microsoft Edge management extensions feedback enabled
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Manageability
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: EdgeManagementExtensionsFeedbackEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: EdgeManagementExtensionsFeedbackEnabled
- Example value:
<true/>
EdgeManagementPolicyOverridesPlatformPolicy
Microsoft Edge management service policy overrides platform policy.
Supported versions:
- On Windows and macOS since 119 or later
Description
If you enable this policy, the cloud-based Microsoft Edge management service policy takes precedence if it conflicts with platform policy.
If you disable or don't configure this policy, platform policy takes precedence if it conflicts with the cloud-based Microsoft Edge management service policy.
This mandatory policy affects machine scope cloud-based Microsoft Edge management policies.
Machine policies apply to all edge browser instances regardless of the user who is logged in.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: EdgeManagementPolicyOverridesPlatformPolicy
- GP name: Microsoft Edge management service policy overrides platform policy.
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Manageability
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: EdgeManagementPolicyOverridesPlatformPolicy
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: EdgeManagementPolicyOverridesPlatformPolicy
- Example value:
<false/>
EdgeManagementUserPolicyOverridesCloudMachinePolicy
Allow cloud-based Microsoft Edge management service user policies to override local user policies.
Supported versions:
- On Windows and macOS since 119 or later
Description
If you enable this policy, cloud-based Microsoft Edge management service user policies takes precedence if it conflicts with local user policy.
If you disable or don't configure this policy, Microsoft Edge management service user policies will take precedence.
The policy can be combined with EdgeManagementPolicyOverridesPlatformPolicy. If both policies are enabled, all cloud-based Microsoft Edge management service policies will take precedence over conflicting local service policies.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: EdgeManagementUserPolicyOverridesCloudMachinePolicy
- GP name: Allow cloud-based Microsoft Edge management service user policies to override local user policies.
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Manageability
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: EdgeManagementUserPolicyOverridesCloudMachinePolicy
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: EdgeManagementUserPolicyOverridesCloudMachinePolicy
- Example value:
<false/>
MAMEnabled
Mobile App Management Enabled
Supported versions:
- On Windows and macOS since 89 or later
Description
Allows the Microsoft Edge browser to retrieve policies from the Intune application management services and apply them to users' profiles.
If you enable this policy or don't configure it, Mobile App Management (MAM) Policies can be applied.
If you disable this policy, Microsoft Edge will not communicate with Intune to request MAM Policies.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: MAMEnabled
- GP name: Mobile App Management Enabled
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Manageability
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: MAMEnabled
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: MAMEnabled
- Example value:
<false/>
Native Messaging policies
NativeMessagingAllowlist
Control which native messaging hosts users can use
Supported versions:
- On Windows and macOS since 77 or later
Description
Setting the policy specifies which native messaging hosts aren't subject to the deny list. A deny list value of * means all native messaging hosts are denied unless they're explicitly allowed.
All native messaging hosts are allowed by default. However, if a native messaging host is denied by policy, the admin can use the allow list to change that policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: NativeMessagingAllowlist
- GP name: Control which native messaging hosts users can use
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Native Messaging
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\NativeMessagingAllowlist
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\NativeMessagingAllowlist\1 = "com.native.messaging.host.name1"
SOFTWARE\Policies\Microsoft\Edge\NativeMessagingAllowlist\2 = "com.native.messaging.host.name2"
Mac information and settings
- Preference Key Name: NativeMessagingAllowlist
- Example value:
<array>
<string>com.native.messaging.host.name1</string>
<string>com.native.messaging.host.name2</string>
</array>
NativeMessagingBlocklist
Configure native messaging block list
Supported versions:
- On Windows and macOS since 77 or later
Description
Setting this policy specifies which native messaging hosts shouldn't be loaded. A deny list value of * means all native messaging hosts are denied unless they're explicitly allowed.
If you leave this policy unset , Microsoft Edge loads all installed native messaging hosts.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: NativeMessagingBlocklist
- GP name: Configure native messaging block list
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Native Messaging
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\NativeMessagingBlocklist
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\NativeMessagingBlocklist\1 = "com.native.messaging.host.name1"
SOFTWARE\Policies\Microsoft\Edge\NativeMessagingBlocklist\2 = "com.native.messaging.host.name2"
Mac information and settings
- Preference Key Name: NativeMessagingBlocklist
- Example value:
<array>
<string>com.native.messaging.host.name1</string>
<string>com.native.messaging.host.name2</string>
</array>
NativeMessagingUserLevelHosts
Allow user-level native messaging hosts (installed without admin permissions)
Supported versions:
- On Windows and macOS since 77 or later
Description
If you set this policy to Enabled or leave it unset, Microsoft Edge can use native messaging hosts installed at the user level.
If you set this policy to Disabled, Microsoft Edge can only use these hosts if they're installed at the system level.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: NativeMessagingUserLevelHosts
- GP name: Allow user-level native messaging hosts (installed without admin permissions)
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Native Messaging
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: NativeMessagingUserLevelHosts
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: NativeMessagingUserLevelHosts
- Example value:
<false/>
Network settings policies
AccessControlAllowMethodsInCORSPreflightSpecConformant
Make Access-Control-Allow-Methods matching in CORS preflight spec conformant
Supported versions:
- On Windows and macOS since 123 or later
Description
This policy controls whether request methods are uppercased when matching with Access-Control-Allow-Methods response headers in CORS preflight.
If you disable this policy, request methods are uppercased. This is the behavior on or before Microsoft Edge 108.
If you enable or don't configure this policy, request methods are not uppercased, unless matching case-insensitively with DELETE, GET, HEAD, OPTIONS, POST, or PUT.
This would reject fetch(url, {method: 'Foo'}) + "Access-Control-Allow-Methods: FOO" response header, and would accept fetch(url, {method: 'Foo'}) + "Access-Control-Allow-Methods: Foo" response header.
Note: request methods "post" and "put" are not affected, while "patch" is affected.
This policy is intended to be temporary and will be removed in the future.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AccessControlAllowMethodsInCORSPreflightSpecConformant
- GP name: Make Access-Control-Allow-Methods matching in CORS preflight spec conformant
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Network settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: AccessControlAllowMethodsInCORSPreflightSpecConformant
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: AccessControlAllowMethodsInCORSPreflightSpecConformant
- Example value:
<true/>
BlockTruncatedCookies
Block truncated cookies (obsolete)
OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 131.
Supported versions:
- On Windows and macOS since 123, until 131
Description
This policy provides a temporary opt-out for changes to how Microsoft Edge handles cookies set via JavaScript that contain certain control characters (NULL, carriage return, and line feed). Previously, the presence of any of these characters in a cookie string would cause it to be truncated but still set. Now, the presence of these characters will cause the whole cookie string to be ignored.
If you enable or don't configure this policy, the new behavior is enabled.
If you disable this policy, the old behavior is enabled.
This policy is obsolete because this policy was originally implemented as a safety measure in case of breakage, but none have been reported.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: BlockTruncatedCookies
- GP name: Block truncated cookies (obsolete)
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Network settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: BlockTruncatedCookies
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: BlockTruncatedCookies
- Example value:
<false/>
CompressionDictionaryTransportEnabled
Enable compression dictionary transport support
Supported versions:
- On Windows and macOS since 118 or later
Description
This feature enables the use of dictionary-specific content encodings in the Accept-Encoding request header ("sbr" and "zst-d") when dictionaries are available for use.
If you enable this policy or don't configure it, Microsoft Edge will accept web contents using the compression dictionary transport feature.
If you disable this policy, Microsoft Edge will turn off the compression dictionary transport feature.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: CompressionDictionaryTransportEnabled
- GP name: Enable compression dictionary transport support
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Network settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: CompressionDictionaryTransportEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: CompressionDictionaryTransportEnabled
- Example value:
<true/>
IPv6ReachabilityOverrideEnabled
Enable IPv6 reachability check override
Supported versions:
- On Windows and macOS since 132 or later
Description
This policy enables an override of the IPv6 reachability check. When overridden, the system will always query AAAA records when resolving host names. It applies to all users and interfaces on the device.
If you enable this policy, the IPv6 reachability check will be overridden.
If you disable or don't configure this policy, the IPv6 reachability check will not be overridden. The system only queries AAAA records when it is reachable to a global IPv6 host.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: IPv6ReachabilityOverrideEnabled
- GP name: Enable IPv6 reachability check override
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Network settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: IPv6ReachabilityOverrideEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: IPv6ReachabilityOverrideEnabled
- Example value:
<true/>
ZstdContentEncodingEnabled
Enable zstd content encoding support
Supported versions:
- On Windows and macOS since 125 or later
Description
This feature enables advertising "zstd" support in the Accept-Encoding request header and support for decompressing zstd web content.
If you enable or don't configure this policy, Microsoft Edge will accept server responses compressed with zstd.
If you disable this policy, the zstd content encoding feature will not be advertised or supported when processing server responses.
This policy is temporary and will be removed in the future.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ZstdContentEncodingEnabled
- GP name: Enable zstd content encoding support
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Network settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: ZstdContentEncodingEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: ZstdContentEncodingEnabled
- Example value:
<true/>
PDF Reader policies
ViewXFAPDFInIEModeAllowedFileHash
View XFA-based PDF files using IE Mode for allowed file hash.
Supported versions:
- On Windows since 132 or later
Description
XFA is a legacy technology that is deprecated by its original creators. It is not an ISO standard and as such, doesn't align with the modern web architecture. Continued use poses potential risks and vulnerabilities. For more information, see - ViewXFAPDFInIEModeAllowedOrigins.
If you enable this policy, you can configure the list of base64 encoded SHA256 file hashes for which XFA PDF files will automatically open in Microsoft Edge using IE Mode.
If you disable or don't configure this policy, XFA PDFs won't be considered for opening via IE mode except the files from file origin mentioned in Policy ViewXFAPDFInIEModeAllowedOrigins
For more information, see Get-FileHash, and Dot Net Convert API.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ViewXFAPDFInIEModeAllowedFileHash
- GP name: View XFA-based PDF files using IE Mode for allowed file hash.
- GP path (Mandatory): Administrative Templates/Microsoft Edge/PDF Reader
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\1 = "'"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\2 = "["
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\3 = "\n"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\4 = " "
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\5 = " "
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\6 = "\""
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\7 = "p"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\8 = "Z"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\9 = "G"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\10 = "m"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\11 = "1"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\12 = "A"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\13 = "v"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\14 = "0"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\15 = "I"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\16 = "E"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\17 = "B"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\18 = "K"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\19 = "A"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\20 = "R"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\21 = "c"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\22 = "z"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\23 = "z"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\24 = "7"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\25 = "e"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\26 = "x"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\27 = "k"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\28 = "N"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\29 = "Y"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\30 = "s"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\31 = "Z"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\32 = "b"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\33 = "8"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\34 = "L"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\35 = "z"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\36 = "a"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\37 = "M"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\38 = "r"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\39 = "V"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\40 = "7"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\41 = "J"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\42 = "3"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\43 = "2"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\44 = "a"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\45 = "2"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\46 = "f"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\47 = "F"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\48 = "G"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\49 = "4"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\50 = "="
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\51 = "\""
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\52 = ","
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\53 = "\n"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\54 = " "
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\55 = " "
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\56 = "\""
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\57 = "n"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\58 = "F"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\59 = "e"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\60 = "L"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\61 = "0"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\62 = "Q"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\63 = "+"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\64 = "9"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\65 = "H"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\66 = "X"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\67 = "7"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\68 = "W"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\69 = "F"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\70 = "I"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\71 = "3"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\72 = "R"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\73 = "s"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\74 = "m"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\75 = "S"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\76 = "D"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\77 = "F"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\78 = "T"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\79 = "l"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\80 = "U"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\81 = "t"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\82 = "r"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\83 = "b"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\84 = "c"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\85 = "l"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\86 = "X"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\87 = "H"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\88 = "6"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\89 = "7"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\90 = "M"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\91 = "T"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\92 = "d"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\93 = "X"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\94 = "D"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\95 = "w"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\96 = "W"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\97 = "u"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\98 = "u"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\99 = "4"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\100 = "="
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\101 = "\""
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\102 = ","
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\103 = "\n"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\104 = " "
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\105 = "]"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\106 = "'"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedFileHash\107 = "\n"
ViewXFAPDFInIEModeAllowedOrigins
View XFA-based PDF files using IE Mode for allowed file origin.
Supported versions:
- On Windows since 132 or later
Description
Internet Explorer (IE) mode uses the Adobe Acrobat Active-X PDF Plugin to open XFA-based PDF files. This policy will only work if the Active-X plugin is already on the user's device, it's not installed as part of this policy.
It's important to note that XFA is a legacy technology that is deprecated by its original creators. It is not an ISO standard and as such, doesn't align with the modern web architecture. Continued use poses potential risks and vulnerabilities.
Given the deprecated status of XFA technology and the lack of any investment by its creators, we strongly recommend that you start planning your transition to a more advanced HTML\PDF form-based solutions.
In the interim, this policy provides a workaround for users to view XFA PDF in Microsoft Edge.
If you enable this policy, you can configure the list of origins from which XFA PDF files will be automatically opened in Microsoft Edge using IE Mode.
If you disable or don't configure the policy, XFA PDFs won't be considered for opening via Internet Explorer mode.
For detailed information on valid URL patterns, see - https://go.microsoft.com/fwlink/?linkid=2095322
Alternatively, ViewXFAPDFInIEModeAllowedFileHash can also be used to configure list of file hashes instead of URL origins, which will enable those files to be automatically opened in Microsoft Edge using IE Mode.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ViewXFAPDFInIEModeAllowedOrigins
- GP name: View XFA-based PDF files using IE Mode for allowed file origin.
- GP path (Mandatory): Administrative Templates/Microsoft Edge/PDF Reader
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\1 = "'"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\2 = "["
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\3 = " "
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\4 = "\n"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\5 = " "
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\6 = " "
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\7 = "\""
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\8 = "h"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\9 = "t"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\10 = "t"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\11 = "p"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\12 = "s"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\13 = ":"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\14 = "/"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\15 = "/"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\16 = "c"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\17 = "o"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\18 = "n"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\19 = "t"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\20 = "e"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\21 = "s"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\22 = "s"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\23 = "o"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\24 = "."
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\25 = "s"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\26 = "h"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\27 = "a"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\28 = "r"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\29 = "e"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\30 = "p"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\31 = "o"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\32 = "i"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\33 = "n"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\34 = "t"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\35 = "."
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\36 = "c"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\37 = "o"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\38 = "m"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\39 = "/"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\40 = "a"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\41 = "c"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\42 = "c"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\43 = "o"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\44 = "u"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\45 = "n"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\46 = "t"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\47 = "s"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\48 = "/"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\49 = "\""
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\50 = ","
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\51 = " "
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\52 = "\n"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\53 = " "
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\54 = " "
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\55 = "\""
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\56 = "h"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\57 = "t"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\58 = "t"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\59 = "p"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\60 = "s"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\61 = ":"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\62 = "/"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\63 = "/"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\64 = "c"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\65 = "o"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\66 = "n"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\67 = "t"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\68 = "e"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\69 = "s"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\70 = "s"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\71 = "o"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\72 = "."
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\73 = "s"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\74 = "h"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\75 = "a"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\76 = "r"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\77 = "e"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\78 = "p"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\79 = "o"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\80 = "i"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\81 = "n"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\82 = "t"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\83 = "."
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\84 = "c"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\85 = "o"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\86 = "m"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\87 = "/"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\88 = "t"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\89 = "r"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\90 = "a"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\91 = "n"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\92 = "s"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\93 = "p"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\94 = "o"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\95 = "r"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\96 = "t"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\97 = "/"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\98 = "\""
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\99 = ","
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\100 = " "
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\101 = "\n"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\102 = " "
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\103 = " "
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\104 = "\""
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\105 = "f"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\106 = "i"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\107 = "l"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\108 = "e"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\109 = ":"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\110 = "/"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\111 = "/"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\112 = "a"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\113 = "c"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\114 = "c"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\115 = "o"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\116 = "u"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\117 = "n"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\118 = "t"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\119 = "_"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\120 = "f"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\121 = "o"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\122 = "r"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\123 = "m"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\124 = "s"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\125 = "/"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\126 = "\""
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\127 = "\n"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\128 = "]"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\129 = "'"
SOFTWARE\Policies\Microsoft\Edge\ViewXFAPDFInIEModeAllowedOrigins\130 = "\n"
Password manager and protection policies
DeletingUndecryptablePasswordsEnabled
Enable deleting undecryptable passwords
Supported versions:
- On Windows and macOS since 132 or later
Description
This policy controls whether the built-in password manager can delete undecryptable passwords from its database. This is required to restore the full functionality of the built-in password manager, but it may include a permanent data loss. Undecryptable password values will not become decryptable on their own.
If fixing them is possible, it usually requires complex user actions.
Enabling this policy or leaving it unset means that users with undecryptable passwords saved to the built-in password manager will lose them. Passwords that are still in a working state will remain untouched.
Disabling this policy means users will have their password manager data untouched, but will experience a broken password manager functionality.
If the policy is set, users can't override it in Microsoft Edge.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: DeletingUndecryptablePasswordsEnabled
- GP name: Enable deleting undecryptable passwords
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Password manager and protection
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: DeletingUndecryptablePasswordsEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: DeletingUndecryptablePasswordsEnabled
- Example value:
<true/>
PasswordDeleteOnBrowserCloseEnabled
Prevent passwords from being deleted if any Edge settings is enabled to delete browsing data when Microsoft Edge closes
Supported versions:
- On Windows and macOS since 117 or later
Description
When this policy is enabled, the passwords saved with Edge Password Manager are exempted from deletion when the browser closes. This policy is only effective when the ClearBrowsingDataOnExit policy is enabled.
If you enable this policy, passwords won't be cleared when the browser closes. If you disable or don't configure this policy, the user's personal configuration is used.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: PasswordDeleteOnBrowserCloseEnabled
- GP name: Prevent passwords from being deleted if any Edge settings is enabled to delete browsing data when Microsoft Edge closes
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Password manager and protection
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Password manager and protection
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: PasswordDeleteOnBrowserCloseEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: PasswordDeleteOnBrowserCloseEnabled
- Example value:
<true/>
PasswordGeneratorEnabled
Allow users to get a strong password suggestion whenever they are creating an account online
Supported versions:
- On Windows and macOS since 93 or later
Description
Configures the Password Generator Settings toggle that enables/disables the feature for users.
If you enable or don't configure this policy, then Password Generator will offer users a strong and unique password suggestion (via a dropdown) on Signup and Change Password pages.
If you disable this policy, users will no longer see strong password suggestions on Signup or Change Password pages.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: PasswordGeneratorEnabled
- GP name: Allow users to get a strong password suggestion whenever they are creating an account online
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Password manager and protection
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: PasswordGeneratorEnabled
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: PasswordGeneratorEnabled
- Example value:
<false/>
PasswordManagerBlocklist
Configure the list of domains for which the password manager UI (Save and Fill) will be disabled
Supported versions:
- On Windows and macOS since 99 or later
Description
Configure the list of domains where Microsoft Edge should disable the password manager. This means that Save and Fill workflows will be disabled, ensuring that passwords for those websites can't be saved or auto filled into web forms.
If you enable this policy, the password manager will be disabled for the specified set of domains.
If you disable or don't configure this policy, password manager will work as usual for all domains.
If you configure this policy, that is, add domains for which password manager is blocked, users can't change or override the behavior in Microsoft Edge. In addition, users can't use password manager for those URLs.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: PasswordManagerBlocklist
- GP name: Configure the list of domains for which the password manager UI (Save and Fill) will be disabled
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Password manager and protection
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\PasswordManagerBlocklist
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\PasswordManagerBlocklist\1 = "https://contoso.com/"
SOFTWARE\Policies\Microsoft\Edge\PasswordManagerBlocklist\2 = "https://login.contoso.com"
Mac information and settings
- Preference Key Name: PasswordManagerBlocklist
- Example value:
<array>
<string>https://contoso.com/</string>
<string>https://login.contoso.com</string>
</array>
PasswordManagerEnabled
Enable saving passwords to the password manager
Supported versions:
- On Windows and macOS since 77 or later
Description
Enable Microsoft Edge to save user passwords. The next time a user visits a site with a saved password, Microsoft Edge will enter the password automatically.
If you enable or don't configure this policy, users can save and add their passwords in Microsoft Edge.
If you disable this policy, users can't save and add new passwords, but they can still use previously saved passwords.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: PasswordManagerEnabled
- GP name: Enable saving passwords to the password manager
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Password manager and protection
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Password manager and protection
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: PasswordManagerEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: PasswordManagerEnabled
- Example value:
<true/>
PasswordManagerRestrictLengthEnabled
Restrict the length of passwords that can be saved in the Password Manager
Supported versions:
- On Windows and macOS since 104 or later
Description
Make Microsoft Edge restrict the length of usernames and/or passwords that can be saved in the Password Manager.
If you enable this policy, Microsoft Edge will not let the user save credentials with usernames and/or passwords longer than 256 characters.
If you disable or don't configure this policy, Microsoft Edge will let the user save credentials with arbitrarily long usernames and/or passwords.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: PasswordManagerRestrictLengthEnabled
- GP name: Restrict the length of passwords that can be saved in the Password Manager
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Password manager and protection
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: PasswordManagerRestrictLengthEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: PasswordManagerRestrictLengthEnabled
- Example value:
<true/>
PasswordMonitorAllowed
Allow users to be alerted if their passwords are found to be unsafe
Supported versions:
- On Windows since 85 or later
- On macOS since 93 or later
Description
Allow Microsoft Edge to monitor user passwords.
If you enable this policy, the user will get alerted if any of their passwords stored in Microsoft Edge are found to be unsafe. Microsoft Edge will show an alert and this information will also be available in Settings > Passwords > Password Monitor.
If you disable this policy, users will not be asked for permission to enable this feature. Their passwords will not be scanned and they will not be alerted either.
If you don't configure the policy, users can turn this feature on or off.
To learn more about how Microsoft Edge finds unsafe passwords see https://go.microsoft.com/fwlink/?linkid=2133833
Additional guidance:
This policy can be set as both Recommended as well as Mandatory, however with an important callout.
Mandatory enabled: If the policy is set to Mandatory enabled, the UI in Settings will be disabled but remain in 'On' state, and a briefcase icon will be made visible next to it with this description displayed on hover - "This setting is managed by your organization."
Recommended enabled: If the policy is set to Recommended enabled, the UI in Settings will remain in 'Off' state, but a briefcase icon will be made visible next to it with this description displayed on hover - "Your organization recommends a specific value for this setting and you have chosen a different value"
Mandatory and Recommended disabled: Both these states will work the normal way, with the usual captions being shown to users.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: PasswordMonitorAllowed
- GP name: Allow users to be alerted if their passwords are found to be unsafe
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Password manager and protection
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Password manager and protection
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: PasswordMonitorAllowed
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: PasswordMonitorAllowed
- Example value:
<true/>
PasswordProtectionChangePasswordURL
Configure the change password URL
Supported versions:
- On Windows and macOS since 77 or later
Description
Configures the change password URL (HTTP and HTTPS schemes only).
Password protection service will send users to this URL to change their password after seeing a warning in the browser.
If you enable this policy, then password protection service sends users to this URL to change their password.
If you disable this policy or don't configure it, then password protection service will not redirect users to a change password URL.
This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, joined to Microsoft Azure Active Directory, or instances that enrolled for device management. On macOS, this policy is available only on instances that are managed via MDM or joined to a domain via MCX.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- String
Windows information and settings
Group Policy (ADMX) info
- GP unique name: PasswordProtectionChangePasswordURL
- GP name: Configure the change password URL
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Password manager and protection
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: PasswordProtectionChangePasswordURL
- Value Type: REG_SZ
Example value:
"https://contoso.com/change_password.html"
Mac information and settings
- Preference Key Name: PasswordProtectionChangePasswordURL
- Example value:
<string>https://contoso.com/change_password.html</string>
PasswordProtectionLoginURLs
Configure the list of enterprise login URLs where the password protection service should capture salted hashes of a password
Supported versions:
- On Windows and macOS since 77 or later
Description
Configure the list of enterprise login URLs (HTTP and HTTPS schemes only) where Microsoft Edge should capture the salted hashes of passwords and use it for password reuse detection.
If you enable this policy, the password protection service captures fingerprints of passwords on the defined URLs.
If you disable this policy or don't configure it, no password fingerprints are captured.
This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, joined to Microsoft Azure Active Directory, or instances that enrolled for device management. On macOS, this policy is available only on instances that are managed via MDM or joined to a domain via MCX.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: PasswordProtectionLoginURLs
- GP name: Configure the list of enterprise login URLs where the password protection service should capture salted hashes of a password
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Password manager and protection
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\PasswordProtectionLoginURLs
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\PasswordProtectionLoginURLs\1 = "https://contoso.com/login.html"
SOFTWARE\Policies\Microsoft\Edge\PasswordProtectionLoginURLs\2 = "https://login.contoso.com"
Mac information and settings
- Preference Key Name: PasswordProtectionLoginURLs
- Example value:
<array>
<string>https://contoso.com/login.html</string>
<string>https://login.contoso.com</string>
</array>
PasswordProtectionWarningTrigger
Configure password protection warning trigger
Supported versions:
- On Windows and macOS since 77 or later
Description
Allows you to control when to trigger password protection warning. Password protection alerts users when they reuse their protected password on potentially suspicious sites.
You can use the PasswordProtectionLoginURLs and PasswordProtectionChangePasswordURL policies to configure which passwords to protect.
Exemptions: Passwords for the sites listed in PasswordProtectionLoginURLs and PasswordProtectionChangePasswordURL, as well as for the sites listed in SmartScreenAllowListDomains, will not trigger a password-protection warning.
Set to 'PasswordProtectionWarningOff' to not show password protection warningss.
Set to 'PasswordProtectionWarningOnPasswordReuse' to show password protection warnings when the user reuses their protected password on a non-allowlisted site.
If you disable or don't configure this policy, then the warning trigger is not shown.
Policy options mapping:
PasswordProtectionWarningOff (0) = Password protection warning is off
PasswordProtectionWarningOnPasswordReuse (1) = Password protection warning is triggered by password reuse
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: PasswordProtectionWarningTrigger
- GP name: Configure password protection warning trigger
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Password manager and protection
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: PasswordProtectionWarningTrigger
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: PasswordProtectionWarningTrigger
- Example value:
<integer>1</integer>
PasswordRevealEnabled
Enable Password reveal button
Supported versions:
- On Windows and macOS since 87 or later
Description
Lets you configure the default display of the browser password reveal button for password input fields on websites.
If you enable or don't configure this policy, the browser user setting defaults to displaying the password reveal button.
If you disable this policy, the browser user setting won't display the password reveal button.
For accessibility, users can change the browser setting from the default policy.
This policy only affects the browser password reveal button, it doesn't affect websites' custom reveal buttons.
Supported features:
- Can be mandatory: No
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: PasswordRevealEnabled
- GP name: Enable Password reveal button
- GP path (Mandatory): N/A
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Password manager and protection
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): N/A
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: PasswordRevealEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: PasswordRevealEnabled
- Example value:
<true/>
PrimaryPasswordSetting
Configures a setting that asks users to enter their device password while using password autofill
Supported versions:
- On Windows and macOS since 93 or later
Description
The feature helps users add an additional layer of privacy to their online accounts by requiring device authentication (as a way of confirming the user's identity) before the saved password is auto-filled into a web form. This ensures that non-authorized persons can't use saved passwords for autofill.
This group policy configures the radio button selector that enables this feature for users. It also has a frequency control where users can specify how often they would like to be prompted for authentication.
If you set this policy to 'Automatically', disable this policy, or don't configure this policy, autofill will not have any authentication flow.
If you set this policy to 'WithDevicePassword', users will have to enter their device password (or preferred mode of authentication under Windows) to prove their identity before their password is auto filled. Authentication modes include Windows Hello, PIN, face recognition, or fingerprint. The frequency for authentication prompt will be set to 'Ask permission once per browsing session' by default. However, users can change it to the other option, which is 'Always ask permission'.
If you set this policy to 'WithCustomPrimaryPassword', users will be asked to create their custom password and then to be redirected to Settings. After the custom password is set, users can authenticate themselves using the custom password and their passwords will get auto-filled after successful authentication. The frequency for authentication prompt will be set to 'Ask permission once per browsing session' by default. However, users can change it to the other option, which is 'Always ask permission'.
If you set this policy to 'AutofillOff', saved passwords will no longer be suggested for autofill.
Policy options mapping:
Automatically (0) = Automatically
WithDevicePassword (1) = With device password
WithCustomPrimaryPassword (2) = With custom primary password
AutofillOff (3) = Autofill off
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: PrimaryPasswordSetting
- GP name: Configures a setting that asks users to enter their device password while using password autofill
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Password manager and protection
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: PrimaryPasswordSetting
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: PrimaryPasswordSetting
- Example value:
<integer>0</integer>
Performance policies
EfficiencyMode
Configure when efficiency mode should become active
Supported versions:
- On Windows and macOS since 96 or later
Description
This policy setting lets you configure when efficiency mode will become active. By default, efficiency mode is set to 'BalancedSavings'. On devices with no battery, the default is for efficiency mode to never become active.
Individual sites may be blocked from participating in efficiency mode by configuring the policy SleepingTabsBlockedForUrls.
Set this policy to 'AlwaysActive' and efficiency mode will always be active.
Set this policy to 'NeverActive' and efficiency mode will never become active.
Set this policy to 'ActiveWhenUnplugged' and efficiency mode will become active when the device is unplugged.
Set this policy to 'ActiveWhenUnpluggedBatteryLow' and efficiency mode will become active when the device is unplugged and the battery is low.
Set this policy to 'BalancedSavings' and when the device is unplugged, efficiency mode will take moderate steps to save battery. When the device is unplugged and the battery is low, efficiency mode will take additional steps to save battery.
Set this policy to 'MaximumSavings' and when the device is unplugged or unplugged and the battery is low, efficiency mode takes additional steps to save battery.
If the device does not have a battery, efficiency mode will never become active in any mode other than 'AlwaysActive' unless the setting or EfficiencyModeEnabled policy is enabled.
This policy has no effect if the EfficiencyModeEnabled policy is disabled.
Learn more about efficiency mode: https://go.microsoft.com/fwlink/?linkid=2173921
Policy options mapping:
AlwaysActive (0) = Efficiency mode is always active
NeverActive (1) = Efficiency mode is never active
ActiveWhenUnplugged (2) = Efficiency mode is active when the device is unplugged
ActiveWhenUnpluggedBatteryLow (3) = Efficiency mode is active when the device is unplugged and the battery is low
BalancedSavings (4) = When the device is unplugged, efficiency mode takes moderate steps to save battery. When the device is unplugged and the battery is low, efficiency mode takes additional steps to save battery.
MaximumSavings (5) = When the device is unplugged or unplugged and the battery is low, efficiency mode takes additional steps to save battery.
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: EfficiencyMode
- GP name: Configure when efficiency mode should become active
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Performance
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Performance
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: EfficiencyMode
- Value Type: REG_DWORD
Example value:
0x00000003
Mac information and settings
- Preference Key Name: EfficiencyMode
- Example value:
<integer>3</integer>
EfficiencyModeEnabled
Efficiency mode enabled
Supported versions:
- On Windows and macOS since 106 or later
Description
Enables efficiency mode which helps extend battery life by saving computer resources. By default, efficiency mode is enabled for devices with a battery and disabled otherwise.
If you enable this policy, efficiency mode will become active according to the setting chosen by the user. You can configure the efficiency mode setting using the EfficiencyMode policy. If the device does not have a battery, efficiency mode will always be active.
If you disable this policy, efficiency mode will never become active. The EfficiencyMode and EfficiencyModeOnPowerEnabled policies will have no effect.
If you don't configure this policy, efficiency mode will be enabled for devices with a battery and disabled otherwise. Users can choose the efficiency mode option they want in edge://settings/system.
Learn more about efficiency mode: https://go.microsoft.com/fwlink/?linkid=2173921
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: EfficiencyModeEnabled
- GP name: Efficiency mode enabled
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Performance
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Performance
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: EfficiencyModeEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: EfficiencyModeEnabled
- Example value:
<true/>
EfficiencyModeOnPowerEnabled
Enable efficiency mode when the device is connected to a power source
Supported versions:
- On Windows and macOS since 106 or later
Description
Allows efficiency mode to become active when the device is connected to a power source. On devices with no battery, this policy has no effect.
If you enable this policy, efficiency mode will become active when the device is connected to a power source.
If you disable or don't configure this policy, efficiency mode will never become active when the device is connected to a power source.
This policy has no effect if the EfficiencyModeEnabled policy is disabled.
Learn more about efficiency mode: https://go.microsoft.com/fwlink/?linkid=2173921
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: EfficiencyModeOnPowerEnabled
- GP name: Enable efficiency mode when the device is connected to a power source
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Performance
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Performance
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: EfficiencyModeOnPowerEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: EfficiencyModeOnPowerEnabled
- Example value:
<true/>
ExtensionsPerformanceDetectorEnabled
Extensions Performance Detector enabled
Supported versions:
- On Windows and macOS since 130 or later
Description
This policy controls if users can access the Extensions Performance Detector Recommended Action feature in Browser Essentials. This feature alerts extension users if their extensions are causing performance regressions in the browser and allows them to take action to resolve the issue.
If you enable or don't configure this policy, users will receive Extensions Performance Detector notifications from Browser Essentials. When there is an active alert, users will be able to view the impact of extensions on their browser's performance and make an informed decision to disable impacting extensions. The detector will exclude browser-managed extensions, such as Google Docs offline, component extensions, and organization-managed extensions (ie. extensions that cannot be disabled).
If you disable this policy, users will not receive notifications or be able to view the Extensions Performance Detector Recommended Action.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ExtensionsPerformanceDetectorEnabled
- GP name: Extensions Performance Detector enabled
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Performance
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Performance
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: ExtensionsPerformanceDetectorEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: ExtensionsPerformanceDetectorEnabled
- Example value:
<true/>
PerformanceDetectorEnabled
Performance Detector Enabled
Supported versions:
- On Windows and macOS since 107 or later
Description
The performance detector detects tab performance issues and recommends actions to fix the performance issues.
If you enable or don't configure this policy, performance detector is turned on.
If you disable this policy, performance detector is turned off.
The user can configure its behavior in edge://settings/system.
Learn more about performance detector: https://aka.ms/EdgePerformanceDetector
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: PerformanceDetectorEnabled
- GP name: Performance Detector Enabled
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Performance
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Performance
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: PerformanceDetectorEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: PerformanceDetectorEnabled
- Example value:
<true/>
PinBrowserEssentialsToolbarButton
Pin browser essentials toolbar button
Supported versions:
- On Windows and macOS since 114 or later
Description
This policy lets you configure whether to pin the Browser essentials button on the toolbar.
When the button is pinned, it will always appear on the toolbar.
When the button isn't pinned, it will only appear when there's an alert. An example of this kind of alert is the performance detector alert that indicates the browser is using high CPU or memory.
If you enable or don't configure this policy, the Browser essentials button will be pinned on the toolbar.
If you disable this policy, the Browser essentials button won't be pinned on the toolbar.
Learn more about browser essentials: https://go.microsoft.com/fwlink/?linkid=2240439
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: PinBrowserEssentialsToolbarButton
- GP name: Pin browser essentials toolbar button
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Performance
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Performance
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: PinBrowserEssentialsToolbarButton
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: PinBrowserEssentialsToolbarButton
- Example value:
<true/>
StartupBoostEnabled
Enable startup boost
Supported versions:
- On Windows since 88 or later
Description
Allows Microsoft Edge processes to start at OS sign-in and restart in background after the last browser window is closed.
If Microsoft Edge is running in background mode, the browser might not close when the last window is closed and the browser won't be restarted in background when the window closes. See the BackgroundModeEnabled policy for information about what happens after configuring Microsoft Edge background mode behavior.
If you enable this policy, startup boost is turned on.
If you disable this policy, startup boost is turned off.
If you don't configure this policy, startup boost may initially be off or on. The user can configure its behavior in edge://settings/system.
Learn more about startup boost: https://go.microsoft.com/fwlink/?linkid=2147018
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: StartupBoostEnabled
- GP name: Enable startup boost
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Performance
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Performance
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: StartupBoostEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Permit or deny screen capture policies
SameOriginTabCaptureAllowedByOrigins
Allow Same Origin Tab capture by these origins
Supported versions:
- On Windows and macOS since 97 or later
Description
Setting the policy lets you set a list of URL patterns that can capture tabs with their same Origin.
Leaving the policy unset means that sites will not be considered for an override at this scope of capture.
If a site matches a URL pattern in this policy, the following policies will not be considered: TabCaptureAllowedByOrigins, WindowCaptureAllowedByOrigins, ScreenCaptureAllowedByOrigins, ScreenCaptureAllowed.
For detailed information on valid url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322. This policy only matches based on origin, so any path in the URL pattern is ignored.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: SameOriginTabCaptureAllowedByOrigins
- GP name: Allow Same Origin Tab capture by these origins
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Permit or deny screen capture
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\SameOriginTabCaptureAllowedByOrigins
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\SameOriginTabCaptureAllowedByOrigins\1 = "https://www.example.com"
SOFTWARE\Policies\Microsoft\Edge\SameOriginTabCaptureAllowedByOrigins\2 = "[*.]example.edu"
Mac information and settings
- Preference Key Name: SameOriginTabCaptureAllowedByOrigins
- Example value:
<array>
<string>https://www.example.com</string>
<string>[*.]example.edu</string>
</array>
ScreenCaptureAllowedByOrigins
Allow Desktop, Window, and Tab capture by these origins
Supported versions:
- On Windows and macOS since 97 or later
Description
Setting the policy lets you set a list of URL patterns that can use Desktop, Window, and Tab Capture.
Leaving the policy unset means that sites will not be considered for an override at this scope of Capture.
This policy is not considered if a site matches a URL pattern in any of the following policies: WindowCaptureAllowedByOrigins, TabCaptureAllowedByOrigins, SameOriginTabCaptureAllowedByOrigins.
If a site matches a URL pattern in this policy, the ScreenCaptureAllowed will not be considered.
For detailed information on valid url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322. This policy only matches based on origin, so any path in the URL pattern is ignored.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ScreenCaptureAllowedByOrigins
- GP name: Allow Desktop, Window, and Tab capture by these origins
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Permit or deny screen capture
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\ScreenCaptureAllowedByOrigins
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\ScreenCaptureAllowedByOrigins\1 = "https://www.example.com"
SOFTWARE\Policies\Microsoft\Edge\ScreenCaptureAllowedByOrigins\2 = "[*.]example.edu"
Mac information and settings
- Preference Key Name: ScreenCaptureAllowedByOrigins
- Example value:
<array>
<string>https://www.example.com</string>
<string>[*.]example.edu</string>
</array>
TabCaptureAllowedByOrigins
Allow Tab capture by these origins
Supported versions:
- On Windows and macOS since 97 or later
Description
Setting the policy lets you set a list of URL patterns that can use Tab Capture.
Leaving the policy unset means that sites will not be considered for an override at this scope of capture.
This policy is not considered if a site matches a URL pattern in the SameOriginTabCaptureAllowedByOrigins policy.
If a site matches a URL pattern in this policy, the following policies will not be considered: WindowCaptureAllowedByOrigins, ScreenCaptureAllowedByOrigins, ScreenCaptureAllowed.
For detailed information on valid url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322. This policy only matches based on origin, so any path in the URL pattern is ignored.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: TabCaptureAllowedByOrigins
- GP name: Allow Tab capture by these origins
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Permit or deny screen capture
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\TabCaptureAllowedByOrigins
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\TabCaptureAllowedByOrigins\1 = "https://www.example.com"
SOFTWARE\Policies\Microsoft\Edge\TabCaptureAllowedByOrigins\2 = "[*.]example.edu"
Mac information and settings
- Preference Key Name: TabCaptureAllowedByOrigins
- Example value:
<array>
<string>https://www.example.com</string>
<string>[*.]example.edu</string>
</array>
WindowCaptureAllowedByOrigins
Allow Window and Tab capture by these origins
Supported versions:
- On Windows and macOS since 97 or later
Description
Setting the policy lets you set a list of URL patterns that can use Window and Tab Capture.
Leaving the policy unset means that sites will not be considered for an override at this scope of Capture.
This policy is not considered if a site matches a URL pattern in any of the following policies: TabCaptureAllowedByOrigins, SameOriginTabCaptureAllowedByOrigins.
If a site matches a URL pattern in this policy, the following policies will not be considered: ScreenCaptureAllowedByOrigins, ScreenCaptureAllowed.
For detailed information on valid url patterns, please see https://go.microsoft.com/fwlink/?linkid=2095322. This policy only matches based on origin, so any path in the URL pattern is ignored.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: WindowCaptureAllowedByOrigins
- GP name: Allow Window and Tab capture by these origins
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Permit or deny screen capture
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\WindowCaptureAllowedByOrigins
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\WindowCaptureAllowedByOrigins\1 = "https://www.example.com"
SOFTWARE\Policies\Microsoft\Edge\WindowCaptureAllowedByOrigins\2 = "[*.]example.edu"
Mac information and settings
- Preference Key Name: WindowCaptureAllowedByOrigins
- Example value:
<array>
<string>https://www.example.com</string>
<string>[*.]example.edu</string>
</array>
Printing policies
DefaultPrinterSelection
Default printer selection rules
Supported versions:
- On Windows and macOS since 77 or later
Description
Overrides Microsoft Edge default printer selection rules. This policy determines the rules for selecting the default printer in Microsoft Edge, which happens the first time a user tries to print a page.
When this policy is set, Microsoft Edge tries to find a printer that matches all of the specified attributes and uses it as default printer. If there are multiple printers that meet the criteria, the first printer that matches is used.
If you don't configure this policy or no matching printers are found within the timeout, the printer defaults to the built-in PDF printer or no printer, if the PDF printer isn't available.
The value is parsed as a JSON object, conforming to the following schema: { "type": "object", "properties": { "idPattern": { "description": "Regular expression to match printer id.", "type": "string" }, "namePattern": { "description": "Regular expression to match printer display name.", "type": "string" } } }
Omitting a field means all values match; for example, if you don't specify connectivity Print Preview starts discovering all kinds of local printers. Regular expression patterns must follow the JavaScript RegExp syntax and matches are case sensitive.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- String
Windows information and settings
Group Policy (ADMX) info
- GP unique name: DefaultPrinterSelection
- GP name: Default printer selection rules
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Printing
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: DefaultPrinterSelection
- Value Type: REG_SZ
Example value:
"{ \"idPattern\": \".*public\", \"namePattern\": \".*Color\" }"
Mac information and settings
- Preference Key Name: DefaultPrinterSelection
- Example value:
<string>{ "idPattern": ".*public", "namePattern": ".*Color" }</string>
PrintHeaderFooter
Print headers and footers
Supported versions:
- On Windows and macOS since 77 or later
Description
Force 'headers and footers' to be on or off in the printing dialog.
If you don't configure this policy, users can decide whether to print headers and footers.
If you disable this policy, users can't print headers and footers.
If you enable this policy, users always print headers and footers.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: PrintHeaderFooter
- GP name: Print headers and footers
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Printing
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Printing
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: PrintHeaderFooter
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: PrintHeaderFooter
- Example value:
<false/>
PrintPdfAsImageDefault
Print PDF as Image Default
Supported versions:
- On Windows and macOS since 106 or later
Description
Controls if Microsoft Edge makes the Print as image option the default when printing PDFs.
If you enable this policy, Microsoft Edge will default to setting the Print as image option in the Print Preview when printing a PDF.
If you disable or don't configure this policy, Microsoft Edge will not default to setting the Print as image option in the Print Preview when printing a PDF.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: PrintPdfAsImageDefault
- GP name: Print PDF as Image Default
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Printing
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: PrintPdfAsImageDefault
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: PrintPdfAsImageDefault
- Example value:
<true/>
PrintPostScriptMode
Print PostScript Mode
Supported versions:
- On Windows since 96 or later
Description
Controls how Microsoft Edge prints on Microsoft Windows.
Printing to a PostScript printer on Microsoft Windows different PostScript generation methods can affect printing performance.
If you set this policy to Default, Microsoft Edge will use a set of default options when generating PostScript. For text in particular, text will always be rendered using Type 3 fonts.
If you set this policy to Type42, Microsoft Edge will render text using Type 42 fonts if possible. This should increase printing speed for some PostScript printers.
If you don't configure this policy, Microsoft Edge will be in Default mode.
Policy options mapping:
Default (0) = Default
Type42 (1) = Type42
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: PrintPostScriptMode
- GP name: Print PostScript Mode
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Printing
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: PrintPostScriptMode
- Value Type: REG_DWORD
Example value:
0x00000001
PrintPreviewStickySettings
Configure the sticky print preview settings
Supported versions:
- On Windows and macOS since 110 or later
Description
Configuring this policy sets the print preview settings as the most recent choice in Print Preview instead of the default print preview settings.
Each item of this policy expects a boolean:
Layout specifies if the webpage layout should be kept sticky or not in print preview settings. If we set this to True the webpage layout uses the recent choice otherwise it will set to default value.
Size specifies if the page size should be kept sticky or not in print preview settings. If we set this to True the page size uses the recent choice otherwise it will set to default value.
Scale Type specifies if the scaling percentage and scale type should be kept sticky or not in print preview settings. If we set this to True the scale percentage and scale type both uses the recent choice oherwise it will set to default value.
Margins specifies if the page margin should be kept sticky or not in print preview settings. If we set this to True the page margins uses the recent choice otherwise it will set to default value.
If you enable this policy, the selected values will use the most recent choice in Print Preview.
If you disable or don't configure this policy, print preview settings will not be impacted.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Dictionary
Windows information and settings
Group Policy (ADMX) info
- GP unique name: PrintPreviewStickySettings
- GP name: Configure the sticky print preview settings
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Printing
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Printing
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: PrintPreviewStickySettings
- Value Type: REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\PrintPreviewStickySettings = {
"layout": false,
"margins": true,
"scaleType": false,
"size": true
}
Compact example value:
SOFTWARE\Policies\Microsoft\Edge\PrintPreviewStickySettings = {"layout": false, "margins": true, "scaleType": false, "size": true}
Mac information and settings
- Preference Key Name: PrintPreviewStickySettings
- Example value:
<key>PrintPreviewStickySettings</key>
<dict>
<key>layout</key>
<false/>
<key>margins</key>
<true/>
<key>scaleType</key>
<false/>
<key>size</key>
<true/>
</dict>
PrintPreviewUseSystemDefaultPrinter
Set the system default printer as the default printer
Supported versions:
- On Windows and macOS since 77 or later
Description
Tells Microsoft Edge to use the system default printer as the default choice in Print Preview instead of the most recently used printer.
If you disable this policy or don't configure it, Print Preview uses the most recently used printer as the default destination choice.
If you enable this policy, Print Preview uses the OS system default printer as the default destination choice.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: PrintPreviewUseSystemDefaultPrinter
- GP name: Set the system default printer as the default printer
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Printing
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Printing
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: PrintPreviewUseSystemDefaultPrinter
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: PrintPreviewUseSystemDefaultPrinter
- Example value:
<false/>
PrintRasterizationMode
Print Rasterization Mode
Supported versions:
- On Windows since 90 or later
Description
Controls how Microsoft Edge prints on Windows.
When printing to a non-PostScript printer on Windows, sometimes print jobs need to be rasterized to print correctly.
If you set this policy to 'Full' or don't configure it, Microsoft Edge will do full page rasterization if necessary.
If you set this policy to 'Fast', Microsoft Edge will reduce the amount of rasterization which can help reduce print job sizes and increase printing speed.
Policy options mapping:
Full (0) = Full page rasterization
Fast (1) = Avoid rasterization if possible
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: PrintRasterizationMode
- GP name: Print Rasterization Mode
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Printing
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: PrintRasterizationMode
- Value Type: REG_DWORD
Example value:
0x00000001
PrintRasterizePdfDpi
Print Rasterize PDF DPI
Supported versions:
- On Windows and macOS since 96 or later
Description
Controls print image resolution when Microsoft Edge prints PDFs with rasterization.
When printing a PDF using the Print to image option, it can be beneficial to specify a print resolution other than a device's printer setting or the PDF default. A high resolution will significantly increase the processing and printing time while a low resolution can lead to poor imaging quality.
If you set this policy, it allows a particular resolution to be specified for use when rasterizing PDFs for printing.
If you set this policy to zero or don't configure it, the system default resolution will be used during rasterization of page images.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: PrintRasterizePdfDpi
- GP name: Print Rasterize PDF DPI
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Printing
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: PrintRasterizePdfDpi
- Value Type: REG_DWORD
Example value:
0x0000012c
Mac information and settings
- Preference Key Name: PrintRasterizePdfDpi
- Example value:
<integer>300</integer>
PrintStickySettings
Print preview sticky settings
Supported versions:
- On Windows and macOS since 98 or later
Description
Specifies whether print preview should apply last used settings for Microsoft Edge PDF and webpages.
If you set this policy to 'EnableAll' or don't configure it, Microsoft Edge applies the last used print preview settings for both PDF and webpages.
If you set this policy to 'DisableAll', Microsoft Edge doesn't apply the last used print preview settings for both PDF and webpages.
If you set this policy to 'DisablePdf', Microsoft Edge doesn't apply the last used print preview settings for PDF printing and retains it for webpages.
If you set this policy to 'DisableWebpage', Microsoft Edge doesn't apply the last used print preview settings for webpage printing and retain it for PDF.
This policy is only available if you enable or don't configure the PrintingEnabled policy.
Policy options mapping:
EnableAll (0) = Enable sticky settings for PDF and Webpages
DisableAll (1) = Disable sticky settings for PDF and Webpages
DisablePdf (2) = Disable sticky settings for PDF
DisableWebpage (3) = Disable sticky settings for Webpages
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: PrintStickySettings
- GP name: Print preview sticky settings
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Printing
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: PrintStickySettings
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: PrintStickySettings
- Example value:
<integer>1</integer>
PrinterTypeDenyList
Disable printer types on the deny list
Supported versions:
- On Windows and macOS since 88 or later
Description
The printer types on the deny list won't be discovered or have their capabilities fetched.
Placing all printer types on the deny list effectively disables printing, because there's no print destination for documents.
If you don't configure this policy, or the printer list is empty, all printer types are discoverable.
Printer destinations include extension printers and local printers. Extension printers are also known as print provider destinations, and include any destination that belongs to a Microsoft Edge extension. Local printers are also known as native printing destinations, and include destinations available to the local machine and shared network printers.
In Microsoft version 93 or later, if you set this policy to 'pdf' it also disables the 'save as Pdf' option from the right click context menu.
In Microsoft version 103 or later, if you set this policy to 'onedrive' it also disables the 'save as Pdf (OneDrive)' option from print preview.
Policy options mapping:
privet (privet) = Zeroconf-based (mDNS + DNS-SD) protocol destinations
extension (extension) = Extension-based destinations
pdf (pdf) = The 'Save as PDF' destination. (93 or later, also disables from context menu)
local (local) = Local printer destinations
onedrive (onedrive) = Save as PDF (OneDrive) printer destinations. (103 or later)
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: PrinterTypeDenyList
- GP name: Disable printer types on the deny list
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Printing
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\PrinterTypeDenyList
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\PrinterTypeDenyList\1 = "local"
SOFTWARE\Policies\Microsoft\Edge\PrinterTypeDenyList\2 = "privet"
Mac information and settings
- Preference Key Name: PrinterTypeDenyList
- Example value:
<array>
<string>local</string>
<string>privet</string>
</array>
PrintingAllowedBackgroundGraphicsModes
Restrict background graphics printing mode
Supported versions:
- On Windows and macOS since 89 or later
Description
Restricts background graphics printing mode. If this policy isn't set there's no restriction on printing background graphics.
Policy options mapping:
any (any) = Allow printing with and without background graphics
enabled (enabled) = Allow printing only with background graphics
disabled (disabled) = Allow printing only without background graphics
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- String
Windows information and settings
Group Policy (ADMX) info
- GP unique name: PrintingAllowedBackgroundGraphicsModes
- GP name: Restrict background graphics printing mode
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Printing
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: PrintingAllowedBackgroundGraphicsModes
- Value Type: REG_SZ
Example value:
"enabled"
Mac information and settings
- Preference Key Name: PrintingAllowedBackgroundGraphicsModes
- Example value:
<string>enabled</string>
PrintingBackgroundGraphicsDefault
Default background graphics printing mode
Supported versions:
- On Windows and macOS since 89 or later
Description
Overrides the last used setting for printing background graphics. If you enable this setting, background graphics printing is enabled. If you disable this setting, background graphics printing is disabled.
Policy options mapping:
enabled (enabled) = Enable background graphics printing mode by default
disabled (disabled) = Disable background graphics printing mode by default
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- String
Windows information and settings
Group Policy (ADMX) info
- GP unique name: PrintingBackgroundGraphicsDefault
- GP name: Default background graphics printing mode
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Printing
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: PrintingBackgroundGraphicsDefault
- Value Type: REG_SZ
Example value:
"enabled"
Mac information and settings
- Preference Key Name: PrintingBackgroundGraphicsDefault
- Example value:
<string>enabled</string>
PrintingEnabled
Enable printing
Supported versions:
- On Windows and macOS since 77 or later
Description
Enables printing in Microsoft Edge and prevents users from changing this setting.
If you enable this policy or don't configure it, users can print.
If you disable this policy, users can't print from Microsoft Edge. Printing is disabled in the wrench menu, extensions, JavaScript applications, and so on. Users can still print from plug-ins that bypass Microsoft Edge while printing. For example, certain Adobe Flash applications have the print option in their context menu, which isn't covered by this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: PrintingEnabled
- GP name: Enable printing
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Printing
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: PrintingEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: PrintingEnabled
- Example value:
<true/>
PrintingLPACSandboxEnabled
Enable Printing LPAC Sandbox
Supported versions:
- On Windows since 129 or later
Description
Setting this policy to Enabled or leaving it unset enables the LPAC Sandbox for printing services when the system configuration supports it.
Setting this policy to Disabled has a detrimental effect on Microsoft Edge's security because services used for printing might run in a weaker sandbox configuration.
Only turn this policy off if there are compatibility issues with third party software that prevent printing services from operating correctly inside the LPAC Sandbox.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: PrintingLPACSandboxEnabled
- GP name: Enable Printing LPAC Sandbox
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Printing
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: PrintingLPACSandboxEnabled
- Value Type: REG_DWORD
Example value:
0x00000000
PrintingPaperSizeDefault
Default printing page size
Supported versions:
- On Windows and macOS since 86 or later
Description
Overrides default printing page size.
name should contain one of the listed formats or 'custom' if required paper size is not in the list. If 'custom' value is provided custom_size property should be specified. It describes the desired height and width in micrometers. Otherwise custom_size property shouldn't be specified. Policy that violates these rules is ignored.
If the page size is unavailable on the printer chosen by the user this policy is ignored.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Dictionary
Windows information and settings
Group Policy (ADMX) info
- GP unique name: PrintingPaperSizeDefault
- GP name: Default printing page size
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Printing
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: PrintingPaperSizeDefault
- Value Type: REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\PrintingPaperSizeDefault = {
"custom_size": {
"height": 297000,
"width": 210000
},
"name": "custom"
}
Compact example value:
SOFTWARE\Policies\Microsoft\Edge\PrintingPaperSizeDefault = {"custom_size": {"height": 297000, "width": 210000}, "name": "custom"}
Mac information and settings
- Preference Key Name: PrintingPaperSizeDefault
- Example value:
<key>PrintingPaperSizeDefault</key>
<dict>
<key>custom_size</key>
<dict>
<key>height</key>
<integer>297000</integer>
<key>width</key>
<integer>210000</integer>
</dict>
<key>name</key>
<string>custom</string>
</dict>
PrintingWebpageLayout
Sets layout for printing
Supported versions:
- On Windows and macOS since 93 or later
Description
Configuring this policy sets the layout for printing webpages.
If you disable or don't configure this policy, users can decide whether to print webpages in Portrait or Landscape layout.
If you enable this policy, the selected option is set as the layout option.
Policy options mapping:
portrait (0) = Sets layout option as portrait
landscape (1) = Sets layout option as landscape
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: PrintingWebpageLayout
- GP name: Sets layout for printing
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Printing
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Printing
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: PrintingWebpageLayout
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: PrintingWebpageLayout
- Example value:
<integer>0</integer>
UseSystemPrintDialog
Print using system print dialog
Supported versions:
- On Windows and macOS since 77 or later
Description
Shows the system print dialog instead of print preview.
If you enable this policy, Microsoft Edge opens the system print dialog instead of the built-in print preview when a user prints a page.
If you don't configure or disable this policy, print commands trigger the Microsoft Edge print preview screen.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: UseSystemPrintDialog
- GP name: Print using system print dialog
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Printing
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: UseSystemPrintDialog
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: UseSystemPrintDialog
- Example value:
<false/>
Private Network Request Settings policies
InsecurePrivateNetworkRequestsAllowed
Specifies whether to allow websites to make requests to any network endpoint in an insecure manner.
Supported versions:
- On Windows and macOS since 92 or later
Description
Controls whether websites are allowed to make requests to more-private network endpoints.
When this policy is enabled, all Private Network Access checks are disabled for all origins. This may allow attackers to perform cross-site request forgery (CSRF) attacks on private network servers.
When this policy is disabled or not configured, the default behavior for requests to more-private network endpoints will depend on the user's personal configuration for the BlockInsecurePrivateNetworkRequests, PrivateNetworkAccessSendPreflights, and PrivateNetworkAccessRespectPreflightResults feature flags. These flags may be controlled by experimentation or set via the command line.
This policy relates to the Private Network Access specification. See https://wicg.github.io/private-network-access/ for more details.
A network endpoint is more private than another if:
- Its IP address is localhost and the other is not.
- Its IP address is private and the other is public. In the future, depending on spec evolution, this policy might apply to all cross-origin requests directed at private IPs or localhost.
When this policy enabled, websites are allowed to make requests to any network endpoint, subject to other cross-origin checks.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: InsecurePrivateNetworkRequestsAllowed
- GP name: Specifies whether to allow websites to make requests to any network endpoint in an insecure manner.
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Private Network Request Settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: InsecurePrivateNetworkRequestsAllowed
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: InsecurePrivateNetworkRequestsAllowed
- Example value:
<false/>
InsecurePrivateNetworkRequestsAllowedForUrls
Allow the listed sites to make requests to more-private network endpoints from in an insecure manner
Supported versions:
- On Windows and macOS since 92 or later
Description
List of URL patterns. Requests initiated from websites served by matching origins are not subject to Private Network Access checks.
If this policy is not set, this policy behaves as if set to the empty list.
For origins not covered by the patterns specified here, the global default value will be used either from the InsecurePrivateNetworkRequestsAllowed policy, if it is set, or the user's personal configuration otherwise.
For detailed information on valid URL patterns, see Filter format for URL list-based policies.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: InsecurePrivateNetworkRequestsAllowedForUrls
- GP name: Allow the listed sites to make requests to more-private network endpoints from in an insecure manner
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Private Network Request Settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\InsecurePrivateNetworkRequestsAllowedForUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\InsecurePrivateNetworkRequestsAllowedForUrls\1 = "http://www.example.com:8080"
SOFTWARE\Policies\Microsoft\Edge\InsecurePrivateNetworkRequestsAllowedForUrls\2 = "[*.]example.edu"
Mac information and settings
- Preference Key Name: InsecurePrivateNetworkRequestsAllowedForUrls
- Example value:
<array>
<string>http://www.example.com:8080</string>
<string>[*.]example.edu</string>
</array>
PrivateNetworkAccessRestrictionsEnabled
Specifies whether to apply restrictions to requests to more private network endpoints
Supported versions:
- On Windows and macOS since 131 or later
Description
Specifies whether to apply restrictions to requests to more private network endpoints
When this policy is Enabled, any time when a warning is supposed to be displayed in the DevTools due to Private Network Access checks failing, the request is blocked.
When this policy is Disabled or unset, all Private Network Access warnings are not enforced and the requests are not blocked.
See https://wicg.github.io/private-network-access/ for Private Network Access restrictions.
Note: A network endpoint is more private than another if:
- Its IP address is localhost and the other is not.
- Its IP address is private and the other is public.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: PrivateNetworkAccessRestrictionsEnabled
- GP name: Specifies whether to apply restrictions to requests to more private network endpoints
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Private Network Request Settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: PrivateNetworkAccessRestrictionsEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: PrivateNetworkAccessRestrictionsEnabled
- Example value:
<true/>
Proxy server policies
ProxyBypassList
Configure proxy bypass rules (deprecated)
DEPRECATED: This policy is deprecated. It is currently supported but will become obsolete in a future release.
Supported versions:
- On Windows and macOS since 77 or later
Description
This policy is deprecated, use ProxySettings instead. It won't work in Microsoft Edge version 91.
Defines a list of hosts for which Microsoft Edge bypasses any proxy.
This policy is applied only if the ProxySettings policy isn't specified and you have selected either fixed_servers or pac_script in the ProxyMode policy. If you selected any other mode for configuring proxy policies, don't enable or configure this policy.
If you enable this policy, you can create a list of hosts for which Microsoft Edge doesn't use a proxy.
If you don't configure this policy, no list of hosts is created for which Microsoft Edge bypasses a proxy. Leave this policy unconfigured if you've specified any other method for setting proxy policies.
For more detailed examples go to https://go.microsoft.com/fwlink/?linkid=2094936.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- String
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ProxyBypassList
- GP name: Configure proxy bypass rules (deprecated)
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Proxy server
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: ProxyBypassList
- Value Type: REG_SZ
Example value:
"https://www.contoso.com, https://www.fabrikam.com"
Mac information and settings
- Preference Key Name: ProxyBypassList
- Example value:
<string>https://www.contoso.com, https://www.fabrikam.com</string>
ProxyMode
Configure proxy server settings (deprecated)
DEPRECATED: This policy is deprecated. It is currently supported but will become obsolete in a future release.
Supported versions:
- On Windows and macOS since 77 or later
Description
This policy is deprecated, use ProxySettings instead. It won't work in Microsoft Edge version 91.
If you set this policy to Enabled you can specify the proxy server Microsoft Edge uses and prevents users from changing proxy settings. Microsoft Edge ignores all proxy-related options specified from the command line. The policy is only applied if the ProxySettings policy isn't specified.
Other options are ignored if you choose one of the following options:
- direct = Never use a proxy server and always connect directly
- system = Use system proxy settings
- auto_detect = Auto detect the proxy server
If you choose to use:
- fixed_servers = Fixed proxy servers. You can specify further options with ProxyServer and ProxyBypassList.
- pac_script = A .pac proxy script. Use ProxyPacUrl to set the URL to a proxy .pac file.
For detailed examples, go to https://go.microsoft.com/fwlink/?linkid=2094936.
If you don't configure this policy, users can choose their own proxy settings.
Policy options mapping:
ProxyDisabled (direct) = Never use a proxy
ProxyAutoDetect (auto_detect) = Auto detect proxy settings
ProxyPacScript (pac_script) = Use a .pac proxy script
ProxyFixedServers (fixed_servers) = Use fixed proxy servers
ProxyUseSystem (system) = Use system proxy settings
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- String
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ProxyMode
- GP name: Configure proxy server settings (deprecated)
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Proxy server
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: ProxyMode
- Value Type: REG_SZ
Example value:
"direct"
Mac information and settings
- Preference Key Name: ProxyMode
- Example value:
<string>direct</string>
ProxyPacUrl
Set the proxy .pac file URL (deprecated)
DEPRECATED: This policy is deprecated. It is currently supported but will become obsolete in a future release.
Supported versions:
- On Windows and macOS since 77 or later
Description
This policy is deprecated, use ProxySettings instead. It won't work in Microsoft Edge version 91.
Specifies the URL for a proxy auto-config (PAC) file.
This policy is applied only if the ProxySettings policy isn't specified and you have selected pac_script in the ProxyMode policy. If you selected any other mode for configuring proxy policies, don't enable or configure this policy.
If you enable this policy, you can specify the URL for a PAC file, which defines how the browser automatically chooses the appropriate proxy server for fetching a particular website.
If you disable or don't configure this policy, no PAC file is specified. Leave this policy unconfigured if you've specified any other method for setting proxy policies.
For detailed examples, see https://go.microsoft.com/fwlink/?linkid=2094936.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- String
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ProxyPacUrl
- GP name: Set the proxy .pac file URL (deprecated)
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Proxy server
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: ProxyPacUrl
- Value Type: REG_SZ
Example value:
"https://internal.contoso.com/example.pac"
Mac information and settings
- Preference Key Name: ProxyPacUrl
- Example value:
<string>https://internal.contoso.com/example.pac</string>
ProxyServer
Configure address or URL of proxy server (deprecated)
DEPRECATED: This policy is deprecated. It is currently supported but will become obsolete in a future release.
Supported versions:
- On Windows and macOS since 77 or later
Description
This policy is deprecated, use ProxySettings instead. It won't work in Microsoft Edge version 91.
Specifies the URL of the proxy server.
This policy is applied only if the ProxySettings policy isn't specified and you have selected fixed_servers in the ProxyMode policy. If you selected any other mode for configuring proxy policies, don't enable or configure this policy.
If you enable this policy, the proxy server configured by this policy will be used for all URLs.
If you disable or don't configure this policy, users can choose their own proxy settings while in this proxy mode. Leave this policy unconfigured if you've specified any other method for setting proxy policies.
For more options and detailed examples, see https://go.microsoft.com/fwlink/?linkid=2094936.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- String
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ProxyServer
- GP name: Configure address or URL of proxy server (deprecated)
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Proxy server
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: ProxyServer
- Value Type: REG_SZ
Example value:
"123.123.123.123:8080"
Mac information and settings
- Preference Key Name: ProxyServer
- Example value:
<string>123.123.123.123:8080</string>
ProxySettings
Proxy settings
Supported versions:
- On Windows and macOS since 77 or later
Description
Configures the proxy settings for Microsoft Edge.
If you enable this policy, Microsoft Edge ignores all proxy-related options specified from the command line.
If you don't configure this policy, users can choose their own proxy settings.
This policy overrides the following individual policies: ProxyMode ProxyPacUrl ProxyServer ProxyBypassList
Setting the ProxySettings policy accepts the following fields:
- ProxyMode, which lets you specify the proxy server used by Microsoft Edge and prevents users from changing proxy settings
- ProxyPacUrl, a URL to a proxy .pac file, or a PAC script encoded as a data URL with MIME type application/x-ns-proxy-autoconfig
- ProxyPacMandatory, a boolean flag which prevents the network stack from falling back to direct connections with invalid or unavailable PAC script
- ProxyServer, a URL for the proxy server
- ProxyBypassList, a list of proxy hosts that Microsoft Edge bypasses
For ProxyMode, if you choose the value:
- direct, a proxy is never used and all other fields are ignored.
- system, the systems's proxy is used and all other fields are ignored.
- auto_detect, all other fields are ignored.
- fixed_servers, the ProxyServer and ProxyBypassList fields are used.
- pac_script, the ProxyPacUrl, ProxyPacMandatory and ProxyBypassList fields are used.
For more detailed examples go to https://go.microsoft.com/fwlink/?linkid=2094936.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Dictionary
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ProxySettings
- GP name: Proxy settings
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Proxy server
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: ProxySettings
- Value Type: REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\ProxySettings = {
"ProxyBypassList": "https://www.example1.com,https://www.example2.com,https://internalsite/",
"ProxyMode": "pac_script",
"ProxyPacMandatory": false,
"ProxyPacUrl": "https://internal.site/example.pac",
"ProxyServer": "123.123.123.123:8080"
}
Compact example value:
SOFTWARE\Policies\Microsoft\Edge\ProxySettings = {"ProxyBypassList": "https://www.example1.com,https://www.example2.com,https://internalsite/", "ProxyMode": "pac_script", "ProxyPacMandatory": false, "ProxyPacUrl": "https://internal.site/example.pac", "ProxyServer": "123.123.123.123:8080"}
Mac information and settings
- Preference Key Name: ProxySettings
- Example value:
<key>ProxySettings</key>
<dict>
<key>ProxyBypassList</key>
<string>https://www.example1.com,https://www.example2.com,https://internalsite/</string>
<key>ProxyMode</key>
<string>pac_script</string>
<key>ProxyPacMandatory</key>
<false/>
<key>ProxyPacUrl</key>
<string>https://internal.site/example.pac</string>
<key>ProxyServer</key>
<string>123.123.123.123:8080</string>
</dict>
Related Website Sets Settings policies
RelatedWebsiteSetsEnabled
Enable Related Website Sets
Supported versions:
- On Windows and macOS since 121 or later
Description
This policy lets you control the enablement of the Related Website Sets feature. Related Website Sets (RWS) is a way for an organisation to declare relationships among sites, so that Microsoft Edge allows limited third-party cookie access for specific purposes across those sites.
If this policy set to True or unset, the Related Website Sets feature is enabled.
If this policy is set to False, the Related Website Sets feature is disabled.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: RelatedWebsiteSetsEnabled
- GP name: Enable Related Website Sets
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Related Website Sets Settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: RelatedWebsiteSetsEnabled
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: RelatedWebsiteSetsEnabled
- Example value:
<false/>
RelatedWebsiteSetsOverrides
Override Related Website Sets.
Supported versions:
- On Windows and macOS since 121 or later
Description
This policy provides a way to override the list of sets Microsoft Edge uses for Related Website Sets
Each set in the browser's list of Related Website Sets must meet the requirements of a Related Website Set. A Related Website Set must contain a primary site and one or more member sites. A set can also contain a list of service sites that it owns, as well as a map from a site to all its ccTLD variants. See https://github.com/WICG/first-party-sets for more information on how Microsoft Edge uses Related Website Sets.
All sites in a Related Website Set must be a registrable domain served over HTTPS. Each site in a Related Website Set must also be unique, which means a site can't be listed more than once in a Related Website Set.
When this policy is given an empty dictionary, Microsoft Edge uses the public list of Related Website Sets.
For all sites in a Related Website Set from the replacements list, if a site is also present on a Related Website Set in the browser's list, then that site will be removed from the browser's Related Website Set. After this, the policy's Related Website Set will be added to the Microsoft Edge's list of Related Website Sets.
For all sites in a Related Website Set from the additions list, if a site is also present on a Related Website Set in Microsoft Edge's list, then the browser's Related Website Set will be updated so that the new Related Website Set can be added to the browser's list. After the browser's list has been updated, the policy's Related Website Set will be added to the browser's list of Related Website Sets.
The browser's list of Related Website Sets requires that for all sites in its list, no site is in more than one set. This is also required for both the replacements list and the additions list. Similarly, a site can't be in both the replacements list and the additions list.
Wildcards (*) aren't supported as a policy value, or as a value within any Related Website Set in these lists.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Dictionary
Windows information and settings
Group Policy (ADMX) info
- GP unique name: RelatedWebsiteSetsOverrides
- GP name: Override Related Website Sets.
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Related Website Sets Settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: RelatedWebsiteSetsOverrides
- Value Type: REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\RelatedWebsiteSetsOverrides = {
"additions": [
{
"associatedSites": [
"https://associate2.test"
],
"ccTLDs": {
"https://associate2.test": [
"https://associate2.com"
]
},
"primary": "https://primary2.test",
"serviceSites": [
"https://associate2-content.test"
]
}
],
"replacements": [
{
"associatedSites": [
"https://associate1.test"
],
"ccTLDs": {
"https://associate1.test": [
"https://associate1.co.uk"
]
},
"primary": "https://primary1.test",
"serviceSites": [
"https://associate1-content.test"
]
}
]
}
Compact example value:
SOFTWARE\Policies\Microsoft\Edge\RelatedWebsiteSetsOverrides = {"additions": [{"associatedSites": ["https://associate2.test"], "ccTLDs": {"https://associate2.test": ["https://associate2.com"]}, "primary": "https://primary2.test", "serviceSites": ["https://associate2-content.test"]}], "replacements": [{"associatedSites": ["https://associate1.test"], "ccTLDs": {"https://associate1.test": ["https://associate1.co.uk"]}, "primary": "https://primary1.test", "serviceSites": ["https://associate1-content.test"]}]}
Mac information and settings
- Preference Key Name: RelatedWebsiteSetsOverrides
- Example value:
<key>RelatedWebsiteSetsOverrides</key>
<dict>
<key>additions</key>
<array>
<dict>
<key>associatedSites</key>
<array>
<string>https://associate2.test</string>
</array>
<key>ccTLDs</key>
<dict>
<key>https://associate2.test</key>
<array>
<string>https://associate2.com</string>
</array>
</dict>
<key>primary</key>
<string>https://primary2.test</string>
<key>serviceSites</key>
<array>
<string>https://associate2-content.test</string>
</array>
</dict>
</array>
<key>replacements</key>
<array>
<dict>
<key>associatedSites</key>
<array>
<string>https://associate1.test</string>
</array>
<key>ccTLDs</key>
<dict>
<key>https://associate1.test</key>
<array>
<string>https://associate1.co.uk</string>
</array>
</dict>
<key>primary</key>
<string>https://primary1.test</string>
<key>serviceSites</key>
<array>
<string>https://associate1-content.test</string>
</array>
</dict>
</array>
</dict>
Sleeping tabs settings policies
AutoDiscardSleepingTabsEnabled
Configure auto discard sleeping tabs
Supported versions:
- On Windows and macOS since 120 or later
Description
Setting this policy enables inactive (sleeping) tabs to be automatically discarded after 1.5 days of inactivity. This is done to save memory. When the user switches back to a discarded tab, the tab will need to be reloaded.
If the SleepingTabsEnabled policy is enabled, then this feature will be enabled by default.
If the SleepingTabsEnabled is disabled, then this feature will be disabled by default and cannot be enabled.
If enabled, idle background tabs will be discarded after 1.5 days.
If disabled, idle background tab will not be discarded after 1.5 days. Tabs can still be discarded for other reasons if this policy is disabled.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AutoDiscardSleepingTabsEnabled
- GP name: Configure auto discard sleeping tabs
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Sleeping tabs settings
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Sleeping tabs settings
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: AutoDiscardSleepingTabsEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: AutoDiscardSleepingTabsEnabled
- Example value:
<true/>
SleepingTabsBlockedForUrls
Block sleeping tabs on specific sites
Supported versions:
- On Windows and macOS since 88 or later
Description
Define a list of sites, based on URL patterns, that are not allowed to be put to sleep by sleeping tabs. Sites in this list are also excluded from other performance optimizations like efficiency mode and tab discard.
If the policy SleepingTabsEnabled is disabled, this list is not used and no sites will be put to sleep automatically.
If you don't configure this policy, all sites will be eligible to be put to sleep unless the user's personal configuration blocks them.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: SleepingTabsBlockedForUrls
- GP name: Block sleeping tabs on specific sites
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Sleeping tabs settings
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Sleeping tabs settings
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\SleepingTabsBlockedForUrls
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended\SleepingTabsBlockedForUrls
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\SleepingTabsBlockedForUrls\1 = "https://www.contoso.com"
SOFTWARE\Policies\Microsoft\Edge\SleepingTabsBlockedForUrls\2 = "[*.]contoso.edu"
Mac information and settings
- Preference Key Name: SleepingTabsBlockedForUrls
- Example value:
<array>
<string>https://www.contoso.com</string>
<string>[*.]contoso.edu</string>
</array>
SleepingTabsEnabled
Configure sleeping tabs
Supported versions:
- On Windows and macOS since 88 or later
Description
This policy setting lets you configure whether to turn on sleeping tabs. Sleeping tabs reduces CPU, battery, and memory usage by putting idle background tabs to sleep. Microsoft Edge uses heuristics to avoid putting tabs to sleep that do useful work in the background, such as display notifications, play sound, and stream video. By default, sleeping tabs is turned on.
Individual sites may be blocked from being put to sleep by configuring the policy SleepingTabsBlockedForUrls.
If you enable this setting, sleeping tabs is turned on.
If you disable this setting, sleeping tabs is turned off.
If you don't configure this setting, users can choose whether to use sleeping tabs.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: SleepingTabsEnabled
- GP name: Configure sleeping tabs
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Sleeping tabs settings
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Sleeping tabs settings
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: SleepingTabsEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: SleepingTabsEnabled
- Example value:
<true/>
SleepingTabsTimeout
Set the background tab inactivity timeout for sleeping tabs
Supported versions:
- On Windows and macOS since 88 or later
Description
This policy setting lets you configure the timeout, in seconds, after which inactive background tabs will be automatically put to sleep if sleeping tabs is enabled. By default, this timeout is 7,200 seconds (2 hours).
Tabs are only put to sleep automatically when the policy SleepingTabsEnabled is enabled or is not configured and the user has enabled the sleeping tabs setting.
If you don't configure this policy, users can choose the timeout value.
Policy options mapping:
30Seconds (30) = 30 seconds of inactivity
5Minutes (300) = 5 minutes of inactivity
15Minutes (900) = 15 minutes of inactivity
30Minutes (1800) = 30 minutes of inactivity
1Hour (3600) = 1 hour of inactivity
2Hours (7200) = 2 hours of inactivity
3Hours (10800) = 3 hours of inactivity
6Hours (21600) = 6 hours of inactivity
12Hours (43200) = 12 hours of inactivity
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: SleepingTabsTimeout
- GP name: Set the background tab inactivity timeout for sleeping tabs
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Sleeping tabs settings
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Sleeping tabs settings
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: SleepingTabsTimeout
- Value Type: REG_DWORD
Example value:
0x00000384
Mac information and settings
- Preference Key Name: SleepingTabsTimeout
- Example value:
<integer>900</integer>
SmartScreen settings policies
ExemptSmartScreenDownloadWarnings
Disable SmartScreen AppRep based warnings for specified file types on specified domains
Supported versions:
- On Windows since 118 or later
Description
You can enable this policy to create a dictionary of file type extensions with a corresponding list of domains that will be exempted from SmartScreen AppRep warnings. For example, if the "vbe" extension is associated with "website1.com", users would not see a SmartScreen AppRep warning when downloading "vbe" files from "website1.com", but may see a download warning when downloading "vbe" files from "website2.com".
Files with file type extensions specified for domains identified by this policy will still be subject to file type extension-based security warnings and mixed-content download warnings.
If you disable this policy or don't configure it, files that trigger SmartScreen AppRep download warnings will show warnings to the user.
If you enable this policy:
- The URL pattern should be formatted according to https://go.microsoft.com/fwlink/?linkid=2095322.
- The file type extension entered must be in lower-cased ASCII. The leading separator should not be included when listing the file type extension, so "vbe" should be used instead of ".vbe".
Example:
The following example value would prevent SmartScreen AppRep warnings on msi, exe, and vbe extensions for *.contoso.com domains. It may show the user a SmartScreen AppRep warning on any other domain for exe and msi files, but not for vbe files.
[ { "file_extension": "msi", "domains": ["contoso.com"] }, { "file_extension": "exe", "domains": ["contoso.com"] }, { "file_extension": "vbe", "domains": ["*"] } ]
Note that while the preceding example shows the suppression of SmartScreen AppRep download warnings for "vbe" files for all domains, applying suppression of such warnings for all domains is not recommended due to security concerns. It is shown in the example merely to demonstrate the ability to do so.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Dictionary
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ExemptSmartScreenDownloadWarnings
- GP name: Disable SmartScreen AppRep based warnings for specified file types on specified domains
- GP path (Mandatory): Administrative Templates/Microsoft Edge/SmartScreen settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: ExemptSmartScreenDownloadWarnings
- Value Type: REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\ExemptSmartScreenDownloadWarnings = [
{
"domains": [
"https://contoso.com",
"contoso2.com"
],
"file_extension": "msi"
},
{
"domains": [
"*"
],
"file_extension": "vbe"
}
]
Compact example value:
SOFTWARE\Policies\Microsoft\Edge\ExemptSmartScreenDownloadWarnings = [{"domains": ["https://contoso.com", "contoso2.com"], "file_extension": "msi"}, {"domains": ["*"], "file_extension": "vbe"}]
NewSmartScreenLibraryEnabled
Enable new SmartScreen library (obsolete)
OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 107.
Supported versions:
- On Windows and macOS since 95, until 107
Description
This policy doesn't work because it was only intended to be a short-term mechanism to support the update to a new SmartScreen client.
Allows the Microsoft Edge browser to load the new SmartScreen library (libSmartScreenN) for any SmartScreen checks on site URLs or application downloads.
If you enable or don't configure this policy, Microsoft Edge will use the new SmartScreen library (libSmartScreenN).
If you disable this policy, Microsoft Edge will use the old SmartScreen library (libSmartScreen).
Before Microsoft Edge version 103, if you don't configure this policy, Microsoft Edge will use the old SmartScreen library (libSmartScreen).
This policy is only available on Windows instances that are joined to a Microsoft Active Directory domain, Windows 10 Pro or Enterprise instances that enrolled for device management. This also includes macOS instances that are that are managed via MDM or joined to a domain via MCX.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: NewSmartScreenLibraryEnabled
- GP name: Enable new SmartScreen library (obsolete)
- GP path (Mandatory): Administrative Templates/Microsoft Edge/SmartScreen settings
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/SmartScreen settings
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: NewSmartScreenLibraryEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: NewSmartScreenLibraryEnabled
- Example value:
<true/>
PreventSmartScreenPromptOverride
Prevent bypassing Microsoft Defender SmartScreen prompts for sites
Supported versions:
- On Windows and macOS since 77 or later
Description
This policy setting lets you decide whether users can override the Microsoft Defender SmartScreen warnings about potentially malicious websites.
If you enable this setting, users can't ignore Microsoft Defender SmartScreen warnings and they are blocked from continuing to the site.
If you disable or don't configure this setting, users can ignore Microsoft Defender SmartScreen warnings and continue to the site.
This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, Windows 10 Pro or Enterprise instances that enrolled for device management, or macOS instances that are that are managed via MDM or joined to a domain via MCX.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: PreventSmartScreenPromptOverride
- GP name: Prevent bypassing Microsoft Defender SmartScreen prompts for sites
- GP path (Mandatory): Administrative Templates/Microsoft Edge/SmartScreen settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: PreventSmartScreenPromptOverride
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: PreventSmartScreenPromptOverride
- Example value:
<true/>
PreventSmartScreenPromptOverrideForFiles
Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads
Supported versions:
- On Windows since 77 or later
- On macOS since 79 or later
Description
This policy lets you determine whether users can override Microsoft Defender SmartScreen warnings about unverified downloads.
If you enable this policy, users in your organization can't ignore Microsoft Defender SmartScreen warnings, and they're prevented from completing the unverified downloads.
If you disable or don't configure this policy, users can ignore Microsoft Defender SmartScreen warnings and complete unverified downloads.
This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, Windows 10 Pro or Enterprise instances that enrolled for device management, or macOS instances that are that are managed via MDM or joined to a domain via MCX.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: PreventSmartScreenPromptOverrideForFiles
- GP name: Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads
- GP path (Mandatory): Administrative Templates/Microsoft Edge/SmartScreen settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: PreventSmartScreenPromptOverrideForFiles
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: PreventSmartScreenPromptOverrideForFiles
- Example value:
<true/>
SmartScreenAllowListDomains
Configure the list of domains for which Microsoft Defender SmartScreen won't trigger warnings
Supported versions:
- On Windows and macOS since 77 or later
Description
Configure the list of Microsoft Defender SmartScreen trusted domains. This means: Microsoft Defender SmartScreen won't check for potentially malicious resources like phishing software and other malware if the source URLs match these domains. The Microsoft Defender SmartScreen download protection service won't check downloads hosted on these domains.
If you enable this policy, Microsoft Defender SmartScreen trusts these domains. If you disable or don't set this policy, default Microsoft Defender SmartScreen protection is applied to all resources.
This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, Windows 10/11 Pro or Enterprise instances that enrolled for device management, or macOS instances that are that are managed via MDM or joined to a domain via MCX. Note: If your organization has enabled Microsoft Defender for Endpoint, this policy and any allow list created with it will be ignored. You must configure your allow and block lists in Microsoft 365 Defender portal using Indicators (Settings > Endpoints > Indicators).
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: SmartScreenAllowListDomains
- GP name: Configure the list of domains for which Microsoft Defender SmartScreen won't trigger warnings
- GP path (Mandatory): Administrative Templates/Microsoft Edge/SmartScreen settings
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\SmartScreenAllowListDomains
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\SmartScreenAllowListDomains\1 = "mydomain.com"
SOFTWARE\Policies\Microsoft\Edge\SmartScreenAllowListDomains\2 = "myuniversity.edu"
Mac information and settings
- Preference Key Name: SmartScreenAllowListDomains
- Example value:
<array>
<string>mydomain.com</string>
<string>myuniversity.edu</string>
</array>
SmartScreenDnsRequestsEnabled
Enable Microsoft Defender SmartScreen DNS requests
Supported versions:
- On Windows and macOS since 97 or later
Description
This policy lets you configure whether to enable DNS requests made by Microsoft Defender SmartScreen. Note: Disabling DNS requests will prevent Microsoft Defender SmartScreen from getting IP addresses, and potentially impact the IP-based protections provided.
If you enable or don't configure this setting, Microsoft Defender SmartScreen will make DNS requests.
If you disable this setting, Microsoft Defender SmartScreen will not make any DNS requests.
This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, Windows 10 Pro or Enterprise instances that enrolled for device management, or macOS instances that are that are managed via MDM or joined to a domain via MCX.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: SmartScreenDnsRequestsEnabled
- GP name: Enable Microsoft Defender SmartScreen DNS requests
- GP path (Mandatory): Administrative Templates/Microsoft Edge/SmartScreen settings
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/SmartScreen settings
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: SmartScreenDnsRequestsEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: SmartScreenDnsRequestsEnabled
- Example value:
<true/>
SmartScreenEnabled
Configure Microsoft Defender SmartScreen
Supported versions:
- On Windows and macOS since 77 or later
Description
This policy setting lets you configure whether to turn on Microsoft Defender SmartScreen. Microsoft Defender SmartScreen provides warning messages to help protect your users from potential phishing scams and malicious software. By default, Microsoft Defender SmartScreen is turned on.
If you enable this setting, Microsoft Defender SmartScreen is turned on.
If you disable this setting, Microsoft Defender SmartScreen is turned off.
If you don't configure this setting, users can choose whether to use Microsoft Defender SmartScreen.
This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, Windows 10 Pro or Enterprise instances that enrolled for device management, or macOS instances that are that are managed via MDM or joined to a domain via MCX.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: SmartScreenEnabled
- GP name: Configure Microsoft Defender SmartScreen
- GP path (Mandatory): Administrative Templates/Microsoft Edge/SmartScreen settings
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/SmartScreen settings
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: SmartScreenEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: SmartScreenEnabled
- Example value:
<true/>
SmartScreenForTrustedDownloadsEnabled
Force Microsoft Defender SmartScreen checks on downloads from trusted sources
Supported versions:
- On Windows since 78 or later
Description
This policy setting lets you configure whether Microsoft Defender SmartScreen checks download reputation from a trusted source.
In Windows, the policy determines a trusted source by checking its Internet zone. If the source comes from the local system, intranet, or trusted sites zone, then the download is considered trusted and safe.
If you enable or don't configure this setting, Microsoft Defender SmartScreen checks the download's reputation regardless of source.
If you disable this setting, Microsoft Defender SmartScreen doesn't check the download's reputation when downloading from a trusted source.
This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, Windows 10 Pro or Enterprise instances that enrolled for device management.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: SmartScreenForTrustedDownloadsEnabled
- GP name: Force Microsoft Defender SmartScreen checks on downloads from trusted sources
- GP path (Mandatory): Administrative Templates/Microsoft Edge/SmartScreen settings
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/SmartScreen settings
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: SmartScreenForTrustedDownloadsEnabled
- Value Type: REG_DWORD
Example value:
0x00000000
SmartScreenPuaEnabled
Configure Microsoft Defender SmartScreen to block potentially unwanted apps
Supported versions:
- On Windows and macOS since 80 or later
Description
This policy setting lets you configure whether to turn on blocking for potentially unwanted apps with Microsoft Defender SmartScreen. Potentially unwanted app blocking with Microsoft Defender SmartScreen provides warning messages to help protect users from adware, coin miners, bundleware, and other low-reputation apps that are hosted by websites. Potentially unwanted app blocking with Microsoft Defender SmartScreen is turned off by default.
If you enable this setting, potentially unwanted app blocking with Microsoft Defender SmartScreen is turned on.
If you disable this setting, potentially unwanted app blocking with Microsoft Defender SmartScreen is turned off.
If you don't configure this setting, users can choose whether to use potentially unwanted app blocking with Microsoft Defender SmartScreen.
This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, Windows 10 Pro or Enterprise instances that enrolled for device management, or macOS instances that are that are managed via MDM or joined to a domain via MCX.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: SmartScreenPuaEnabled
- GP name: Configure Microsoft Defender SmartScreen to block potentially unwanted apps
- GP path (Mandatory): Administrative Templates/Microsoft Edge/SmartScreen settings
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/SmartScreen settings
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: SmartScreenPuaEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: SmartScreenPuaEnabled
- Example value:
<true/>
Startup, home page and new tab page policies
HomepageIsNewTabPage
Set the new tab page as the home page
Supported versions:
- On Windows and macOS since 77 or later
Description
Configures the default home page in Microsoft Edge. You can set the home page to a URL you specify or to the new tab page.
If you enable this policy, the Home button is set to the new tab page as configured by the user or with the policy NewTabPageLocation and the URL set with the policy HomepageLocation is not taken into consideration.
If you disable this policy, the Home button is the set URL as configured by the user or as configured in the policy HomepageLocation.
If you don't configure this policy, users can choose whether the set URL or the new tab page is their home page.
This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, joined to Microsoft Azure Active Directory, or instances that enrolled for device management. On macOS, this policy is available only on instances that are managed via MDM or joined to a domain via MCX.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: HomepageIsNewTabPage
- GP name: Set the new tab page as the home page
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Startup, home page and new tab page
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Startup, home page and new tab page
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: HomepageIsNewTabPage
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: HomepageIsNewTabPage
- Example value:
<true/>
HomepageLocation
Configure the home page URL
Supported versions:
- On Windows and macOS since 77 or later
Description
Configures the default home page URL in Microsoft Edge.
The home page is the page opened by the Home button. The pages that open on startup are controlled by the RestoreOnStartup policies.
You can either set a URL here or set the home page to open the new tab page 'edge://newtab'. By default, the Home button will open the new tab page (as configured by the user or with the policy NewTabPageLocation), and the user will be able to choose between the URL configured by this policy and the new tab page.
If you enable this policy, users can't change their home page URL, but they can choose the behavior for the Home button to open either the set URL or the new tab page. If you wish to enforce the usage of the set URL you must also configure HomepageIsNewTabPage=Disabled.
If you disable or don't configure this policy, users can choose their own home page, as long as the HomepageIsNewTabPage policy isn't enabled.
This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, joined to Microsoft Azure Active Directory, or instances that enrolled for device management. On macOS, this policy is available only on instances that are managed via MDM or joined to a domain via MCX.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- String
Windows information and settings
Group Policy (ADMX) info
- GP unique name: HomepageLocation
- GP name: Configure the home page URL
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Startup, home page and new tab page
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Startup, home page and new tab page
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: HomepageLocation
- Value Type: REG_SZ
Example value:
"https://www.contoso.com"
Mac information and settings
- Preference Key Name: HomepageLocation
- Example value:
<string>https://www.contoso.com</string>
NewTabPageAllowedBackgroundTypes
Configure the background types allowed for the new tab page layout
Supported versions:
- On Windows and macOS since 86 or later
Description
You can configure which types of background image that are allowed on the new tab page layout in Microsoft Edge.
If you don't configure this policy, all background image types on the new tab page are enabled.
Policy options mapping:
DisableImageOfTheDay (1) = Disable daily background image type
DisableCustomImage (2) = Disable custom background image type
DisableAll (3) = Disable all background image types
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: NewTabPageAllowedBackgroundTypes
- GP name: Configure the background types allowed for the new tab page layout
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Startup, home page and new tab page
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: NewTabPageAllowedBackgroundTypes
- Value Type: REG_DWORD
Example value:
0x00000002
Mac information and settings
- Preference Key Name: NewTabPageAllowedBackgroundTypes
- Example value:
<integer>2</integer>
NewTabPageAppLauncherEnabled
Hide App Launcher on Microsoft Edge new tab page
Supported versions:
- On Windows and macOS since 108 or later
Description
By default, the App Launcher is shown every time a user opens a new tab page.
If you enable or don't configure this policy, there is no change on the Microsoft Edge new tab page and App Launcher is there for users.
If you disable this policy, App Launcher doesn't appear and users won't be able to launch M365 apps from Microsoft Edge new tab page via the App Launcher.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: NewTabPageAppLauncherEnabled
- GP name: Hide App Launcher on Microsoft Edge new tab page
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Startup, home page and new tab page
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: NewTabPageAppLauncherEnabled
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: NewTabPageAppLauncherEnabled
- Example value:
<false/>
NewTabPageBingChatEnabled
Disable Bing chat entry-points on Microsoft Edge Enterprise new tab page
Supported versions:
- On Windows and macOS since 117 or later
Description
By default, there are two Bing chat entry-points on new tab page. One is inside the new tab page search box, and one is in the Bing Autosuggest drawer on-click.
If you enable or don't configure this policy, there is no change on the Microsoft Edge Enterprise new tab page and the Bing chat entry-points are there for users.
If you disable this policy, Bing chat entry-points don't appear on the new tab page.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: NewTabPageBingChatEnabled
- GP name: Disable Bing chat entry-points on Microsoft Edge Enterprise new tab page
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Startup, home page and new tab page
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: NewTabPageBingChatEnabled
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: NewTabPageBingChatEnabled
- Example value:
<false/>
NewTabPageCompanyLogo
Set new tab page company logo (obsolete)
OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 85.
Supported versions:
- On Windows and macOS since 79, until 85
Description
This policy didn't work as expected due to changes in operational requirements. Therefore it's obsolete and should not be used.
Specifies the company logo to use on the new tab page in Microsoft Edge.
The policy should be configured as a string that expresses the logo(s) in JSON format. For example: { "default_logo": { "url": "https://www.contoso.com/logo.png", "hash": "cd0aa9856147b6c5b4ff2b7dfee5da20aa38253099ef1b4a64aced233c9afe29" }, "light_logo": { "url": "https://www.contoso.com/light_logo.png", "hash": "517d286edb416bb2625ccfcba9de78296e90da8e32330d4c9c8275c4c1c33737" } }
You configure this policy by specifying the URL from which Microsoft Edge can download the logo and its cryptographic hash (SHA-256), which is used to verify the integrity of the download. The logo must be in PNG or SVG format, and its file size must not exceed 16 MB. The logo is downloaded and cached, and it will be redownloaded whenever the URL or the hash changes. The URL must be accessible without any authentication.
The 'default_logo' is required and will be used when there's no background image. If 'light_logo' is provided, it will be used when the user's new tab page has a background image. We recommend a horizontal logo with a transparent background that is left-aligned and vertically centered. The logo should have a minimum height of 32 pixels and an aspect ratio from 1:1 to 4:1. The 'default_logo' should have proper contrast against a white/black background while the 'light_logo' should have proper contrast against a background image.
If you enable this policy, Microsoft Edge downloads and shows the specified logo(s) on the new tab page. Users can't override or hide the logo(s).
If you disable or don't configure this policy, Microsoft Edge will show no company logo or a Microsoft logo on the new tab page.
For help with determining the SHA-256 hash, see Get-FileHash.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Dictionary
Windows information and settings
Group Policy (ADMX) info
- GP unique name: NewTabPageCompanyLogo
- GP name: Set new tab page company logo (obsolete)
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Startup, home page and new tab page
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: NewTabPageCompanyLogo
- Value Type: REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\NewTabPageCompanyLogo = {
"default_logo": {
"hash": "cd0aa9856147b6c5b4ff2b7dfee5da20aa38253099ef1b4a64aced233c9afe29",
"url": "https://www.contoso.com/logo.png"
},
"light_logo": {
"hash": "517d286edb416bb2625ccfcba9de78296e90da8e32330d4c9c8275c4c1c33737",
"url": "https://www.contoso.com/light_logo.png"
}
}
Compact example value:
SOFTWARE\Policies\Microsoft\Edge\NewTabPageCompanyLogo = {"default_logo": {"hash": "cd0aa9856147b6c5b4ff2b7dfee5da20aa38253099ef1b4a64aced233c9afe29", "url": "https://www.contoso.com/logo.png"}, "light_logo": {"hash": "517d286edb416bb2625ccfcba9de78296e90da8e32330d4c9c8275c4c1c33737", "url": "https://www.contoso.com/light_logo.png"}}
Mac information and settings
- Preference Key Name: NewTabPageCompanyLogo
- Example value:
<key>NewTabPageCompanyLogo</key>
<dict>
<key>default_logo</key>
<dict>
<key>hash</key>
<string>cd0aa9856147b6c5b4ff2b7dfee5da20aa38253099ef1b4a64aced233c9afe29</string>
<key>url</key>
<string>https://www.contoso.com/logo.png</string>
</dict>
<key>light_logo</key>
<dict>
<key>hash</key>
<string>517d286edb416bb2625ccfcba9de78296e90da8e32330d4c9c8275c4c1c33737</string>
<key>url</key>
<string>https://www.contoso.com/light_logo.png</string>
</dict>
</dict>
NewTabPageCompanyLogoEnabled
Hide the company logo on the Microsoft Edge new tab page
Supported versions:
- On Windows and macOS since 117 or later
Description
By default, the company logo is shown on the new tab page if the company logo is configured in Admin Portal.
If you enable or don't configure this policy, there is no change on the Microsoft Edge new tab page and the company logo is there for users.
If you disable this policy, the company logo doesn't appear on Microsoft Edge new tab page.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: NewTabPageCompanyLogoEnabled
- GP name: Hide the company logo on the Microsoft Edge new tab page
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Startup, home page and new tab page
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: NewTabPageCompanyLogoEnabled
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: NewTabPageCompanyLogoEnabled
- Example value:
<false/>
NewTabPageContentEnabled
Allow Microsoft content on the new tab page
Supported versions:
- On Windows and macOS since 91 or later
Description
This policy applies for Microsoft Edge to all profile types, namely unsigned local user profiles, profiles signed in using a Microsoft Account, profiles signed in using Active Directory and profiles signed in using Microsoft Entra ID. The Enterprise new tab page for profiles signed in using Microsoft Entra ID can be configured in the M365 admin portal, but this policy setting takes precedence, so any M365 admin portal configurations will be ignored.
If you enable or don't configure this policy, Microsoft Edge displays Microsoft content on the new tab page. The user can choose different display options for the content. These options include, but aren't limited to: Content off, Content visible on scroll, Headings only, and Content visible. Enabling this policy doesn't force content to be visible - the user can keep setting their own preferred content position.
If you disable this policy, Microsoft Edge doesn't display Microsoft content on the new tab page, the Content control in the NTP settings flyout is disabled and set to "Content off", and the Layout control in the NTP settings flyout is disabled and set to "Custom".
Related policies: NewTabPageAllowedBackgroundTypes, NewTabPageQuickLinksEnabled
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: NewTabPageContentEnabled
- GP name: Allow Microsoft content on the new tab page
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Startup, home page and new tab page
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: NewTabPageContentEnabled
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: NewTabPageContentEnabled
- Example value:
<false/>
NewTabPageHideDefaultTopSites
Hide the default top sites from the new tab page
Supported versions:
- On Windows and macOS since 77 or later
Description
Hides the default top sites from the new tab page in Microsoft Edge.
If you set this policy to true, the default top site tiles are hidden.
If you set this policy to false or don't configure it, the default top site tiles remain visible.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: NewTabPageHideDefaultTopSites
- GP name: Hide the default top sites from the new tab page
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Startup, home page and new tab page
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: NewTabPageHideDefaultTopSites
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: NewTabPageHideDefaultTopSites
- Example value:
<true/>
NewTabPageLocation
Configure the new tab page URL
Supported versions:
- On Windows and macOS since 77 or later
Description
Configures the default URL for the new tab page.
The recommended version of this policy does not currently work and functions exactly like the mandatory version.
This policy determines the page that's opened when new tabs are created (including when new windows are opened). It also affects the startup page if that's set to open to the new tab page.
This policy doesn't determine which page opens on startup; that's controlled by the RestoreOnStartup policy. It also doesn't affect the home page if that's set to open to the new tab page.
If you don't configure this policy, the default new tab page is used.
If you configure this policy and the NewTabPageSetFeedType policy, this policy has precedence.
If a blank tab is preferred, "about:blank" is the correct URL to use, not "about://blank".
This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, joined to Microsoft Azure Active Directory, or instances that enrolled for device management. On macOS, this policy is available only on instances that are managed via MDM or joined to a domain via MCX.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- String
Windows information and settings
Group Policy (ADMX) info
- GP unique name: NewTabPageLocation
- GP name: Configure the new tab page URL
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Startup, home page and new tab page
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Startup, home page and new tab page
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: NewTabPageLocation
- Value Type: REG_SZ
Example value:
"https://www.fabrikam.com"
Mac information and settings
- Preference Key Name: NewTabPageLocation
- Example value:
<string>https://www.fabrikam.com</string>
NewTabPageManagedQuickLinks
Set new tab page quick links
Supported versions:
- On Windows and macOS since 79 or later
Description
By default, Microsoft Edge displays quick links on the new tab page from user-added shortcuts and top sites based on browsing history. With this policy, you can configure up to three quick link tiles on the new tab page, expressed as a JSON object:
[ { "url": "https://www.contoso.com", "title": "Contoso Portal", "pinned": true/false }, ... ]
The 'url' field is required; 'title' and 'pinned' are optional. If 'title' is not provided, the URL is used as the default title. If 'pinned' is not provided, the default value is false.
Microsoft Edge presents these in the order listed, from left to right, with all pinned tiles displayed ahead of non-pinned tiles.
If the policy is set as mandatory, the 'pinned' field will be ignored and all tiles will be pinned. The tiles can't be deleted by the user and will always appear at the front of the quick links list.
If the policy is set as recommended, pinned tiles will remain in the list but the user has the ability to edit and delete them. Quick link tiles that aren't pinned behave like default top sites and are pushed off the list if other websites are visited more frequently. When applying non-pinned links via this policy to an existing browser profile, the links may not appear at all, depending on how they rank compared to the user's browsing history.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Dictionary
Windows information and settings
Group Policy (ADMX) info
- GP unique name: NewTabPageManagedQuickLinks
- GP name: Set new tab page quick links
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Startup, home page and new tab page
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Startup, home page and new tab page
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: NewTabPageManagedQuickLinks
- Value Type: REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\NewTabPageManagedQuickLinks = [
{
"pinned": true,
"title": "Contoso Portal",
"url": "https://contoso.com"
},
{
"title": "Fabrikam",
"url": "https://fabrikam.com"
}
]
Compact example value:
SOFTWARE\Policies\Microsoft\Edge\NewTabPageManagedQuickLinks = [{"pinned": true, "title": "Contoso Portal", "url": "https://contoso.com"}, {"title": "Fabrikam", "url": "https://fabrikam.com"}]
Mac information and settings
- Preference Key Name: NewTabPageManagedQuickLinks
- Example value:
<key>NewTabPageManagedQuickLinks</key>
<array>
<dict>
<key>pinned</key>
<true/>
<key>title</key>
<string>Contoso Portal</string>
<key>url</key>
<string>https://contoso.com</string>
</dict>
<dict>
<key>title</key>
<string>Fabrikam</string>
<key>url</key>
<string>https://fabrikam.com</string>
</dict>
</array>
NewTabPagePrerenderEnabled
Enable preload of the new tab page for faster rendering
Supported versions:
- On Windows and macOS since 85 or later
Description
If you configure this policy, preloading the New tab page is enabled, and users can't change this setting. If you don't configure this policy, preloading is enabled and a user can change this setting.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: NewTabPagePrerenderEnabled
- GP name: Enable preload of the new tab page for faster rendering
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Startup, home page and new tab page
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Startup, home page and new tab page
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: NewTabPagePrerenderEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: NewTabPagePrerenderEnabled
- Example value:
<true/>
NewTabPageQuickLinksEnabled
Allow quick links on the new tab page
Supported versions:
- On Windows and macOS since 91 or later
Description
If you enable or don't configure this policy, Microsoft Edge displays quick links on the new tab page, and the user can interact with the control, turning quick links on and off. Enabling this policy does not force quick links to be visible - the user can continue to turn quick links on and off.
If you disable this policy, Microsoft Edge hides quick links on the new tab page and disables the quick links control in the NTP settings flyout.
This policy only applies for Microsoft Edge local user profiles, profiles signed in using a Microsoft Account, and profiles signed in using Active Directory. To configure the Enterprise new tab page for profiles signed in using Azure Active Directory, use the M365 admin portal.
Related policies: NewTabPageAllowedBackgroundTypes, NewTabPageContentEnabled
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: NewTabPageQuickLinksEnabled
- GP name: Allow quick links on the new tab page
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Startup, home page and new tab page
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: NewTabPageQuickLinksEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: NewTabPageQuickLinksEnabled
- Example value:
<true/>
NewTabPageSetFeedType
Configure the Microsoft Edge new tab page experience (obsolete)
OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 92.
Supported versions:
- On Windows and macOS since 79, until 92
Description
This policy is obsolete because the new version of the enterprise new tab page no longer requires choosing between different content types. Instead, the content that is presented to the user can be controlled via the Microsoft 365 admin center. To get to the Microsoft 365 admin center, sign in at https://admin.microsoft.com with your admin account.
Lets you choose either the Microsoft News or Office 365 feed experience for the new tab page.
When you set this policy to 'News', users will see the Microsoft News feed experience on the new tab page.
When you set this policy to 'Office', users with an Azure Active Directory browser sign-in will see the Office 365 feed experience on the new tab page.
If you disable or don't configure this policy:
Users with an Azure Active Directory browser sign-in are offered the Office 365 new tab page feed experience, as well as the standard new tab page feed experience.
Users without an Azure Active Directory browser sign-in will see the standard new tab page experience.
If you configure this policy and the NewTabPageLocation policy, NewTabPageLocation has precedence.
Default setting: Disabled or not configured.
Policy options mapping:
News (0) = Microsoft News feed experience
Office (1) = Office 365 feed experience
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: NewTabPageSetFeedType
- GP name: Configure the Microsoft Edge new tab page experience (obsolete)
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Startup, home page and new tab page
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Startup, home page and new tab page
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: NewTabPageSetFeedType
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: NewTabPageSetFeedType
- Example value:
<integer>0</integer>
RestoreOnStartup
Action to take on Microsoft Edge startup
Supported versions:
- On Windows and macOS since 77 or later
Description
Specify how Microsoft Edge behaves when it starts.
If you want a new tab to always open on startup, choose 'RestoreOnStartupIsNewTabPage'.
If you want to reopen URLs that were open the last time Microsoft Edge closed, choose 'RestoreOnStartupIsLastSession'. The browsing session will be restored as it was. Note that this option disables some settings that rely on sessions or that perform actions on exit (such as Clear browsing data on exit or session-only cookies).
If you want to open a specific set of URLs, choose 'RestoreOnStartupIsURLs'.
Starting in Microsoft Edge version 125, if you want to reopen URLs that were open the last time Microsoft Edge closed and open a specific set of URLs, choose 'RestoreOnStartupIsLastSessionAndURLs'.
Disabling this setting is the same as leaving it not configured. Users will be able to change it in Microsoft Edge.
This policy is only available on Windows instances that are joined to a Microsoft Active Directory domain, joined to Microsoft Azure Active Directory, or instances that enrolled for device management. On macOS, this policy is only available on instances that are managed via MDM or joined to a domain via MCX.
Policy options mapping:
RestoreOnStartupIsNewTabPage (5) = Open a new tab
RestoreOnStartupIsLastSession (1) = Restore the last session
RestoreOnStartupIsURLs (4) = Open a list of URLs
RestoreOnStartupIsLastSessionAndURLs (6) = Open a list of URLs and restore the last session
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: RestoreOnStartup
- GP name: Action to take on Microsoft Edge startup
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Startup, home page and new tab page
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Startup, home page and new tab page
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: RestoreOnStartup
- Value Type: REG_DWORD
Example value:
0x00000004
Mac information and settings
- Preference Key Name: RestoreOnStartup
- Example value:
<integer>4</integer>
RestoreOnStartupURLs
Sites to open when the browser starts
Supported versions:
- On Windows and macOS since 77 or later
Description
Specify a list of websites to open automatically when the browser starts. If you don't configure this policy, no site is opened on startup.
This policy only works if you also set the RestoreOnStartup policy to 'Open a list of URLs' (4).
This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, joined to Microsoft Azure Active Directory` or instances that enrolled for device management.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: RestoreOnStartupURLs
- GP name: Sites to open when the browser starts
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Startup, home page and new tab page
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Startup, home page and new tab page
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\RestoreOnStartupURLs
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended\RestoreOnStartupURLs
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\RestoreOnStartupURLs\1 = "https://contoso.com"
SOFTWARE\Policies\Microsoft\Edge\RestoreOnStartupURLs\2 = "https://www.fabrikam.com"
Mac information and settings
- Preference Key Name: RestoreOnStartupURLs
- Example value:
<array>
<string>https://contoso.com</string>
<string>https://www.fabrikam.com</string>
</array>
RestoreOnStartupUserURLsEnabled
Allow users to add and remove their own sites during startup when the RestoreOnStartupURLs policy is configured
Supported versions:
- On Windows since 107 or later
- On macOS since 111 or later
Description
This policy only works if you set the RestoreOnStartup policy to 'Open a list of URLs' (4) and the RestoreOnStartupURLs policy as mandatory. If you enable this policy, users are allowed to add and remove their own URLs to open when starting Edge while maintaining the admin specified mandatory list of sites specified by setting RestoreOnStartup policy to open a list of URLS and providing the list of sites in the RestoreOnStartupURLs policy.
If you disable or don't configure this policy, there is no change to how the RestoreOnStartup and RestoreOnStartupURLs policies work.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: RestoreOnStartupUserURLsEnabled
- GP name: Allow users to add and remove their own sites during startup when the RestoreOnStartupURLs policy is configured
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Startup, home page and new tab page
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: RestoreOnStartupUserURLsEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: RestoreOnStartupUserURLsEnabled
- Example value:
<true/>
ShowHomeButton
Show Home button on toolbar
Supported versions:
- On Windows and macOS since 77 or later
Description
Shows the Home button on Microsoft Edge's toolbar.
Enable this policy to always show the Home button. Disable it to never show the button.
If you don't configure the policy, users can choose whether to show the home button.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ShowHomeButton
- GP name: Show Home button on toolbar
- GP path (Mandatory): Administrative Templates/Microsoft Edge/Startup, home page and new tab page
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/Startup, home page and new tab page
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: ShowHomeButton
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: ShowHomeButton
- Example value:
<true/>
Additional policies
AADWebSiteSSOUsingThisProfileEnabled
Single sign-on for work or school sites using this profile enabled
Supported versions:
- On Windows and macOS since 92 or later
Description
'Allow single sign-on for work or school sites using this profile' option allows non-AAD profiles to be able to use single sign-on for work or school sites using work or school credentials present on the machine. This option shows up for end-users as a toggle in Settings -> Profiles -> Profile Preferences for non-AAD profiles only.
If you enable or disable this policy, 'Intelligent enablement of Single sign-on (SSO) for all Windows Azure Active Directory (Azure AD) accounts for users with a single non-Azure AD Microsoft Edge profile' will be turned off.
If you don't configure this policy, users can control whether to use SSO using other credentials present on the machine in edge://settings/profiles/multiProfileSettings.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AADWebSiteSSOUsingThisProfileEnabled
- GP name: Single sign-on for work or school sites using this profile enabled
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: AADWebSiteSSOUsingThisProfileEnabled
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: AADWebSiteSSOUsingThisProfileEnabled
- Example value:
<false/>
AIGenThemesEnabled
Enables DALL-E themes generation
Supported versions:
- On Windows and macOS since 122 or later
Description
This policy lets you generate browser themes using DALL-E and apply them to Microsoft Edge.
If you enable or don't configure this policy, the AI generated themes will be enabled.
If you disable this policy, the AI generated themes will be disabled for your organization.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AIGenThemesEnabled
- GP name: Enables DALL-E themes generation
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: AIGenThemesEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: AIGenThemesEnabled
- Example value:
<true/>
AccessibilityImageLabelsEnabled
Let screen reader users get image descriptions from Microsoft
Supported versions:
- On Windows and macOS since 97 or later
Description
Lets screen reader users get descriptions of unlabeled images on the web.
If you enable or don't configure this policy, users have the option of using an anonymous Microsoft service. This service provides automatic descriptions for unlabeled images users encounter on the web when they're using a screen reader.
If you disable this policy, users can't enable the Get Image Descriptions from Microsoft feature.
When this feature is enabled, the content of images that need a generated description is sent to Microsoft servers to generate a description.
No cookies or other user data is sent to Microsoft, and Microsoft doesn't save or log any image content.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AccessibilityImageLabelsEnabled
- GP name: Let screen reader users get image descriptions from Microsoft
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: AccessibilityImageLabelsEnabled
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: AccessibilityImageLabelsEnabled
- Example value:
<false/>
AdHocCodeSigningForPWAsEnabled
Native application signing during Progressive Web Application installation
Supported versions:
- On macOS since 132 or later
Description
Enabling this policy or leaving it unset enables the use of ad-hoc signatures for the native application that's created when installing a Progressive Web Application (PWA). This ensures that each installed application has a unique identity to macOS system components.
Disabling this policy will result in every native application created when installing Progressive Web Applications having the same identity. This can interfere with macOS functionality.
Only turn off the policy if you are using an endpoint security solution that blocks applications with an ad-hoc signature.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Mac information and settings
- Preference Key Name: AdHocCodeSigningForPWAsEnabled
- Example value:
<false/>
AdditionalSearchBoxEnabled
Enable additional search box in browser
Supported versions:
- On Windows and macOS since 123 or later
Description
A search box is an additional text input field located next to the address bar in a web browser. It allows users to perform web searches directly from the browser interface.
If you enable or don't configure this policy, the search box will be visible and available for use. Users can toggle the search box in Edge Settings page edge://settings/appearance#SearchBoxInToolbar.
If you disable this policy, search box will not be visible, and users will have to use the address bar or navigate to a search engine to perform web searches.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AdditionalSearchBoxEnabled
- GP name: Enable additional search box in browser
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: AdditionalSearchBoxEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: AdditionalSearchBoxEnabled
- Example value:
<true/>
AddressBarEditingEnabled
Configure address bar editing
Supported versions:
- On Windows and macOS since 98 or later
Description
If you enable or don't configure this policy, users can change the URL in the address bar.
If you disable this policy, it prevents users from changing the URL in the address bar.
Note: This policy doesn't prevent the browser from navigating to any URL. Users can still navigate to any URL by using the search option in the default New Tab Page, or using any link that leads to a web search engine. To ensure that users can only go to sites you expect, consider configuring the following policies in addition to this policy:
URLBlocklist and URLAllowlist to scope the pages that browser can navigate to.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AddressBarEditingEnabled
- GP name: Configure address bar editing
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: AddressBarEditingEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: AddressBarEditingEnabled
- Example value:
<true/>
AddressBarMicrosoftSearchInBingProviderEnabled
Enable Microsoft Search in Bing suggestions in the address bar
Supported versions:
- On Windows and macOS since 81 or later
Description
Enables the display of relevant Microsoft Search in Bing suggestions in the address bar's suggestion list when the user types a search string in the address bar. If you enable or don't configure this policy, users can see internal results powered by Microsoft Search in Bing in the Microsoft Edge address bar suggestion list. To see the Microsoft Search in Bing results, the user must be signed into Microsoft Edge with their Azure AD account for that organization. If you disable this policy, users can't see internal results in the Microsoft Edge address bar suggestion list. Starting with Microsoft Edge version 89, Microsoft Search in Bing suggestions will be available even if Bing isn't the user's default search provider.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AddressBarMicrosoftSearchInBingProviderEnabled
- GP name: Enable Microsoft Search in Bing suggestions in the address bar
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: AddressBarMicrosoftSearchInBingProviderEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: AddressBarMicrosoftSearchInBingProviderEnabled
- Example value:
<true/>
AdsSettingForIntrusiveAdsSites
Ads setting for sites with intrusive ads
Supported versions:
- On Windows and macOS since 78 or later
Description
Controls whether ads are blocked on sites with intrusive ads.
Policy options mapping:
AllowAds (1) = Allow ads on all sites
BlockAds (2) = Block ads on sites with intrusive ads. (Default value)
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AdsSettingForIntrusiveAdsSites
- GP name: Ads setting for sites with intrusive ads
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: AdsSettingForIntrusiveAdsSites
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: AdsSettingForIntrusiveAdsSites
- Example value:
<integer>1</integer>
AdsTransparencyEnabled
Configure if the ads transparency feature is enabled
Supported versions:
- On Windows and macOS since 100 or later
Description
Lets you decide whether the ads transparency feature is enabled. This behavior only applies to the "balanced" mode of tracking prevention, and does not impact "basic" or "strict" modes. Your users' tracking prevention level can be configured using the TrackingPrevention policy. AdsTransparencyEnabled will only have an effect if TrackingPrevention is set to TrackingPreventionBalanced or is not configured.
If you enable or don't configure this policy, transparency metadata provided by ads will be available to the user when the feature is active.
When the feature is enabled, Tracking Prevention will enable exceptions for the associated ad providers that have met Microsoft's privacy standards.
If you disable this policy, Tracking Prevention will not adjust its behavior even when transparency metadata is provided by ads.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AdsTransparencyEnabled
- GP name: Configure if the ads transparency feature is enabled
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: AdsTransparencyEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: AdsTransparencyEnabled
- Example value:
<true/>
AllowBackForwardCacheForCacheControlNoStorePageEnabled
Allow pages with Cache-Control: no-store header to enter back/forward cache
Supported versions:
- On Windows and macOS since 123 or later
Description
This policy controls if a page with Cache-Control: no-store header can be stored in back/forward cache. The website setting this header may not expect the page to be restored from back/forward cache since some sensitive information could still be displayed after the restoration even if it is no longer accessible.
If you enable or don't configure this policy, the page with Cache-Control: no-store header might be restored from back/forward cache unless the cache eviction is triggered (e.g. when there is HTTP-only cookie change to the site).
If you disable this policy, the page with Cache-Control: no-store header will not be stored in back/forward cache.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AllowBackForwardCacheForCacheControlNoStorePageEnabled
- GP name: Allow pages with Cache-Control: no-store header to enter back/forward cache
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: AllowBackForwardCacheForCacheControlNoStorePageEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: AllowBackForwardCacheForCacheControlNoStorePageEnabled
- Example value:
<true/>
AllowDeletingBrowserHistory
Enable deleting browser and download history
Supported versions:
- On Windows and macOS since 77 or later
Description
Enables deleting browser history and download history and prevents users from changing this setting.
Note that even with this policy is disabled, the browsing and download history aren't guaranteed to be retained: users can edit or delete the history database files directly, and the browser itself may remove (based on expiration period) or archive any or all history items at any time.
If you enable this policy or don't configure it, users can delete the browsing and download history.
If you disable this policy, users can't delete browsing and download history. Disabling this policy will disable history sync and open tab sync.
If you enable this policy, don't enable the ClearBrowsingDataOnExit policy, because they both deal with deleting data. If you enable both, the ClearBrowsingDataOnExit policy takes precedence and deletes all data when Microsoft Edge closes, regardless of how this policy is configured.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AllowDeletingBrowserHistory
- GP name: Enable deleting browser and download history
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: AllowDeletingBrowserHistory
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: AllowDeletingBrowserHistory
- Example value:
<true/>
AllowFileSelectionDialogs
Allow file selection dialogs
Supported versions:
- On Windows and macOS since 77 or later
Description
Allow access to local files by letting Microsoft Edge display file selection dialogs.
If you enable or don't configure this policy, users can open file selection dialogs as normal.
If you disable this policy, whenever the user performs an action that triggers a file selection dialog (like importing favorites, uploading files, or saving links), a message is displayed instead, and the user is assumed to have clicked Cancel on the file selection dialog.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AllowFileSelectionDialogs
- GP name: Allow file selection dialogs
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: AllowFileSelectionDialogs
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: AllowFileSelectionDialogs
- Example value:
<true/>
AllowGamesMenu
Allow users to access the games menu (deprecated)
DEPRECATED: This policy is deprecated. It is currently supported but will become obsolete in a future release.
Supported versions:
- On Windows and macOS since 99 or later
Description
This policy is deprecated because it can be managed using the HubsSidebarEnabled policy.
If you enable or don't configure this policy, users can access the games menu.
If you disable this policy, users won't be able to access the games menu.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AllowGamesMenu
- GP name: Allow users to access the games menu (deprecated)
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: AllowGamesMenu
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: AllowGamesMenu
- Example value:
<false/>
AllowPopupsDuringPageUnload
Allows a page to show popups during its unloading (obsolete)
OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 87.
Supported versions:
- On Windows and macOS since 78, until 87
Description
This policy allows an admin to specify that a page can show popups during its unloading.
When the policy is set to enabled, pages are allowed to show popups while they're being unloaded.
When the policy is set to disabled or unset, pages aren't allowed to show popups while they're being unloaded. This is as per the spec: (https://html.spec.whatwg.org/#apis-for-creating-and-navigating-browsing-contexts-by-name).
This policy was removed in Microsoft Edge 88 and is ignored if set.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AllowPopupsDuringPageUnload
- GP name: Allows a page to show popups during its unloading (obsolete)
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: AllowPopupsDuringPageUnload
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: AllowPopupsDuringPageUnload
- Example value:
<false/>
AllowSurfGame
Allow surf game
Supported versions:
- On Windows and macOS since 83 or later
Description
If you disable this policy, users won't be able to play the surf game when the device is offline or if the user navigates to edge://surf.
If you enable or don't configure this policy, users can play the surf game.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AllowSurfGame
- GP name: Allow surf game
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: AllowSurfGame
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: AllowSurfGame
- Example value:
<false/>
AllowSyncXHRInPageDismissal
Allow pages to send synchronous XHR requests during page dismissal (obsolete)
OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 99.
Supported versions:
- On Windows and macOS since 79, until 99
Description
This policy is obsolete because it was only intended to be a short-term mechanism to give enterprises more time to update their web content if and when it was found to be incompatible with the change to disallow synchronous XHR requests during page dismissal. It doesn't work in Microsoft Edge after version 99.
This policy lets you specify that a page can send synchronous XHR requests during page dismissal.
If you enable this policy, pages can send synchronous XHR requests during page dismissal.
If you disable this policy or don't configure this policy, pages aren't allowed to send synchronous XHR requests during page dismissal.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AllowSyncXHRInPageDismissal
- GP name: Allow pages to send synchronous XHR requests during page dismissal (obsolete)
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: AllowSyncXHRInPageDismissal
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: AllowSyncXHRInPageDismissal
- Example value:
<false/>
AllowSystemNotifications
Allows system notifications
Supported versions:
- On Windows since 117 or later
Description
Lets you use system notifications instead of Microsoft Edge's embedded Message Center on Windows and Linux.
If set to True or not set, Microsoft Edge is allowed to use system notifications.
If set to False, Microsoft Edge will not use system notifications. Microsoft Edge's embedded Message Center will be used as a fallback.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AllowSystemNotifications
- GP name: Allows system notifications
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: AllowSystemNotifications
- Value Type: REG_DWORD
Example value:
0x00000001
AllowTokenBindingForUrls
Configure the list of sites for which Microsoft Edge will attempt to establish a Token Binding with (obsolete)
OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 129.
Supported versions:
- On Windows since 83, until 129
Description
This policy is obsolete because Token Binding is no longer supported, starting with Microsoft Edge 130.
Configure the list of URL patterns for sites that the browser will attempt to perform the Token Binding protocol with. For the domains on this list, the browser will send the Token Binding ClientHello in the TLS handshake (See https://tools.ietf.org/html/rfc8472). If the server responds with a valid ServerHello response, the browser will create and send Token Binding messages on subsequent https requests. See https://tools.ietf.org/html/rfc8471 for more info.
If this list is empty, Token Binding will be disabled.
This policy is only available on Windows 10 devices with Virtual Secure Mode capability.
Starting in Microsoft Edge 86, this policy no longer supports dynamic refresh.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AllowTokenBindingForUrls
- GP name: Configure the list of sites for which Microsoft Edge will attempt to establish a Token Binding with (obsolete)
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\AllowTokenBindingForUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\AllowTokenBindingForUrls\1 = "mydomain.com"
SOFTWARE\Policies\Microsoft\Edge\AllowTokenBindingForUrls\2 = "[*.]mydomain2.com"
SOFTWARE\Policies\Microsoft\Edge\AllowTokenBindingForUrls\3 = "[*.].mydomain2.com"
AllowTrackingForUrls
Configure tracking prevention exceptions for specific sites
Supported versions:
- On Windows and macOS since 78 or later
Description
Configure the list of URL patterns that are excluded from tracking prevention.
If you configure this policy, the list of configured URL patterns is excluded from tracking prevention.
If you don't configure this policy, the global default value from the "Block tracking of users' web-browsing activity" policy (if set) or the user's personal configuration is used for all sites.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AllowTrackingForUrls
- GP name: Configure tracking prevention exceptions for specific sites
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\AllowTrackingForUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\AllowTrackingForUrls\1 = "https://www.contoso.com"
SOFTWARE\Policies\Microsoft\Edge\AllowTrackingForUrls\2 = "[*.]contoso.edu"
Mac information and settings
- Preference Key Name: AllowTrackingForUrls
- Example value:
<array>
<string>https://www.contoso.com</string>
<string>[*.]contoso.edu</string>
</array>
AllowWebAuthnWithBrokenTlsCerts
Allow Web Authentication requests on sites with broken TLS certificates.
Supported versions:
- On Windows and macOS since 123 or later
Description
If you enable this policy, Microsoft Edge will allow Web Authentication requests on websites that have TLS certificates with errors (i.e. websites considered not secure).
If you disable or don't configure this policy, the default behavior of blocking such requests will apply.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AllowWebAuthnWithBrokenTlsCerts
- GP name: Allow Web Authentication requests on sites with broken TLS certificates.
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: AllowWebAuthnWithBrokenTlsCerts
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: AllowWebAuthnWithBrokenTlsCerts
- Example value:
<true/>
AllowedDomainsForApps
Define domains allowed to access Google Workspace
Supported versions:
- On Windows and macOS since 104 or later
Description
Setting the policy on Microsoft Edge turns on the restricted sign-in feature in Google Workspace and prevents users from changing this setting. Users can only access Google tools using accounts from the specified domains. To allow gmail or googlemail accounts, add consumer_accounts to the list of domains. This policy is based on the Chrome policy of the same name.
If you don't provide a domain name or leave this policy unset, users can access Google Workspace with any account.
Users cannot change or override this setting.
Note: This policy causes the X-GoogApps-Allowed-Domains header to be appended to all HTTP and HTTPS requests to all google.com domains, as described in https://go.microsoft.com/fwlink/?linkid=2197973.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- String
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AllowedDomainsForApps
- GP name: Define domains allowed to access Google Workspace
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: AllowedDomainsForApps
- Value Type: REG_SZ
Example value:
"example.com"
Mac information and settings
- Preference Key Name: AllowedDomainsForApps
- Example value:
<string>example.com</string>
AlternateErrorPagesEnabled
Suggest similar pages when a webpage can't be found
Supported versions:
- On Windows and macOS since 80 or later
Description
Allow Microsoft Edge to issue a connection to a web service to generate URL and search suggestions for connectivity issues such as DNS errors.
If you enable this policy, a web service is used to generate url and search suggestions for network errors.
If you disable this policy, no calls to the web service are made and a standard error page is shown.
If you don't configure this policy, Microsoft Edge respects the user preference that's set under Services at edge://settings/privacy. Specifically, there's a Suggest similar pages when a webpage can't be found toggle, which the user can switch on or off. Note that if you have enable this policy (AlternateErrorPagesEnabled), the Suggest similar pages when a webpage can't be found setting is turned on, but the user can't change the setting by using the toggle. If you disable this policy, the Suggest similar pages when a webpage can't be found setting is turned off, and the user can't change the setting by using the toggle.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AlternateErrorPagesEnabled
- GP name: Suggest similar pages when a webpage can't be found
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: AlternateErrorPagesEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: AlternateErrorPagesEnabled
- Example value:
<true/>
AlwaysOpenPdfExternally
Always open PDF files externally
Supported versions:
- On Windows and macOS since 77 or later
Description
Disables the internal PDF viewer in Microsoft Edge.
If you enable this policy Microsoft Edge treats PDF files as downloads and lets users open them with the default application.
If Microsoft Edge is the default PDF reader, PDF files aren't downloaded and will continue to open in Microsoft Edge.
If you don't configure this policy or disable it, Microsoft Edge will open PDF files (unless the user disables it).
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AlwaysOpenPdfExternally
- GP name: Always open PDF files externally
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: AlwaysOpenPdfExternally
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: AlwaysOpenPdfExternally
- Example value:
<true/>
AmbientAuthenticationInPrivateModesEnabled
Enable Ambient Authentication for InPrivate and Guest profiles
Supported versions:
- On Windows and macOS since 81 or later
Description
Configure this policy to allow/disallow ambient authentication for InPrivate and Guest profiles in Microsoft Edge.
Ambient Authentication is http authentication with default credentials when explicit credentials aren't provided via NTLM/Kerberos/Negotiate challenge/response schemes.
If you set the policy to 'RegularOnly', it allows ambient authentication for Regular sessions only. InPrivate and Guest sessions won't be allowed to ambiently authenticate.
If you set the policy to 'InPrivateAndRegular', it allows ambient authentication for InPrivate and Regular sessions. Guest sessions won't be allowed to ambiently authenticate.
If you set the policy to 'GuestAndRegular', it allows ambient authentication for Guest and Regular sessions. InPrivate sessions won't be allowed to ambiently authenticate
If you set the policy to 'All', it allows ambient authentication for all sessions.
Note that ambient authentication is always allowed on regular profiles.
In Microsoft Edge version 81 and later, if the policy is left not set, ambient authentication will be enabled in regular sessions only.
Policy options mapping:
RegularOnly (0) = Enable ambient authentication in regular sessions only
InPrivateAndRegular (1) = Enable ambient authentication in InPrivate and regular sessions
GuestAndRegular (2) = Enable ambient authentication in guest and regular sessions
All (3) = Enable ambient authentication in regular, InPrivate and guest sessions
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AmbientAuthenticationInPrivateModesEnabled
- GP name: Enable Ambient Authentication for InPrivate and Guest profiles
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: AmbientAuthenticationInPrivateModesEnabled
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: AmbientAuthenticationInPrivateModesEnabled
- Example value:
<integer>0</integer>
AppCacheForceEnabled
Allows the AppCache feature to be re-enabled, even if it's turned off by default (obsolete)
OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 96.
Supported versions:
- On Windows and macOS since 84, until 96
Description
Support for AppCache and this policy was removed from Microsoft Edge starting in version 97.
If you set this policy to true, the AppCache is enabled, even when AppCache in Microsoft Edge is not available by default.
If you set this policy to false, or don't set it, AppCache will follow Microsoft Edge's defaults.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AppCacheForceEnabled
- GP name: Allows the AppCache feature to be re-enabled, even if it's turned off by default (obsolete)
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: AppCacheForceEnabled
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: AppCacheForceEnabled
- Example value:
<false/>
ApplicationBoundEncryptionEnabled
Enable Application Bound Encryption
Supported versions:
- On Windows since 127 or later
Description
Enabling this policy or leaving it unset binds the encryption keys used for local data storage to Microsoft Edge whenever possible.
Disabling this policy has a detrimental effect on Microsoft Edge's security because unknown and potentially hostile apps can retrieve the encryption keys used to secure data.
Only turn off this policy if there are compatibility issues, such as scenarios where other applications need legitimate access to Microsoft Edge's data. Encrypted user data is expected to be fully portable between different computers or the integrity and location of Microsoft Edge's executable files isn’t consistent.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ApplicationBoundEncryptionEnabled
- GP name: Enable Application Bound Encryption
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: ApplicationBoundEncryptionEnabled
- Value Type: REG_DWORD
Example value:
0x00000000
ApplicationLocaleValue
Set application locale
Supported versions:
- On Windows since 77 or later
Description
Configures the application locale in Microsoft Edge and prevents users from changing the locale.
If you enable this policy, Microsoft Edge uses the specified locale. If the configured locale isn't supported, 'en-US' is used instead.
If you disable or don't configure this setting, Microsoft Edge uses either the user-specified preferred locale (if configured) or the fallback locale 'en-US'.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- String
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ApplicationLocaleValue
- GP name: Set application locale
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: ApplicationLocaleValue
- Value Type: REG_SZ
Example value:
"en"
AskBeforeCloseEnabled
Get user confirmation before closing a browser window with multiple tabs
Supported versions:
- On Windows and macOS since 104 or later
Description
This policy lets you configure whether users see a confirmation dialog before closing a browser window with multiple tabs. This dialog asks users to confirm that the browser window can be closed.
If you enable this policy, users will be presented with a confirmation dialog when closing a browser window with multiple tabs.
If you disable or don't configure this policy, a browser window with multiple tabs will close immediately without user confirmation.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AskBeforeCloseEnabled
- GP name: Get user confirmation before closing a browser window with multiple tabs
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: AskBeforeCloseEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: AskBeforeCloseEnabled
- Example value:
<true/>
AudioCaptureAllowed
Allow or block audio capture
Supported versions:
- On Windows and macOS since 77 or later
Description
Allows you to set whether a user is prompted to grant a website access to their audio capture device. This policy applies to all URLs except for those configured in the AudioCaptureAllowedUrls list.
If you enable this policy or don't configure it (the default setting), the user is prompted for audio capture access except from the URLs in the AudioCaptureAllowedUrls list. These listed URLs are granted access without prompting.
If you disable this policy, the user is not prompted, and audio capture is accessible only to the URLs configured in AudioCaptureAllowedUrls.
This policy affects all types of audio inputs, not only the built-in microphone.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AudioCaptureAllowed
- GP name: Allow or block audio capture
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: AudioCaptureAllowed
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: AudioCaptureAllowed
- Example value:
<false/>
AudioCaptureAllowedUrls
Sites that can access audio capture devices without requesting permission
Supported versions:
- On Windows and macOS since 77 or later
Description
Specify websites, based on URL patterns, that can use audio capture devices without asking the user for permission. Patterns in this list are matched against the security origin of the requesting URL. If they match, the site is automatically granted access to audio capture devices. Note, however, that the pattern "*", which matches any URL, is not supported by this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AudioCaptureAllowedUrls
- GP name: Sites that can access audio capture devices without requesting permission
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\AudioCaptureAllowedUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\AudioCaptureAllowedUrls\1 = "https://www.contoso.com/"
SOFTWARE\Policies\Microsoft\Edge\AudioCaptureAllowedUrls\2 = "https://[*.]contoso.edu/"
Mac information and settings
- Preference Key Name: AudioCaptureAllowedUrls
- Example value:
<array>
<string>https://www.contoso.com/</string>
<string>https://[*.]contoso.edu/</string>
</array>
AudioProcessHighPriorityEnabled
Allow the audio process to run with priority above normal on Windows
Supported versions:
- On Windows since 96 or later
Description
This policy controls the priority of the audio process on Windows. If this policy is enabled, the audio process will run with above normal priority. If this policy is disabled, the audio process will run with normal priority. If this policy is not configured, the default configuration for the audio process will be used. This policy is intended as a temporary measure to give enterprises the ability to run audio with higher priority to address certain performance issues with audio capture. This policy will be removed in the future.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AudioProcessHighPriorityEnabled
- GP name: Allow the audio process to run with priority above normal on Windows
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: AudioProcessHighPriorityEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
AudioSandboxEnabled
Allow the audio sandbox to run
Supported versions:
- On Windows and macOS since 81 or later
Description
This policy controls the audio process sandbox.
If you enable this policy, the audio process will run sandboxed.
If you disable this policy, the audio process will run unsandboxed and the WebRTC audio-processing module will run in the renderer process. This leaves users open to security risks related to running the audio subsystem unsandboxed.
If you don't configure this policy, the default configuration for the audio sandbox will be used, which might differ based on the platform.
This policy is intended to give enterprises flexibility to disable the audio sandbox if they use security software setups that interfere with the sandbox.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AudioSandboxEnabled
- GP name: Allow the audio sandbox to run
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: AudioSandboxEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: AudioSandboxEnabled
- Example value:
<true/>
AutoImportAtFirstRun
Automatically import another browser's data and settings at first run
Supported versions:
- On Windows and macOS since 77 or later
Description
If you enable this policy, all supported datatypes and settings from the specified browser will be silently and automatically imported at first run. During the First Run Experience, the import section will also be skipped.
The browser data from Microsoft Edge Legacy will always be silently migrated at the first run, irrespective of the value of this policy.
If this policy is set to 'FromDefaultBrowser', then the datatypes corresponding to the default browser on the managed device will be imported.
If the browser specified as the value of this policy is not present in the managed device, Microsoft Edge will simply skip the import without any notification to the user.
If you set this policy to 'DisabledAutoImport', the import section of the first-run experience is skipped entirely and Microsoft Edge doesn't import browser data and settings automatically.
If this policy is set to the value of 'FromInternetExplorer', the following datatypes will be imported from Internet Explorer:
- Favorites or bookmarks
- Saved passwords
- Search engines
- Browsing history
- Home page
If this policy is set to the value of 'FromGoogleChrome', the following datatypes will be imported from Google Chrome:
- Favorites
- Saved passwords
- Addresses and more
- Payment info
- Browsing history
- Settings
- Pinned and Open tabs
- Extensions
- Cookies
Note: For more details on what is imported from Google Chrome, please see https://go.microsoft.com/fwlink/?linkid=2120835
If this policy is set to the value of 'FromSafari', user data is no longer imported into Microsoft Edge. This is due to the way Full Disk Access works on Mac. On macOS Mojave and above, it's no longer possible to have automated and unattended import of Safari data into Microsoft Edge.
Starting with Microsoft Edge version 83, if this policy is set to the value of 'FromMozillaFirefox', the following datatypes will be imported from Mozilla Firefox:
- Favorites or bookmarks
- Saved passwords
- Addresses and more
- Browsing History
If you want to restrict specific datatypes from getting imported on the managed devices, you can use this policy with other policies such as ImportAutofillFormData, ImportBrowserSettings, ImportFavorites, and etc.
Policy options mapping:
FromDefaultBrowser (0) = Automatically imports all supported datatypes and settings from the default browser
FromInternetExplorer (1) = Automatically imports all supported datatypes and settings from Internet Explorer
FromGoogleChrome (2) = Automatically imports all supported datatypes and settings from Google Chrome
FromSafari (3) = Automatically imports all supported datatypes and settings from Safari
DisabledAutoImport (4) = Disables automatic import, and the import section of the first-run experience is skipped
FromMozillaFirefox (5) = Automatically imports all supported datatypes and settings from Mozilla Firefox
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AutoImportAtFirstRun
- GP name: Automatically import another browser's data and settings at first run
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: AutoImportAtFirstRun
- Value Type: REG_DWORD
Example value:
0x00000002
Mac information and settings
- Preference Key Name: AutoImportAtFirstRun
- Example value:
<integer>2</integer>
AutoLaunchProtocolsComponentEnabled
AutoLaunch Protocols Component Enabled
Supported versions:
- On Windows and macOS since 96 or later
Description
Specifies whether the AutoLaunch Protocols component should be enabled. This component allows Microsoft to provide a list similar to that of the AutoLaunchProtocolsFromOrigins policy, allowing certain external protocols to launch without prompt or blocking certain protocols (on specified origins). By default, this component is enabled.
If you enable or don't configure this policy, the AutoLaunch Protocols component is enabled.
If you disable this policy, the AutoLaunch Protocols component is disabled.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AutoLaunchProtocolsComponentEnabled
- GP name: AutoLaunch Protocols Component Enabled
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: AutoLaunchProtocolsComponentEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: AutoLaunchProtocolsComponentEnabled
- Example value:
<true/>
AutoLaunchProtocolsFromOrigins
Define a list of protocols that can launch an external application from listed origins without prompting the user
Supported versions:
- On Windows and macOS since 85 or later
Description
Allows you to set a list of protocols, and for each protocol an associated list of allowed origin patterns, that can launch an external application without prompting the user. The trailing separator should not be included when listing the protocol and the protocol should be all lower case. For example, list "skype" instead of "skype:", "skype://" or "Skype".
If you configure this policy, a protocol will only be permitted to launch an external application without prompting by policy if:
the protocol is listed
the origin of the site trying to launch the protocol matches one of the origin patterns in that protocol's allowed_origins list.
If either condition is false, the external protocol launch prompt will not be omitted by policy.
If you don't configure this policy, no protocols can launch without a prompt. Users can opt out of prompts on a per-protocol/per-site basis unless the ExternalProtocolDialogShowAlwaysOpenCheckbox policy is set to Disabled. This policy has no impact on per-protocol/per-site prompt exemptions set by users.
The origin matching patterns use a similar format to those for the URLBlocklist policy, which are documented at https://go.microsoft.com/fwlink/?linkid=2095322.
However, origin matching patterns for this policy cannot contain "/path" or "@query" elements. Any pattern that does contain a "/path" or "@query" element will be ignored.
This policy does not work as expected with file://* wildcards.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Dictionary
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AutoLaunchProtocolsFromOrigins
- GP name: Define a list of protocols that can launch an external application from listed origins without prompting the user
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: AutoLaunchProtocolsFromOrigins
- Value Type: REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\AutoLaunchProtocolsFromOrigins = [
{
"allowed_origins": [
"example.com",
"http://www.example.com:8080"
],
"protocol": "spotify"
},
{
"allowed_origins": [
"https://example.com",
"https://.mail.example.com"
],
"protocol": "msteams"
},
{
"allowed_origins": [
"*"
],
"protocol": "msoutlook"
}
]
Compact example value:
SOFTWARE\Policies\Microsoft\Edge\AutoLaunchProtocolsFromOrigins = [{"allowed_origins": ["example.com", "http://www.example.com:8080"], "protocol": "spotify"}, {"allowed_origins": ["https://example.com", "https://.mail.example.com"], "protocol": "msteams"}, {"allowed_origins": ["*"], "protocol": "msoutlook"}]
Mac information and settings
- Preference Key Name: AutoLaunchProtocolsFromOrigins
- Example value:
<key>AutoLaunchProtocolsFromOrigins</key>
<array>
<dict>
<key>allowed_origins</key>
<array>
<string>example.com</string>
<string>http://www.example.com:8080</string>
</array>
<key>protocol</key>
<string>spotify</string>
</dict>
<dict>
<key>allowed_origins</key>
<array>
<string>https://example.com</string>
<string>https://.mail.example.com</string>
</array>
<key>protocol</key>
<string>msteams</string>
</dict>
<dict>
<key>allowed_origins</key>
<array>
<string>*</string>
</array>
<key>protocol</key>
<string>msoutlook</string>
</dict>
</array>
AutoOpenAllowedForURLs
URLs where AutoOpenFileTypes can apply
Supported versions:
- On Windows and macOS since 85 or later
Description
A list of URLs to which AutoOpenFileTypes will apply to. This policy has no impact on automatically open values set by users via the download shelf ... > "Always open files of this type" menu entry.
If you set URLs in this policy, files will only automatically open by policy if the URL is part of this set and the file type is listed in AutoOpenFileTypes. If either condition is false, the download won't automatically open by policy.
If you don't set this policy, all downloads where the file type is in AutoOpenFileTypes will automatically open.
A URL pattern has to be formatted according to https://go.microsoft.com/fwlink/?linkid=2095322.
This policy does not work as expected with file://* wildcards.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AutoOpenAllowedForURLs
- GP name: URLs where AutoOpenFileTypes can apply
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\AutoOpenAllowedForURLs
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\AutoOpenAllowedForURLs\1 = "example.com"
SOFTWARE\Policies\Microsoft\Edge\AutoOpenAllowedForURLs\2 = "https://ssl.server.com"
SOFTWARE\Policies\Microsoft\Edge\AutoOpenAllowedForURLs\3 = "hosting.com/good_path"
SOFTWARE\Policies\Microsoft\Edge\AutoOpenAllowedForURLs\4 = "https://server:8080/path"
SOFTWARE\Policies\Microsoft\Edge\AutoOpenAllowedForURLs\5 = ".exact.hostname.com"
Mac information and settings
- Preference Key Name: AutoOpenAllowedForURLs
- Example value:
<array>
<string>example.com</string>
<string>https://ssl.server.com</string>
<string>hosting.com/good_path</string>
<string>https://server:8080/path</string>
<string>.exact.hostname.com</string>
</array>
AutoOpenFileTypes
List of file types that should be automatically opened on download
Supported versions:
- On Windows and macOS since 85 or later
Description
This policy sets a list of file types that should be automatically opened on download. Note: The leading separator should not be included when listing the file type, so list "txt" instead of ".txt".
By default, these file types will be automatically opened on all URLs. You can use the AutoOpenAllowedForURLs policy to restrict the URLs for which these file types will be automatically opened on.
Files with types that should be automatically opened will still be subject to the enabled Microsoft Defender SmartScreen checks and won't be opened if they fail those checks.
File types that a user has already specified to automatically be opened will continue to do so when downloaded. The user will continue to be able to specify other file types to be automatically opened.
If you don't set this policy, only file types that a user has already specified to automatically be opened will do so when downloaded.
This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, joined to Microsoft Azure Active Directory or instances that enrolled for device management.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AutoOpenFileTypes
- GP name: List of file types that should be automatically opened on download
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\AutoOpenFileTypes
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\AutoOpenFileTypes\1 = "exe"
SOFTWARE\Policies\Microsoft\Edge\AutoOpenFileTypes\2 = "txt"
Mac information and settings
- Preference Key Name: AutoOpenFileTypes
- Example value:
<array>
<string>exe</string>
<string>txt</string>
</array>
AutofillAddressEnabled
Enable AutoFill for addresses
Supported versions:
- On Windows and macOS since 77 or later
Description
Enables the AutoFill feature and allows users to auto-complete address information in web forms using previously stored information.
If you disable this policy, AutoFill never suggests or fills in address information, nor does it save additional address information that the user might submit while browsing the web.
If you enable this policy or don't configure it, users can control AutoFill for addresses in the user interface.
Note that if you disable this policy you also stop all activity for all web forms, except payment and password forms. No further entries are saved, and Microsoft Edge won't suggest or AutoFill any previous entries.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AutofillAddressEnabled
- GP name: Enable AutoFill for addresses
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: AutofillAddressEnabled
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: AutofillAddressEnabled
- Example value:
<false/>
AutofillCreditCardEnabled
Enable AutoFill for payment instruments
Supported versions:
- On Windows and macOS since 77 or later
Description
Enables Microsoft Edge's AutoFill feature and lets users auto complete payment instruments like credit or debit cards in web forms using previously stored information. This includes suggesting new payment instruments like Buy Now Pay Later (BNPL) in web forms and Express Checkout.
If you enable this policy or don't configure it, users can control AutoFill for payment instruments.
If you disable this policy, AutoFill never suggests, fills, or recommends new payment Instruments. Additionally, it won't save any payment instrument information that users submit while browsing the web.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AutofillCreditCardEnabled
- GP name: Enable AutoFill for payment instruments
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: AutofillCreditCardEnabled
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: AutofillCreditCardEnabled
- Example value:
<false/>
AutofillMembershipsEnabled
Save and fill memberships
Supported versions:
- On Windows and macOS since 110 or later
Description
This policy lets you decide whether users can have their membership info (for example, program name and membership number) automatically saved and used to fill form fields while using Microsoft Edge. By default, users can choose whether to enable it or not.
If you enable this policy, users can only have their membership info automatically saved and used to fill form fields while using Microsoft Edge.
If you don't configure this policy, users can choose whether to have their membership info automatically saved and used to fill form fields while using Microsoft Edge.
If you disable this policy, users can't have their membership info automatically saved and used to fill form fields while using Microsoft Edge.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AutofillMembershipsEnabled
- GP name: Save and fill memberships
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: AutofillMembershipsEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: AutofillMembershipsEnabled
- Example value:
<true/>
AutomaticHttpsDefault
Configure Automatic HTTPS
Supported versions:
- On Windows and macOS since 92 or later
Description
This policy lets you manage settings for AutomaticHttpsDefault, which switches connections from HTTP to HTTPS.
This feature helps protect against man-in-the-middle attacks by enforcing more secure connections, but users might experience more connection errors.
Microsoft Edge attempts to upgrade some navigations from HTTP to HTTPS, when possible. This policy can be used to disable this behavior. If set to "AlwaysUpgrade" or left unset, this feature will be enabled by default.
The separate HttpAllowlist policy can be used to exempt specific hostnames or hostname patterns from being upgraded to HTTPS by this feature.
Starting in Microsoft Edge 111, "UpgradePossibleDomains" is deprecated and is treated the same as "DisableAutomaticHttps". It won't work in Microsoft Edge version 114.
Policy options mapping:
DisableAutomaticHttps (0) = Automatic HTTPS functionality is disabled.
UpgradeCapableDomains (1) = (Deprecated) Navigations delivered over HTTP are switched to HTTPS, only on domains likely to support HTTPS.
AlwaysUpgrade (2) = All navigations delivered over HTTP are switched to HTTPS. Connection errors might occur more often.
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AutomaticHttpsDefault
- GP name: Configure Automatic HTTPS
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: AutomaticHttpsDefault
- Value Type: REG_DWORD
Example value:
0x00000002
Mac information and settings
- Preference Key Name: AutomaticHttpsDefault
- Example value:
<integer>2</integer>
AutoplayAllowed
Allow media autoplay for websites
Supported versions:
- On Windows and macOS since 78 or later
Description
This policy sets the media autoplay policy for websites.
The default setting, "Not configured" respects the current media autoplay settings and lets users configure their autoplay settings.
Setting to "Enabled" sets media autoplay to "Allow". All websites are allowed to autoplay media. Users can't override this policy.
Setting to "Disabled" sets media autoplay to "Limit". This limits websites that are allowed to autoplay media to webpages with high media engagement and active WebRTC streams. Prior to Microsoft Edge version 92, this would set media autoplay to "Block". Users can't override this policy.
A tab will need to be closed and re-opened for this policy to take effect.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AutoplayAllowed
- GP name: Allow media autoplay for websites
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: AutoplayAllowed
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: AutoplayAllowed
- Example value:
<true/>
AutoplayAllowlist
Allow media autoplay on specific sites
Supported versions:
- On Windows and macOS since 93 or later
Description
Define a list of sites, based on URL patterns, that are allowed to autoplay media.
If you don't configure this policy, the global default value from the AutoplayAllowed policy (if set) or the user's personal configuration is used for all sites.
For detailed information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322.
Note: * is not an accepted value for this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: AutoplayAllowlist
- GP name: Allow media autoplay on specific sites
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\AutoplayAllowlist
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\AutoplayAllowlist\1 = "https://www.contoso.com"
SOFTWARE\Policies\Microsoft\Edge\AutoplayAllowlist\2 = "[*.]contoso.edu"
Mac information and settings
- Preference Key Name: AutoplayAllowlist
- Example value:
<array>
<string>https://www.contoso.com</string>
<string>[*.]contoso.edu</string>
</array>
BackgroundModeEnabled
Continue running background apps after Microsoft Edge closes
Supported versions:
- On Windows since 77 or later
Description
Allows Microsoft Edge processes to start at OS sign-in and keep running after the last browser window is closed. In this scenario, background apps and the current browsing session remain active, including any session cookies. An open background process displays an icon in the system tray and can always be closed from there.
If you enable this policy, background mode is turned on.
If you disable this policy, background mode is turned off.
If you don't configure this policy, background mode is initially turned off, and the user can configure its behavior in edge://settings/system.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: BackgroundModeEnabled
- GP name: Continue running background apps after Microsoft Edge closes
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: BackgroundModeEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
BackgroundTemplateListUpdatesEnabled
Enables background updates to the list of available templates for Collections and other features that use templates (deprecated)
DEPRECATED: This policy is deprecated. It is currently supported but will become obsolete in a future release.
Supported versions:
- On Windows and macOS since 79 or later
Description
This policy is deprecated because we are moving to a new policy. It won't work in Microsoft Edge as soon as version 104. The new policy to use is EdgeAssetDeliveryServiceEnabled.
Lets you enable or disable background updates to the list of available templates for Collections and other features that use templates. Templates are used to extract rich metadata from a webpage when the page is saved to a collection.
If you enable this setting or the setting is unconfigured, the list of available templates will be downloaded in the background from a Microsoft service every 24 hours.
If you disable this setting the list of available templates will be downloaded on demand. This type of download might result in small performance penalties for Collections and other features.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: BackgroundTemplateListUpdatesEnabled
- GP name: Enables background updates to the list of available templates for Collections and other features that use templates (deprecated)
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: BackgroundTemplateListUpdatesEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: BackgroundTemplateListUpdatesEnabled
- Example value:
<true/>
BeforeunloadEventCancelByPreventDefaultEnabled
Control the behavior for the cancel dialog produced by the beforeunload event (obsolete)
OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 130.
Supported versions:
- On Windows and macOS since 118, until 130
Description
This policy provides a temporary opt-out for two related fixes to the behavior of the confirmation dialog that’s shown by the beforeunload event.
When this policy is Enabled, the new (correct) behavior will be used. When this policy is Disabled, the old (legacy) behavior will be used. When this policy is left not set, the default behavior will be used. Note: This policy is a temporary workaround and will be removed in a future release.
New and correct behavior: In beforeunload
, calling event.preventDefault()
will trigger the confirmation dialog. Setting event.returnValue
to the empty string won’t trigger the confirmation dialog.
Old and legacy behavior: In beforeunload
, calling event.preventDefault()
won’t trigger the confirmation dialog. Setting event.returnValue
to the empty string will trigger the confirmation dialog.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: BeforeunloadEventCancelByPreventDefaultEnabled
- GP name: Control the behavior for the cancel dialog produced by the beforeunload event (obsolete)
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: BeforeunloadEventCancelByPreventDefaultEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: BeforeunloadEventCancelByPreventDefaultEnabled
- Example value:
<true/>
BingAdsSuppression
Block all ads on Bing search results
Supported versions:
- On Windows and macOS since 83 or later
Description
Enables an ad-free search experience on Bing.com
If you enable this policy, then a user can search on bing.com and have an ad-free search experience. At the same time, the SafeSearch setting will be set to 'Strict' and can't be changed by the user.
If you don't configure this policy, then the default experience will have ads in the search results on bing.com. SafeSearch will be set to 'Moderate' by default and can be changed by the user.
This policy is only available for K-12 SKUs that are identified as EDU tenants by Microsoft.
Please refer to https://go.microsoft.com/fwlink/?linkid=2119711 to learn more about this policy or if the following scenarios apply to you:
You have an EDU tenant, but the policy doesn't work.
You had your IP allowlisted for having an ad free search experience.
You were experiencing an ad-free search experience on Microsoft Edge Legacy and want to upgrade to the new version of Microsoft Edge.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: BingAdsSuppression
- GP name: Block all ads on Bing search results
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: BingAdsSuppression
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: BingAdsSuppression
- Example value:
<true/>
BlockThirdPartyCookies
Block third party cookies
Supported versions:
- On Windows and macOS since 77 or later
Description
Block web page elements that aren't from the domain that's in the address bar from setting cookies.
If you enable this policy, web page elements that are not from the domain that is in the address bar can't set cookies
If you disable this policy, web page elements from domains other than in the address bar can set cookies.
If you don't configure this policy, third-party cookies are enabled but users can change this setting.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: BlockThirdPartyCookies
- GP name: Block third party cookies
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: BlockThirdPartyCookies
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: BlockThirdPartyCookies
- Example value:
<false/>
BrowserAddProfileEnabled
Enable profile creation from the Identity flyout menu or the Settings page
Supported versions:
- On Windows and macOS since 77 or later
Description
Allows users to create new profiles, using the Add profile option. If you enable this policy or don't configure it, Microsoft Edge allows users to use Add profile on the Identity flyout menu or the Settings page to create new profiles.
If you disable this policy, users cannot add new profiles from the Identity flyout menu or the Settings page.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: BrowserAddProfileEnabled
- GP name: Enable profile creation from the Identity flyout menu or the Settings page
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: BrowserAddProfileEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: BrowserAddProfileEnabled
- Example value:
<true/>
BrowserCodeIntegritySetting
Configure browser process code integrity guard setting
Supported versions:
- On Windows since 104 or later
Description
This policy controls the use of code integrity guard in the browser process, which only allows Microsoft signed binaries to load.
Setting this policy to Enabled will enable code integrity guard in the browser process.
Setting this policy to Disabled, or if the policy is not set, will prevent the browser from enabling code integrity guard in the browser process.
The policy value Audit (1) is obsolete as of version 110. Setting this value is equivalent to the Disabled value.
This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, or Windows 10 Pro or Enterprise instances that enrolled for device management.
This policy will only take effect on Windows 10 RS2 and above.
Policy options mapping:
Disabled (0) = Do not enable code integrity guard in the browser process.
Audit (1) = Enable code integrity guard audit mode in the browser process.
Enabled (2) = Enable code integrity guard enforcement in the browser process.
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: BrowserCodeIntegritySetting
- GP name: Configure browser process code integrity guard setting
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: BrowserCodeIntegritySetting
- Value Type: REG_DWORD
Example value:
0x00000000
BrowserGuestModeEnabled
Enable guest mode
Supported versions:
- On Windows and macOS since 77 or later
Description
Enable the option to allow the use of guest profiles in Microsoft Edge. In a guest profile, the browser doesn't import browsing data from existing profiles, and it deletes browsing data when all guest profiles are closed.
If you enable this policy or don't configure it, Microsoft Edge lets users browse in guest profiles.
If you disable this policy, Microsoft Edge doesn't let users browse in guest profiles.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: BrowserGuestModeEnabled
- GP name: Enable guest mode
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: BrowserGuestModeEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: BrowserGuestModeEnabled
- Example value:
<true/>
BrowserLegacyExtensionPointsBlockingEnabled
Enable browser legacy extension point blocking
Supported versions:
- On Windows since 95 or later
Description
Sets the ProcessExtensionPointDisablePolicy on Microsoft Edge's browser process to block code injection from legacy third party applications.
If you enable or don't configure this policy, the ProcessExtensionPointDisablePolicy is applied to block legacy extension points in the browser process.
If you disable this policy, the ProcessExtensionPointDisablePolicy is not applied to block legacy extension points in the browser process. This has a detrimental effect on Microsoft Edge's security and stability as unknown and potentially hostile code can load inside Microsoft Edge's browser process. Only turn off the policy if there are compatibility issues with third-party software that must run inside Microsoft Edge's browser process.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: BrowserLegacyExtensionPointsBlockingEnabled
- GP name: Enable browser legacy extension point blocking
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: BrowserLegacyExtensionPointsBlockingEnabled
- Value Type: REG_DWORD
Example value:
0x00000000
BrowserNetworkTimeQueriesEnabled
Allow queries to a Browser Network Time service
Supported versions:
- On Windows and macOS since 77 or later
Description
Prevents Microsoft Edge from occasionally sending queries to a browser network time service to retrieve an accurate timestamp.
If you disable this policy, Microsoft Edge will stop sending queries to a browser network time service.
If you enable this policy or don't configure it, Microsoft Edge will occasionally send queries to a browser network time service.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: BrowserNetworkTimeQueriesEnabled
- GP name: Allow queries to a Browser Network Time service
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: BrowserNetworkTimeQueriesEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: BrowserNetworkTimeQueriesEnabled
- Example value:
<true/>
BrowserSignin
Browser sign-in settings
Supported versions:
- On Windows and macOS since 77 or later
Description
Specify whether a user can sign into Microsoft Edge with their account and use account-related services like sync and single sign on. To control the availability of sync, use the SyncDisabled policy instead.
If you set this policy to 'Disable', make sure that you also set the NonRemovableProfileEnabled policy to disabled because NonRemovableProfileEnabled disables the creation of an automatically signed in browser profile. If both policies are set, Microsoft Edge will use the 'Disable browser sign-in' policy and behave as if NonRemovableProfileEnabled is set to disabled.
If you set this policy to 'Enable', users can sign into the browser. Signing into the browser doesn't mean that sync is turned on by default; the user must separately opt-in to use this feature.
If you set this policy to 'Force', users must sign into a profile to use the browser. By default, this will allow the user to choose whether they want to sync to their account, unless sync is disabled by the domain admin or with the SyncDisabled policy. The default value of BrowserGuestModeEnabled policy is set to false.
If you don't configure this policy users can decide if they want to enable the browser sign-in option and use it as they see fit.
Policy options mapping:
Disable (0) = Disable browser sign-in
Enable (1) = Enable browser sign-in
Force (2) = Force users to sign-in to use the browser (all profiles)
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: BrowserSignin
- GP name: Browser sign-in settings
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: BrowserSignin
- Value Type: REG_DWORD
Example value:
0x00000002
Mac information and settings
- Preference Key Name: BrowserSignin
- Example value:
<integer>2</integer>
BrowsingDataLifetime
Browsing Data Lifetime Settings
Supported versions:
- On Windows and macOS since 89 or later
Description
Configures browsing data lifetime settings for Microsoft Edge. This policy controls the lifetime of selected browsing data. This policy has no effect if Sync is enabled. The available data types are the 'browsing_history', 'download_history', 'cookies_and_other_site_data', 'cached_images_and_files', 'password_signin', 'autofill', 'site_settings' and 'hosted_app_data'. Microsoft Edge will regularly remove data of selected types that is older than 'time_to_live_in_hours'. The deletion of expired data will happen 15 seconds after the browser starts then every hour while the browser is running.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Dictionary
Windows information and settings
Group Policy (ADMX) info
- GP unique name: BrowsingDataLifetime
- GP name: Browsing Data Lifetime Settings
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: BrowsingDataLifetime
- Value Type: REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\BrowsingDataLifetime = [
{
"data_types": [
"browsing_history"
],
"time_to_live_in_hours": 24
},
{
"data_types": [
"password_signin",
"autofill"
],
"time_to_live_in_hours": 12
}
]
Compact example value:
SOFTWARE\Policies\Microsoft\Edge\BrowsingDataLifetime = [{"data_types": ["browsing_history"], "time_to_live_in_hours": 24}, {"data_types": ["password_signin", "autofill"], "time_to_live_in_hours": 12}]
Mac information and settings
- Preference Key Name: BrowsingDataLifetime
- Example value:
<key>BrowsingDataLifetime</key>
<array>
<dict>
<key>data_types</key>
<array>
<string>browsing_history</string>
</array>
<key>time_to_live_in_hours</key>
<integer>24</integer>
</dict>
<dict>
<key>data_types</key>
<array>
<string>password_signin</string>
<string>autofill</string>
</array>
<key>time_to_live_in_hours</key>
<integer>12</integer>
</dict>
</array>
BuiltInDnsClientEnabled
Use built-in DNS client
Supported versions:
- On Windows and macOS since 77 or later
Description
Controls whether to use the built-in DNS client.
This policy controls which software stack is used to communicate with the DNS server: the operating system DNS client, or Microsoft Edge's built-in DNS client. This policy does not affect which DNS servers are used: if, for example, the operating system is configured to use an enterprise DNS server, that same server would be used by the built-in DNS client. It also does not control if DNS-over-HTTPS is used; Microsoft Edge always uses the built-in resolver for DNS-over-HTTPS requests. Please see the DnsOverHttpsMode policy for information on controlling DNS-over-HTTPS.
If you enable this policy or you don't configure this policy, the built-in DNS client is used.
If you disable this policy, the built-in DNS client is only used when DNS-over-HTTPS is in use.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: BuiltInDnsClientEnabled
- GP name: Use built-in DNS client
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: BuiltInDnsClientEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: BuiltInDnsClientEnabled
- Example value:
<true/>
BuiltinCertificateVerifierEnabled
Determines whether the built-in certificate verifier will be used to verify server certificates (obsolete)
OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 106.
Supported versions:
- On macOS since 83, until 106
Description
This policy is obsolete because it was a short-term mechanism to give enterprises more time to update their environments and report issues if they are found to be incompatible with the built-in certificate verifier.
The policy doesn't work in Microsoft Edge version 107.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Mac information and settings
- Preference Key Name: BuiltinCertificateVerifierEnabled
- Example value:
<false/>
CECPQ2Enabled
CECPQ2 post-quantum key-agreement enabled for TLS (obsolete)
OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 113.
Supported versions:
- On Windows and macOS since 93, until 113
Description
This policy was removed in Microsoft Edge 114 and is ignored if set. It served to disable CECPQ2, but CECPQ2 has been disabled by default. A separate policy will be introduced to control the rollout of the replacement of CECPQ2. That replacement will be a combination of the standard key-agreement X25519 with NIST's chosen post-quantum KEM, called "Kyber".
If this policy is not configured, or is set to enabled, then Microsoft Edge will follow the default rollout process for CECPQ2, a post-quantum key-agreement algorithm in TLS.
CECPQ2 results in larger TLS messages which, in very rare cases, can trigger bugs in some networking hardware. This policy can be set to False to disable CECPQ2 while networking issues are resolved.
This policy is a temporary measure and will be removed in future versions of Microsoft Edge.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: CECPQ2Enabled
- GP name: CECPQ2 post-quantum key-agreement enabled for TLS (obsolete)
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: CECPQ2Enabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: CECPQ2Enabled
- Example value:
<true/>
CORSNonWildcardRequestHeadersSupport
CORS non-wildcard request header support enabled
Supported versions:
- On Windows and macOS since 97 or later
Description
This policy lets you configure support of CORS non-wildcard request headers.
Microsoft Edge version 97 introduces support for CORS non-wildcard request headers. When a script makes a cross-origin network request via fetch() and XMLHttpRequest with a script-added Authorization header, the header must be explicitly allowed by the Access-Control-Allow-Headers header in the CORS preflight response. "Explicitly" here means that the wild card symbol "*" doesn't cover the Authorization header. See https://go.microsoft.com/fwlink/?linkid=2180022 for more detail.
If you enable or don't configure the policy, Microsoft Edge will support the CORS non-wildcard request headers and behave as previously described.
If you disable this policy, Microsoft Edge will allow the wildcard symbol ("*") in the Access-Control-Allow-Headers header in the CORS preflight response to cover the Authorization header.
This policy is a temporary workaround for the new CORS non-wildcard request header feature. It's intended to be removed in the future.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: CORSNonWildcardRequestHeadersSupport
- GP name: CORS non-wildcard request header support enabled
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: CORSNonWildcardRequestHeadersSupport
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: CORSNonWildcardRequestHeadersSupport
- Example value:
<true/>
CSSCustomStateDeprecatedSyntaxEnabled
Controls whether the deprecated :--foo syntax for CSS custom state is enabled
Supported versions:
- On Windows and macOS since 127 or later
Description
The :--foo syntax for the CSS custom state feature is being changed to :state(foo) in Microsoft Edge in order to comply with changes that have been made in Firefox and Safari. This policy lets the deprecated syntax to be used until Stable 133.
This deprecation might break some Microsoft Edge-only websites that use the deprecated :--foo syntax.
If you enable this policy, the deprecated syntax will be enabled.
If you disable this policy or don't set it, the deprecated syntax will be disabled.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: CSSCustomStateDeprecatedSyntaxEnabled
- GP name: Controls whether the deprecated :--foo syntax for CSS custom state is enabled
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: CSSCustomStateDeprecatedSyntaxEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: CSSCustomStateDeprecatedSyntaxEnabled
- Example value:
<true/>
CertificateTransparencyEnforcementDisabledForCas
Disable Certificate Transparency enforcement for a list of subjectPublicKeyInfo hashes
Supported versions:
- On Windows and macOS since 77 or later
Description
Disables enforcement of Certificate Transparency requirements for a list of subjectPublicKeyInfo hashes.
This policy lets you disable Certificate Transparency disclosure requirements for certificate chains that contain certificates with one of the specified subjectPublicKeyInfo hashes. This allows certificates that would otherwise be untrusted because they were not properly publicly disclosed to still be used for Enterprise hosts.
To disable Certificate Transparency enforcement when this policy is set, one of the following sets of conditions must be met:
- The hash is of the server certificate's subjectPublicKeyInfo.
- The hash is of a subjectPublicKeyInfo that appears in a CA certificate in the certificate chain, that CA certificate is constrained via the X.509v3 nameConstraints extension, one or more directoryName nameConstraints are present in the permittedSubtrees, and the directoryName contains an organizationName attribute.
- The hash is of a subjectPublicKeyInfo that appears in a CA certificate in the certificate chain, the CA certificate has one or more organizationName attributes in the certificate Subject, and the server's certificate contains the same number of organizationName attributes, in the same order, and with byte-for-byte identical values.
A subjectPublicKeyInfo hash is specified by concatenating the hash algorithm name, the "/" character, and the Base64 encoding of that hash algorithm applied to the DER-encoded subjectPublicKeyInfo of the specified certificate. This Base64 encoding is the same format as an SPKI Fingerprint, as defined in RFC 7469, Section 2.4. Unrecognized hash algorithms are ignored. The only supported hash algorithm at this time is "sha256".
If you disable this policy or don't configure it, any certificate that's required to be disclosed via Certificate Transparency will be treated as untrusted if it's not disclosed according to the Certificate Transparency policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: CertificateTransparencyEnforcementDisabledForCas
- GP name: Disable Certificate Transparency enforcement for a list of subjectPublicKeyInfo hashes
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\CertificateTransparencyEnforcementDisabledForCas
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\CertificateTransparencyEnforcementDisabledForCas\1 = "sha256/AAAAAAAAAAAAAAAAAAAAAA=="
SOFTWARE\Policies\Microsoft\Edge\CertificateTransparencyEnforcementDisabledForCas\2 = "sha256//////////////////////w=="
Mac information and settings
- Preference Key Name: CertificateTransparencyEnforcementDisabledForCas
- Example value:
<array>
<string>sha256/AAAAAAAAAAAAAAAAAAAAAA==</string>
<string>sha256//////////////////////w==</string>
</array>
CertificateTransparencyEnforcementDisabledForLegacyCas
Disable Certificate Transparency enforcement for a list of legacy certificate authorities (obsolete)
OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 131.
Supported versions:
- On Windows and macOS since 77, until 131
Description
Disables enforcing Certificate Transparency requirements for a list of legacy certificate authorities (Cas).
This policy lets you disable Certificate Transparency disclosure requirements for certificate chains that contain certificates with one of the specified subjectPublicKeyInfo hashes. This allows certificates that would otherwise be untrusted because they were not properly publicly disclosed, continue to be used for enterprise hosts.
In order for Certificate Transparency enforcement to be disabled, you must set the hash to a subjectPublicKeyInfo appearing in a CA certificate that is recognized as a legacy certificate authority (CA). A legacy CA is a CA that has been publicly trusted by default by one or more operating systems supported by Microsoft Edge.
You specify a subjectPublicKeyInfo hash by concatenating the hash algorithm name, the "/" character, and the Base64 encoding of that hash algorithm applied to the DER-encoded subjectPublicKeyInfo of the specified certificate. This Base64 encoding is the same format as an SPKI Fingerprint, as defined in RFC 7469, Section 2.4. Unrecognized hash algorithms are ignored. The only supported hash algorithm at this time is "sha256".
If you don't configure this policy, any certificate that's required to be disclosed via Certificate Transparency will be treated as untrusted if it isn't disclosed according to the Certificate Transparency policy.
This policy is obsolete because the feature to disable Certificate Transparency enforcement for legacy certificates has been removed.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: CertificateTransparencyEnforcementDisabledForLegacyCas
- GP name: Disable Certificate Transparency enforcement for a list of legacy certificate authorities (obsolete)
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\CertificateTransparencyEnforcementDisabledForLegacyCas
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\CertificateTransparencyEnforcementDisabledForLegacyCas\1 = "sha256/AAAAAAAAAAAAAAAAAAAAAA=="
SOFTWARE\Policies\Microsoft\Edge\CertificateTransparencyEnforcementDisabledForLegacyCas\2 = "sha256//////////////////////w=="
Mac information and settings
- Preference Key Name: CertificateTransparencyEnforcementDisabledForLegacyCas
- Example value:
<array>
<string>sha256/AAAAAAAAAAAAAAAAAAAAAA==</string>
<string>sha256//////////////////////w==</string>
</array>
CertificateTransparencyEnforcementDisabledForUrls
Disable Certificate Transparency enforcement for specific URLs
Supported versions:
- On Windows and macOS since 77 or later
Description
Disables enforcing Certificate Transparency requirements for the listed URLs.
This policy lets you not disclose certificates for the hostnames in the specified URLs via Certificate Transparency. This lets you use certificates that would otherwise be untrusted, because they weren't properly publicly disclosed, but it makes it harder to detect mis-issued certificates for those hosts.
Form your URL pattern according to https://go.microsoft.com/fwlink/?linkid=2095322. Because certificates are valid for a given hostname, independent of the scheme, port, or path, only the hostname part of the URL is considered. Wildcard hosts are not supported.
If you don't configure this policy, any certificate that should be disclosed via Certificate Transparency is treated as untrusted if it's not disclosed.
This policy does not work as expected with file://* wildcards.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: CertificateTransparencyEnforcementDisabledForUrls
- GP name: Disable Certificate Transparency enforcement for specific URLs
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\CertificateTransparencyEnforcementDisabledForUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\CertificateTransparencyEnforcementDisabledForUrls\1 = "contoso.com"
SOFTWARE\Policies\Microsoft\Edge\CertificateTransparencyEnforcementDisabledForUrls\2 = ".contoso.com"
Mac information and settings
- Preference Key Name: CertificateTransparencyEnforcementDisabledForUrls
- Example value:
<array>
<string>contoso.com</string>
<string>.contoso.com</string>
</array>
ClearBrowsingDataOnExit
Clear browsing data when Microsoft Edge closes
Supported versions:
- On Windows and macOS since 78 or later
Description
Microsoft Edge doesn't clear the browsing data by default when it closes. Browsing data includes information entered in forms, passwords, and even the websites visited.
If you enable this policy, all browsing data is deleted each time Microsoft Edge closes. Note that if you enable this policy, it takes precedence over how you configured DefaultCookiesSetting
If you disable or don't configure this policy, users can configure the Clear browsing data option in Settings.
If you enable this policy, don't configure the AllowDeletingBrowserHistory or the ClearCachedImagesAndFilesOnExit policy, because they all deal with deleting browsing data. If you configure the preceding policies and this policy, all browsing data is deleted when Microsoft Edge closes, regardless of how you configured AllowDeletingBrowserHistory or ClearCachedImagesAndFilesOnExit.
To exclude cookies from being deleted on exit, configure the SaveCookiesOnExit policy. To exclude passwords from being deleted on exit, configure the PasswordDeleteOnBrowserCloseEnabled policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ClearBrowsingDataOnExit
- GP name: Clear browsing data when Microsoft Edge closes
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: ClearBrowsingDataOnExit
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: ClearBrowsingDataOnExit
- Example value:
<true/>
ClearCachedImagesAndFilesOnExit
Clear cached images and files when Microsoft Edge closes
Supported versions:
- On Windows and macOS since 83 or later
Description
Microsoft Edge doesn't clear cached images and files by default when it closes.
If you enable this policy, cached images and files will be deleted each time Microsoft Edge closes.
If you disable this policy, users cannot configure the cached images and files option in edge://settings/clearBrowsingDataOnClose.
If you don't configure this policy, users can choose whether cached images and files are cleared on exit.
If you disable this policy, don't enable the ClearBrowsingDataOnExit policy, because they both deal with deleting data. If you configure both, the ClearBrowsingDataOnExit policy takes precedence and deletes all data when Microsoft Edge closes, regardless of how you configured ClearCachedImagesAndFilesOnExit.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ClearCachedImagesAndFilesOnExit
- GP name: Clear cached images and files when Microsoft Edge closes
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: ClearCachedImagesAndFilesOnExit
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: ClearCachedImagesAndFilesOnExit
- Example value:
<true/>
ClickOnceEnabled
Allow users to open files using the ClickOnce protocol
Supported versions:
- On Windows since 78 or later
Description
Allow users to open files using the ClickOnce protocol. The ClickOnce protocol allows websites to request that the browser open files from a specific URL using the ClickOnce file handler on the user's computer or device.
If you enable this policy, users can open files using the ClickOnce protocol. This policy overrides the user's ClickOnce setting in the edge://flags/ page.
If you disable this policy, users can't open files using the ClickOnce protocol. Instead, the file will be saved to the file system using the browser. This policy overrides the user's ClickOnce setting in the edge://flags/ page.
If you don't configure this policy, users with Microsoft Edge versions before Microsoft Edge 87 can't open files using the ClickOnce protocol by default. However, they have the option to enable the use of the ClickOnce protocol with the edge://flags/ page. Users with Microsoft Edge versions 87 and later can open files using the ClickOnce protocol by default but have the option to disable the ClickOnce protocol with edge://flags/ page.
Disabling ClickOnce may prevent ClickOnce applications (.application files) from launching properly.
For more information about ClickOnce, see https://go.microsoft.com/fwlink/?linkid=2103872 and https://go.microsoft.com/fwlink/?linkid=2099880.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ClickOnceEnabled
- GP name: Allow users to open files using the ClickOnce protocol
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: ClickOnceEnabled
- Value Type: REG_DWORD
Example value:
0x00000000
ClipboardAllowedForUrls
Allow clipboard use on specific sites
Supported versions:
- On Windows and macOS since 109 or later
Description
Configure the list of URL patterns that specify which sites can use the clipboard site permission.
Setting the policy lets you create a list of URL patterns that specify which sites can use the clipboard site permission. This doesn't include all clipboard operations on origins that match the patterns. For example, users will still be able to paste using keyboard shortcuts because this isn't controlled by the clipboard site permission.
Leaving the policy unset means DefaultClipboardSetting applies for all sites if it's set. If it isn't set, the user's personal setting applies.
For more information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards, *, are allowed.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ClipboardAllowedForUrls
- GP name: Allow clipboard use on specific sites
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\ClipboardAllowedForUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\ClipboardAllowedForUrls\1 = "https://www.example.com"
SOFTWARE\Policies\Microsoft\Edge\ClipboardAllowedForUrls\2 = "[*.]example.edu"
Mac information and settings
- Preference Key Name: ClipboardAllowedForUrls
- Example value:
<array>
<string>https://www.example.com</string>
<string>[*.]example.edu</string>
</array>
ClipboardBlockedForUrls
Block clipboard use on specific sites
Supported versions:
- On Windows and macOS since 109 or later
Description
Configure the list of URL patterns that specify which sites can use the clipboard site permission.
Setting the policy lets you create a list of URL patterns that specify sites that can't use the clipboard site permission. This doesn't include all clipboard operations on origins that match the patterns. For example, users will still be able to paste using keyboard shortcuts because this isn't controlled by the clipboard site permission.
Leaving the policy unset means DefaultClipboardSetting applies for all sites if it's set. If it isn't set, the user's personal setting applies.
For more information about valid url patterns, see https://go.microsoft.com/fwlink/?linkid=2095322. Wildcards, *, are allowed.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ClipboardBlockedForUrls
- GP name: Block clipboard use on specific sites
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\ClipboardBlockedForUrls
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\ClipboardBlockedForUrls\1 = "https://www.example.com"
SOFTWARE\Policies\Microsoft\Edge\ClipboardBlockedForUrls\2 = "[*.]example.edu"
Mac information and settings
- Preference Key Name: ClipboardBlockedForUrls
- Example value:
<array>
<string>https://www.example.com</string>
<string>[*.]example.edu</string>
</array>
CollectionsServicesAndExportsBlockList
Block access to a specified list of services and export targets in Collections
Supported versions:
- On Windows and macOS since 86 or later
Description
List specific services and export targets that users can't access in the Collections feature in Microsoft Edge. This includes displaying additional data from Bing and exporting collections to Microsoft products or external partners.
If you enable this policy, services and export targets that match the given list are blocked.
If you don't configure this policy, no restrictions on the acceptable services and export targets are enforced.
Policy options mapping:
pinterest_suggestions (pinterest_suggestions) = Pinterest suggestions
collections_share (collections_share) = Sharing of Collections
local_pdf (local_pdf) = Save local PDFs in Collections to OneDrive
send_word (send_word) = Send collection to Microsoft Word
send_excel (send_excel) = Send collection to Microsoft Excel
send_onenote (send_onenote) = Send collection to Microsoft OneNote
send_pinterest (send_pinterest) = Send collection to Pinterest
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- List of strings
Windows information and settings
Group Policy (ADMX) info
- GP unique name: CollectionsServicesAndExportsBlockList
- GP name: Block access to a specified list of services and export targets in Collections
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\CollectionsServicesAndExportsBlockList
- Path (Recommended): N/A
- Value Name: 1, 2, 3, ...
- Value Type: list of REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\CollectionsServicesAndExportsBlockList\1 = "collections_share"
SOFTWARE\Policies\Microsoft\Edge\CollectionsServicesAndExportsBlockList\2 = "local_pdf"
SOFTWARE\Policies\Microsoft\Edge\CollectionsServicesAndExportsBlockList\3 = "send_word"
SOFTWARE\Policies\Microsoft\Edge\CollectionsServicesAndExportsBlockList\4 = "send_excel"
SOFTWARE\Policies\Microsoft\Edge\CollectionsServicesAndExportsBlockList\5 = "send_onenote"
Mac information and settings
- Preference Key Name: CollectionsServicesAndExportsBlockList
- Example value:
<array>
<string>collections_share</string>
<string>local_pdf</string>
<string>send_word</string>
<string>send_excel</string>
<string>send_onenote</string>
</array>
CommandLineFlagSecurityWarningsEnabled
Enable security warnings for command-line flags
Supported versions:
- On Windows and macOS since 78 or later
Description
If disabled, this policy prevents security warnings from appearing when Microsoft Edge is launched with potentially dangerous command-line flags.
If enabled or unset, security warnings are displayed when these command-line flags are used to launch Microsoft Edge.
For example, the --disable-gpu-sandbox flag generates this warning: You're using an unsupported command-line flag: --disable-gpu-sandbox. This poses stability and security risks.
This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, joined to Microsoft Azure Active Directory, or instances that enrolled for device management. On macOS, this policy is available only on instances that are managed via MDM or joined to a domain via MCX.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: CommandLineFlagSecurityWarningsEnabled
- GP name: Enable security warnings for command-line flags
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: CommandLineFlagSecurityWarningsEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: CommandLineFlagSecurityWarningsEnabled
- Example value:
<true/>
ComponentUpdatesEnabled
Enable component updates in Microsoft Edge
Supported versions:
- On Windows and macOS since 77 or later
Description
If you enable or don't configure this policy, component updates are enabled in Microsoft Edge.
If you disable this policy or set it to false, component updates are disabled for all components in Microsoft Edge.
However, some components are exempt from this policy. This includes any component that doesn't contain executable code, that doesn't significantly alter the behavior of the browser, or that's critical for security. That is, updates that are deemed "critical for security" are still applied even if you disable this policy.
Examples of such components include the certificate revocation lists and security lists like tracking prevention lists.
Please note that disabling this policy can potentially prevent the Microsoft Edge developers from providing critical security fixes in a timely manner and is thus not recommended.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ComponentUpdatesEnabled
- GP name: Enable component updates in Microsoft Edge
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: ComponentUpdatesEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: ComponentUpdatesEnabled
- Example value:
<true/>
ComposeInlineEnabled
Compose is enabled for writing on the web
Supported versions:
- On Windows and macOS since 115 or later
Description
This policy lets you configure Compose in Microsoft Edge. Compose provides help for writing with AI-generated text, which lets the user get ideas for writing. This includes elaborating on text, re-writing, changing tone, formatting the text, and more.
If you enable or don't configure this policy, Compose can provide text generation for eligible fields, which are text editable and don't have an autocomplete attribute.
If you disable this policy, Compose will not be able to provide text generation for eligible fields. Compose will still be available for prompt-based text generation through the sidebar and must be managed with either EdgeDiscoverEnabled policy or HubsSidebarEnabled policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ComposeInlineEnabled
- GP name: Compose is enabled for writing on the web
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: ComposeInlineEnabled
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: ComposeInlineEnabled
- Example value:
<false/>
ConfigureDoNotTrack
Configure Do Not Track
Supported versions:
- On Windows and macOS since 77 or later
Description
Specify whether to send Do Not Track requests to websites that ask for tracking info. Do Not Track requests let the websites you visit know that you don't want your browsing activity to be tracked. By default, Microsoft Edge doesn't send Do Not Track requests, but users can turn on this feature to send them.
If you enable this policy, Do Not Track requests are always sent to websites asking for tracking info.
If you disable this policy, requests are never sent.
If you don't configure this policy, users can choose whether to send these requests.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ConfigureDoNotTrack
- GP name: Configure Do Not Track
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: ConfigureDoNotTrack
- Value Type: REG_DWORD
Example value:
0x00000000
Mac information and settings
- Preference Key Name: ConfigureDoNotTrack
- Example value:
<false/>
ConfigureFriendlyURLFormat
Configure the default paste format of URLs copied from Microsoft Edge, and determine if additional formats will be available to users
Supported versions:
- On Windows since 87 or later
- On macOS since 88 or later
Description
If FriendlyURLs are enabled, Microsoft Edge will compute additional representations of the URL and place them on the clipboard.
This policy configures what format will be pasted when the user pastes in external applications, or inside Microsoft Edge without the 'Paste as' context menu item.
If configured, this policy makes a choice on behalf of the user. The options in edge://settings/shareCopyPaste will be grayed out, and the options in the 'Paste As' context menu will not be available.
Not configured = The user will be able to choose their preferred paste format. By default, this is set to the friendly URL format. The 'Paste As' menu will be available in Microsoft Edge.
1 = No additional formats will be stored on the clipboard. There will be no 'Paste as' context menu item in Microsoft Edge and the only format available to paste will be the plain text URL format. Effectively, the friendly URL feature will be disabled.
3 = The user will get a friendly URL whenever they paste into surfaces that accept rich text. The plain URL will still be available for non-rich surfaces. There will be no 'Paste As' menu in Microsoft Edge.
4 = (Not currently used)
The richer formats may not be well-supported in some paste destinations and/or websites. In these scenarios, the plain URL option is recommended when configuring this policy.
The recommended policy is available in Microsoft Edge 105 or later.
Policy options mapping:
PlainText (1) = The plain URL without any extra information, such as the page's title. This is the recommended option when this policy is configured. For more information, see the description.
TitledHyperlink (3) = Titled Hyperlink: A hyperlink that points to the copied URL, but whose visible text is the title of the destination page. This is the Friendly URL format.
WebPreview (4) = Coming soon. If set, behaves the same as 'Plain URL'.
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: Yes
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ConfigureFriendlyURLFormat
- GP name: Configure the default paste format of URLs copied from Microsoft Edge, and determine if additional formats will be available to users
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): Administrative Templates/Microsoft Edge - Default Settings (users can override)/
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): SOFTWARE\Policies\Microsoft\Edge\Recommended
- Value Name: ConfigureFriendlyURLFormat
- Value Type: REG_DWORD
Example value:
0x00000003
Mac information and settings
- Preference Key Name: ConfigureFriendlyURLFormat
- Example value:
<integer>3</integer>
ConfigureKeyboardShortcuts
Configure the list of commands for which to disable keyboard shortcuts
Supported versions:
- On Windows since 101 or later
Description
Configure the list of Microsoft Edge commands for which to disable keyboard shortcuts.
See https://go.microsoft.com/fwlink/?linkid=2186950 for a list of possible commands to disable.
If you enable this policy, commands in the 'disabled' list will no longer be activated by keyboard shortcuts.
If you disable this policy, all keyboard shortcuts behave as usual.
Note: Disabling a command will only remove its shortcut mapping. Commands in the 'disabled' list will still function if accessed via browser UI.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Dictionary
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ConfigureKeyboardShortcuts
- GP name: Configure the list of commands for which to disable keyboard shortcuts
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: ConfigureKeyboardShortcuts
- Value Type: REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\ConfigureKeyboardShortcuts = {
"disabled": [
"new_tab",
"fullscreen"
]
}
Compact example value:
SOFTWARE\Policies\Microsoft\Edge\ConfigureKeyboardShortcuts = {"disabled": ["new_tab", "fullscreen"]}
ConfigureOnPremisesAccountAutoSignIn
Configure automatic sign in with an Active Directory domain account when there is no Azure AD domain account
Supported versions:
- On Windows since 81 or later
Description
Enable the use of Active Directory accounts for automatic sign in if your users' machines are Domain Joined and your environment is not hybrid joined. If you want users automatically signed in with their Azure Active Directory accounts instead, please Azure AD join (See https://go.microsoft.com/fwlink/?linkid=2118197 for more information) or hybrid join (See https://go.microsoft.com/fwlink/?linkid=2118365 for more information) your environment.
On every launch, Microsoft Edge will try to sign-in using this policy, as long as the first profile being launched isn't signed-in or an auto sign-in hasn't happened before.
If you have configured the BrowserSignin policy to disabled, this policy will not take any effect.
If you enable this policy and set it to 'SignInAndMakeDomainAccountNonRemovable', Microsoft Edge will automatically sign in users that are on domain joined machines using their Active Directory accounts.
If you set this policy to 'Disabled' or don't set it, Microsoft Edge will not automatically sign in users that are on domain joined machines with Active Directory accounts.
From Microsoft Edge 89 onwards, if there is an existing on-premises profile with RoamingProfileSupportEnabled policy disabled and machine is now hybrid joined i.e it has an Azure AD account, it will auto-upgrade the on-premises profile to Azure AD profile to get full Azure AD sync facilities.
From Microsoft Edge 93 onwards, if policy ImplicitSignInEnabled is disabled, this policy will not take any effect.
From Microsoft Edge 94 onwards, if policy OnlyOnPremisesImplicitSigninEnabled is enabled, and this policy is set to 'SignInAndMakeDomainAccountNonRemovable', it will take effect even on hybrid joined environment. Microsoft Edge will automatically sign in users using their Active Directory domain account even if there are MSA or AAD accounts.
Policy options mapping:
Disabled (0) = Disabled
SignInAndMakeDomainAccountNonRemovable (1) = Sign in and make domain account non-removable
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ConfigureOnPremisesAccountAutoSignIn
- GP name: Configure automatic sign in with an Active Directory domain account when there is no Azure AD domain account
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: ConfigureOnPremisesAccountAutoSignIn
- Value Type: REG_DWORD
Example value:
0x00000000
ConfigureOnlineTextToSpeech
Configure Online Text To Speech
Supported versions:
- On Windows and macOS since 77 or later
Description
Set whether the browser can leverage Online Text to Speech voice fonts, part of Azure Cognitive Services. These voice fonts are higher quality than the pre-installed system voice fonts.
If you enable or don't configure this policy, web-based applications that use the SpeechSynthesis API can use Online Text to Speech voice fonts.
If you disable this policy, the voice fonts aren't available.
Read more about this feature here: SpeechSynthesis API: https://go.microsoft.com/fwlink/?linkid=2110038 Cognitive Services: https://go.microsoft.com/fwlink/?linkid=2110141
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ConfigureOnlineTextToSpeech
- GP name: Configure Online Text To Speech
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: ConfigureOnlineTextToSpeech
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: ConfigureOnlineTextToSpeech
- Example value:
<true/>
ConfigureShare
Configure the Share experience
Supported versions:
- On Windows since 83 or later
- On macOS since 93 or later
Description
If you set this policy to 'ShareAllowed' (the default), users will be able to access the Share experience from the Settings and More Menu in Microsoft Edge to share with other apps on the system.
If you set this policy to 'ShareDisallowed', users won't be able to access the Share experience. If the Share button is on the toolbar, it will also be hidden.
Policy options mapping:
ShareAllowed (0) = Allow using the Share experience
ShareDisallowed (1) = Don't allow using the Share experience
Use the preceding information when configuring this policy.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Integer
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ConfigureShare
- GP name: Configure the Share experience
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: ConfigureShare
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: ConfigureShare
- Example value:
<integer>1</integer>
ConfigureViewInFileExplorer
Configure the View in File Explorer feature for SharePoint pages in Microsoft Edge
Supported versions:
- On Windows since 93 or later
Description
This setting allows you to configure the View in File Explorer capability for file management in SharePoint Online while using Microsoft Edge.
You will need to list the specific domains where this is allowed and list cookies needed for SharePoint authentication (rtFa and FedAuth).
Behind the scenes, the policy allows URLs with the viewinfileexplorer: scheme to open WebDAV URLs in Windows File Explorer on pages matching the list of domains and uses the cookies you specified for WebDAV authentication.
If you enable this policy, you can use the "View in File Explorer" feature on the SharePoint document libraries you list. You will need to specify the SharePoint domain and authentication cookies. See example value below.
If you disable or don't configure this policy, you cannot use the "View in File Explorer" feature on SharePoint document libraries.
Note that while this is an available option through Microsoft Edge, rather than use the View in File Explorer option, the recommended approach to managing files and folders outside of SharePoint is to sync your SharePoint files or move or copy files in SharePoint. Sync your SharePoint files: https://go.microsoft.com/fwlink/p/?linkid=2166983 Move or copy files in SharePoint: https://go.microsoft.com/fwlink/p/?linkid=2167123
This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, or Windows 10 Pro or Enterprise instances enrolled for device management.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Dictionary
Windows information and settings
Group Policy (ADMX) info
- GP unique name: ConfigureViewInFileExplorer
- GP name: Configure the View in File Explorer feature for SharePoint pages in Microsoft Edge
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: ConfigureViewInFileExplorer
- Value Type: REG_SZ
Example value:
SOFTWARE\Policies\Microsoft\Edge\ConfigureViewInFileExplorer = [
{
"cookies": [
"rtFa",
"FedAuth"
],
"domain": "contoso.sharepoint.com"
},
{
"cookies": [
"rtFa",
"FedAuth"
],
"domain": "contoso2.sharepoint.com"
}
]
Compact example value:
SOFTWARE\Policies\Microsoft\Edge\ConfigureViewInFileExplorer = [{"cookies": ["rtFa", "FedAuth"], "domain": "contoso.sharepoint.com"}, {"cookies": ["rtFa", "FedAuth"], "domain": "contoso2.sharepoint.com"}]
CopilotCDPPageContext
Control Copilot with Commercial Data Protection access to page context for Microsoft Entra ID profiles (deprecated)
DEPRECATED: This policy is deprecated. It is currently supported but will become obsolete in a future release.
Supported versions:
- On Windows and macOS since 124 or later
Description
Instead of this deprecated policy, we recommend using EdgeEntraCopilotPageContext.
This policy controls access to page contents for Copilot with Commercial Data Protection in the Edge sidebar. This policy applies only to Microsoft Entra ID profiles. To summarize pages and interact with text selections, it needs to be able to access the page contents. This policy does not apply to MSA profiles. This policy doesn't control access for Copilot without Commercial Data Protection. Access for Copilot without Commercial Data Protection is controlled by the policy CopilotPageContext.
If you enable this policy, Copilot with Commercial Data Protection will have access to page context.
If you don't configure this policy, a user can enable access to page context for Copilot with Commercial Data Protection using the setting toggle in Edge.
If you disable this policy, Copilot with Commercial Data Protection will not be able to access page context.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: CopilotCDPPageContext
- GP name: Control Copilot with Commercial Data Protection access to page context for Microsoft Entra ID profiles (deprecated)
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: CopilotCDPPageContext
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: CopilotCDPPageContext
- Example value:
<true/>
CopilotPageContext
Control Copilot access to page context for Microsoft Entra ID profiles
Supported versions:
- On Windows and macOS since 124 or later
Description
This policy controls access to page contents for Copilot in the Microsoft Edge sidebar when users are logged into their MSA Copilot account. This policy applies only to Microsoft Entra ID Microsoft Edge profiles. To summarize pages and interact with text selections, it needs to be able to access the page contents. This policy does not apply to MSA Microsoft Edge profiles. This policy doesn't control access for Copilot with enterprise data protection (EDP). Access for Copilot with enterprise data protection (EDP) is controlled by the EdgeEntraCopilotPageContext policy.
If you enable this policy, Copilot will have access to page content when logged in with Entra ID.
If this policy is not configured, the default behavior for non-EU countries is that access is initially enabled. For EU countries, the default behavior is that access is initially disabled. In both cases, if the policy is not configured, users can enable or disable Copilot's access to page content using the setting toggle in Microsoft Edge.
If you disable this policy, Copilot will not be able to access page context.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: CopilotPageContext
- GP name: Control Copilot access to page context for Microsoft Entra ID profiles
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: CopilotPageContext
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: CopilotPageContext
- Example value:
<true/>
CreatePasskeysInICloudKeychain
Control whether passkey creation will default to iCloud Keychain.
Supported versions:
- On macOS since 132 or later
Description
Microsoft Edge may direct passkey/WebAuthn creation requests directly to iCloud Keychain on macOS 13.5 or later. If iCloud Keychain syncing is not enabled yet, this will prompt the user to sign in with iCloud, or might prompt them to enable iCloud Keychain syncing.
If this policy is set to "true" then iCloud Keychain will be the default whenever the WebAuthn request is compatible with that choice.
If this policy isn't set then the default behavior depends on factors such as whether iCloud Drive is enabled, or whether the user has recently used or created a credential in their Microsoft Edge profile.
If this policy is set to false, iCloud Keychain will not be used by default and the previous behavior (of creating the credential in the Microsoft Edge profile) may be used instead. Users will still be able to select iCloud Keychain as an option, and may still see iCloud Keychain credentials when signing in.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Mac information and settings
- Preference Key Name: CreatePasskeysInICloudKeychain
- Example value:
<false/>
CrossOriginWebAssemblyModuleSharingEnabled
Specifies whether WebAssembly modules can be sent cross-origin (obsolete)
OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 98.
Supported versions:
- On Windows and macOS since 95, until 98
Description
Specifies whether WebAssembly modules can be sent to another window or worker cross-origin. Cross-origin WebAssembly module sharing was deprecated as part of the efforts to deprecate document.domain, see https://github.com/mikewest/deprecating-document-domain. This policy allowed re-enabling of cross-origin WebAssembly module sharing. This policy is obsolete because it was intended to offer a longer transition period in the deprecation process.
If you enable this policy, sites can send WebAssembly modules cross-origin without restrictions.
If you disable or don't configure this policy, sites can only send WebAssembly modules to windows and workers in the same origin.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: CrossOriginWebAssemblyModuleSharingEnabled
- GP name: Specifies whether WebAssembly modules can be sent cross-origin (obsolete)
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: CrossOriginWebAssemblyModuleSharingEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: CrossOriginWebAssemblyModuleSharingEnabled
- Example value:
<true/>
CryptoWalletEnabled
Enable CryptoWallet feature (obsolete)
OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 128.
Supported versions:
- On Windows since 112, until 128
Description
This policy is obsoleted because this feature will no longer be supported, starting in Microsoft Edge 128. There is no replacement for this policy. Enables CryptoWallet feature in Microsoft Edge.
If you enable this policy or don't configure it, users can use CryptoWallet feature which allows users to securely store, manage and transact digital assets such as Bitcoin, Ethereum and other cryptocurrencies. Therefore, Microsoft Edge may access Microsoft servers to communicate with the web3 world during the use of the CryptoWallet feature.
If you disable this policy, users can't use CryptoWallet feature.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: No - Requires browser restart
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: CryptoWalletEnabled
- GP name: Enable CryptoWallet feature (obsolete)
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: CryptoWalletEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
CustomHelpLink
Specify custom help link
Supported versions:
- On Windows and macOS since 79 or later
Description
Specify a link for the Help menu or the F1 key.
If you enable this policy, an admin can specify a link for the Help menu or the F1 key.
If you disable or don't configure this policy, the default link for the Help menu or the F1 key is used.
This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, Windows 10 Pro or Enterprise instances that enrolled for device management, or macOS instances that are that are managed via MDM or joined to a domain via MCX.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: Yes
- Applies to a profile that is signed in with a Microsoft account: No
Data Type:
- String
Windows information and settings
Group Policy (ADMX) info
- GP unique name: CustomHelpLink
- GP name: Specify custom help link
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: CustomHelpLink
- Value Type: REG_SZ
Example value:
"https://go.microsoft.com/fwlink/?linkid=2080734"
Mac information and settings
- Preference Key Name: CustomHelpLink
- Example value:
<string>https://go.microsoft.com/fwlink/?linkid=2080734</string>
DNSInterceptionChecksEnabled
DNS interception checks enabled
Supported versions:
- On Windows and macOS since 80 or later
Description
This policy configures a local switch that can be used to disable DNS interception checks. These checks attempt to discover whether the browser is behind a proxy that redirects unknown host names.
This detection might not be necessary in an enterprise environment where the network configuration is known. It can be disabled to avoid additional DNS and HTTP traffic on start-up and each DNS configuration change.
If you enable or don't set this policy, the DNS interception checks are performed.
If you disable this policy, DNS interception checks aren't performed.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean
Windows information and settings
Group Policy (ADMX) info
- GP unique name: DNSInterceptionChecksEnabled
- GP name: DNS interception checks enabled
- GP path (Mandatory): Administrative Templates/Microsoft Edge/
- GP path (Recommended): N/A
- GP ADMX file name: MSEdge.admx
Windows Registry Settings
- Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
- Path (Recommended): N/A
- Value Name: DNSInterceptionChecksEnabled
- Value Type: REG_DWORD
Example value:
0x00000001
Mac information and settings
- Preference Key Name: DNSInterceptionChecksEnabled
- Example value:
<true/>
DefaultBrowserSettingEnabled
Set Microsoft Edge as default browser
Supported versions:
- On Windows 7 and macOS since 77 or later
Description
If you set this policy to True, Microsoft Edge always checks whether it's the default browser on startup and, if possible, automatically registers itself.
If you set this policy to False, Microsoft Edge is stopped from ever checking if it's the default and turns user controls off for this option.
If you don't set this policy, Microsoft Edge lets users control whether it's the default and, if not, whether user notifications should appear.
Note for Windows administrators: This policy only works for PCs running Windows 7. For later versions of Windows, you have to deploy a "default application associations" file that makes Microsoft Edge the handler for the https and http protocols (and, optionally, the ftp protocol and file formats such as .html, .htm, .pdf, .svg, .webp). See https://go.microsoft.com/fwlink/?linkid=2094932 for more information.
Supported features:
- Can be mandatory: Yes
- Can be recommended: No
- Dynamic Policy Refresh: Yes
- Per Profile: No
- Applies to a profile that is signed in with a Microsoft account: Yes
Data Type:
- Boolean