Microsoft Edge security baseline settings reference for Microsoft Intune
This article is a reference for the settings that are available in the Microsoft Edge security baseline for Microsoft Intune and applies to versions of that baseline that released in May 2023 or later.
If you use a security baseline for Edge version 85 or earlier, see List of the settings in the Microsoft Edge security baseline in Intune.
Note
Beginning in May 2023, all new security baseline versions use a new settings format that replaces previous versions. While the last version instance for a baseline that uses the older setting format remains available to use, the older format will no longer receive updates for new settings, or updated default configurations.
About this reference article
Each security baseline is a group of preconfigured Windows settings that help you apply and enforce granular security settings that the relevant security teams recommend. You can also customize each baseline you deploy to enforce only those settings and values you require. When you create a security baseline profile in Intune, you're creating a template that consists of multiple device configuration profiles.
The details that are displayed in this article are based on baseline version that is selected at the top of the article. For each selection, this article displays:
- A list of each setting in that baseline version.
- The default configuration of each setting in that baseline version.
- When available, a link to the underlying configuration service provider (CSP) documentation, or other related content from the relevant product group that provides context and possibly additional details for the settings use.
When a new version of a baseline becomes available, it replaces the previous version. Profile instances that you’ve created prior to the availability of a new version:
Become read-only. You can continue to use those profiles but can't edit them to change their configuration.
Tip
Because the new baselines versions introduced in May 2023 or later exist side-by-side with the last baseline version from the older format, baselines for the last available version of that older format remain accessible to use and to edit.
Can be updated to the latest version. After you update a profile to the current baseline version, you can edit the profile to modify settings.
To learn more about using security baselines, see:
Microsoft Edge
Microsoft Edge baseline for November 2023 (Edge version 117)
For information about the most recent baseline versions and settings from Microsoft, including versions of this baseline that might not be available through Intune, download the Microsoft Security Compliance Toolkit from the Microsoft Download Center.
Allow unconfigured sites to be reloaded in Internet Explorer mode
Baseline default: DisabledAllow users to proceed from the HTTPS warning page
Baseline default: DisabledAutomatically open downloaded MHT or MHTML files from the web in Internet Explorer mode
Baseline default: DisabledEnable browser legacy extension point blocking
Baseline default: EnabledEnable site isolation for every site
Baseline default: EnabledEnhance images enabled
Baseline default: DisabledForce WebSQL to be enabled
Baseline default: DisabledShow the Reload in Internet Explorer mode button in the toolbar
Baseline default: DisabledSpecifies whether SharedArrayBuffers can be used in a non cross-origin-isolated context
Baseline default: Disabled
Extensions:
Control which extensions cannot be installed
Baseline default: Enabled- Extension IDs the user should be prevented from installing (or * for all) (Device)
Baseline default: *
- Extension IDs the user should be prevented from installing (or * for all) (Device)
HTTP authentication:
Allow Basic authentication for HTTP
Baseline default: DisabledSupported authentication schemes
Baseline default: Enabled
Learn more
Native Messaging:
- Allow user-level native messaging hosts (installed without admin permissions)
Baseline default: Disabled
Private Network Request Settings:
- Specifies whether to allow insecure websites to make requests to more-private network endpoints
Baseline default: Disabled
SmartScreen settings:
Configure Microsoft Defender SmartScreen
Baseline default: Enabled
Learn moreConfigure Microsoft Defender SmartScreen to block potentially unwanted apps
Baseline default: EnabledPrevent bypassing Microsoft Defender SmartScreen prompts for sites
Baseline default: Enabled
Learn morePrevent bypassing of Microsoft Defender SmartScreen warnings about downloads
Baseline default: Enabled
Learn moreConfigure Edge TyposquattingChecker
Baseline default: Enabled
Microsoft Edge baseline for May 2023 (Edge version 112)
For information about the most recent baseline versions and settings from Microsoft, including versions of this baseline that might not be available through Intune, download the Microsoft Security Compliance Toolkit from the Microsoft Download Center.
Allow unconfigured sites to be reloaded in Internet Explorer mode
Baseline default: DisabledAllow users to proceed from the HTTPS warning page
Baseline default: DisabledEnable browser legacy extension point blocking
Baseline default: EnabledEnable site isolation for every site
Baseline default: EnabledEnhance images enabled
Baseline default: DisabledForce WebSQL to be enabled
Baseline default: DisabledMinimum TLS version enabled
Baseline default: Enabled- Minimum SSL version enabled (Device)
Baseline default: TLS 1.2
- Minimum SSL version enabled (Device)
Show the Reload in Internet Explorer mode button in the toolbar
Baseline default: DisabledSpecifies whether SharedArrayBuffers can be used in a non cross-origin-isolated context
Baseline default: Disabled
Extensions:
Control which extensions cannot be installed
Baseline default: Enabled- Extension IDs the user should be prevented from installing (or * for all) (Device)
Baseline default: *
- Extension IDs the user should be prevented from installing (or * for all) (Device)
HTTP authentication:
Allow Basic authentication for HTTP
Baseline default: DisabledSupported authentication schemes
Baseline default: Enabled
Learn moreSupported authentication schemes (Device)
Baseline default: ntlm,negotiate
Native Messaging:
- Allow user-level native messaging hosts (installed without admin permissions)
Baseline default: Disabled
Password manager and protection:
- Enable saving passwords to the password manager
Baseline default: Disabled
Learn more
Private Network Request Settings:
- Specifies whether to allow insecure websites to make requests to more-private network endpoints
Baseline default: Disabled
SmartScreen settings:
Configure Microsoft Defender SmartScreen
Baseline default: Enabled
Learn moreConfigure Microsoft Defender SmartScreen to block potentially unwanted apps
Baseline default: EnabledPrevent bypassing Microsoft Defender SmartScreen prompts for sites
Baseline default: Enabled
Learn morePrevent bypassing of Microsoft Defender SmartScreen warnings about downloads
Baseline default: Enabled
Learn more