Harden Microsoft Edge with Group Policy and Intune

The browser is where users meet the internet: phishing pages, malicious downloads, rogue extensions that read every page, and exploits that target the renderer. Microsoft Edge has good protections built in, but most of them are either user-controllable or off by default. Enterprise policy turns them into something you can enforce and prove.

This guide covers the policies that matter most for security. It is part of the Attack Surface Reduction series and pairs with exploit protection, which hardens other applications the way Edge hardens itself.

Prerequisites

• Edge ADMX templates (msedge.admx, and msedgeupdate.admx for updates) from the Microsoft Edge for Business download page, copied to the central store. Update them with each major Edge release, because new policies appear regularly.
• Settings appear under Computer Configuration > Policies > Administrative Templates > Microsoft Edge, and are written to HKLM\SOFTWARE\Policies\Microsoft\Edge.
• Intune: the settings catalog has a Microsoft Edge category, and Endpoint security > Security baselines includes a Microsoft Edge baseline you can start from.

Use the mandatory folder above for security settings. The Microsoft Edge - Default Settings (users can override) folder is for preferences, not controls.

Step 1: enforce SmartScreen

SmartScreen blocks known phishing and malware sites and warns on unknown downloads. The key is to stop users clicking through.

Also enable the typosquatting checker (TyposquattingCheckerEnabled = 1) in the same area. Blocking download overrides is the one that generates tickets: developers and admins downloading new tools hit unknown-reputation warnings. Handle those with a proper software request path rather than leaving the override open for everyone.

Step 2: restrict risky downloads

Microsoft Edge > Allow download restrictions (DownloadRestrictions):

Value 1 is a sensible fleet default; 2 fits high-risk roles. Combine it with the Office macro hardening so the documents that do get through still arrive with the Mark of the Web and hit Protected View.

Step 3: control extensions

Extensions run with broad access to the pages users visit, including session cookies. A malicious or sold-on extension is effectively a credential stealer that updates itself. Move to an allowlist:

1. Inventory. On a sample of devices, list installed extensions from edge://extensions or from the Extensions folders under each profile in %LOCALAPPDATA%\Microsoft\Edge\User Data. Your EDR or inventory tool may already report them.
2. Approve. Keep a short list of extension IDs with an owner and a business reason.
3. Enforce. Under Microsoft Edge > Extensions:
   • Control which extensions cannot be installed (ExtensionInstallBlocklist) = *
   • Allow specific extensions to be installed (ExtensionInstallAllowlist) = the approved IDs
   • Control which extensions are installed silently (ExtensionInstallForcelist) for the ones everyone needs, such as your password manager
   • Blocks external extensions from being installed (BlockExternalExtensions) = Enabled

For finer control, Configure extension management settings (ExtensionSettings) takes JSON and can block extensions requesting specific permissions or restrict install sources. It overrides the simpler policies when both are set, so pick one approach and document it.

Step 4: enable enhanced security mode

Enhanced security mode disables the JavaScript JIT on unfamiliar sites and turns on OS mitigations such as Arbitrary Code Guard and, on supported CPUs, hardware-enforced stack protection for the renderer. That removes a large class of browser exploits.

Microsoft Edge > Enhance the security state in Microsoft Edge (EnhanceSecurityMode):

Use Balanced for the fleet and Strict for administrators and finance. If an internal web app becomes too slow, exempt it with Configure the list of domains for which enhance security mode will not be enforced (EnhanceSecurityModeBypassListDomains) rather than lowering the mode for everyone. The enforce list does the reverse for sites you consider risky.

Step 5: close the other doors

Leave SitePerProcess, RendererAppContainerEnabled and AudioSandboxEnabled at their secure defaults, and alert if a policy turns them off.

Step 6: update fast and force the restart

Browser zero-days are patched in days. Edge updates itself, but only takes effect after a restart, and users keep browsers open for weeks.

• Computer Configuration > Policies > Administrative Templates > Microsoft Edge Update > Applications > Update policy override default = Always allow updates (UpdateDefault = 1 under HKLM\SOFTWARE\Policies\Microsoft\EdgeUpdate). Make sure no older GPO sets it to disabled.
• Microsoft Edge > Notify a user that a browser restart is recommended or required for pending updates (RelaunchNotification) = Required (2), with Set the time period for update notifications (RelaunchNotificationPeriod) at, for example, 86400000 ms (24 hours).
• If you use WSUS or Configuration Manager to deliver Edge instead, keep the channel and the approval cadence fast; weekly is too slow for actively exploited browser bugs.

The broader update picture, including the prioritisation of browsers, is in the patching guide.

Other browsers on the same devices

Hardening Edge does little if users can install and run an unmanaged browser next to it. Decide on a supported browser list and treat each one the same way:

• Chrome uses near-identical policy names (ExtensionInstallBlocklist, ExtensionInstallAllowlist, DownloadRestrictions, RemoteDebuggingAllowed, SSLErrorOverrideAllowed) under HKLM\SOFTWARE\Policies\Google\Chrome. Import Google's ADMX templates and mirror the Edge settings.
• Firefox has its own policy engine (a policies.json file or ADMX templates). The concepts carry over, the names do not.
• Unsupported browsers installed per user in %LOCALAPPDATA% escape both policy and patching. Block them with application control or at least detect them through inventory.

Whatever you allow, it must be patched as fast as Edge. The third-party patching guide covers how to keep browsers and their runtimes current outside Windows Update.

What breaks

• Downloads of new tools blocked by SmartScreen without override. Provide a request path.
• Extensions users relied on disappear when the blocklist lands. Announce it, publish the approved list, and review requests weekly for the first month.
• Internal sites with self-signed or expired certificates become unreachable once overrides are disabled. Fix the certificates; this is a finding, not a nuisance.
• Heavy internal web apps slow down in strict enhanced security mode. Use the bypass list.
• Web-based admin consoles using Basic auth over HTTP stop authenticating.

Verify it

On a device, open edge://policy. Every configured policy should show Status: OK and Source: Platform (Group Policy or MDM). Errors there usually mean a wrong value type or an obsolete policy name. edge://settings/help shows the version.

From PowerShell:

Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Edge" |
  Select-Object SmartScreenEnabled, PreventSmartScreenPromptOverride,
    PreventSmartScreenPromptOverrideForFiles, DownloadRestrictions,
    EnhanceSecurityMode, SSLErrorOverrideAllowed, RemoteDebuggingAllowed

Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallBlocklist"
(Get-Item "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe").VersionInfo.ProductVersion

Report the Edge version fleet-wide and alert on devices more than one stable release behind.

Checklist

• Current Edge and Edge Update ADMX templates in the central store, or Intune Edge baseline in use
• SmartScreen enforced, overrides blocked for sites and downloads, PUA blocking on
• Download restrictions set to block dangerous downloads or stricter
• Extension blocklist * with a reviewed allowlist and owner per extension
• Enhanced security mode Balanced for all, Strict for high-risk roles
• Certificate error overrides and remote debugging disabled
• Automatic updates allowed and restart required within 24 hours
• edge://policy checked on pilot devices; version reported fleet-wide