Every Edge policy and what it does when you leave it alone

Controls whether ads are blocked on sites with intrusive ads. Policy options mapping: * AllowAds (1) = Allow ads on all sites * BlockAds (2) = Block ads on sites with intrusive ads. (Default value) Use the preceding information when configuring this policy.

This policy controls whether users can enable HTTPS-Only Mode (Always Use Secure Connections) in Settings. HTTPS-Only Mode attempts to upgrade all navigation to HTTPS. If this setting isn't set or is set to Allowed, users are able to enable HTTPS-Only Mode. If this setting is set to Disallowed, HTTPS-Only Mode will be disabled. If this setting is set to Force Enabled, HTTPS-Only Mode is enabled in Strict mode. If this setting is set to Force Balance Enabled, HTTPS-Only Mode is enabled in Balanced mode. The settings Force Enabled and Force Enabled can be recommended to users. HTTPS-Only Mode will be set to Strict or Balanced initially, but users are allowed to change it. If you set this policy to a value that isn't supported by the version of Microsoft Edge that receives the policy, Microsoft Edge defaults to the Allowed setting. The separate HttpAllowlist policy can be used to exempt specific hostnames or hostname patterns from being upgraded to HTTPS by this feature. Policy options mapping: * allowed (allowed) = Don't restrict users' HTTPS-Only Mode setting * disallowed (disallowed) = Disable HTTPS-Only Mode * force_enabled (force_enabled) = Force enable HTTPS-Only Mode in Strict mode * force_balanced_enabled (force_balanced_enabled) = Force enable HTTPS-Only Mode in Balanced Mode Use the preceding information when configuring this policy. Example value: disallowed

If you enable this policy, users will see a prompt to import their browsing data from other browsers on each Microsoft Edge launch. If you disable this policy, users will never see a prompt to import their browsing data from other browsers on each Microsoft Edge launch. If the policy is left unconfigured, users can activate this feature from a Microsoft Edge prompt or from the Settings page. Note: A similar policy named 'AutoImportAtFirstRun' (Automatically import another browser's data and settings at first run) exists. This policy should be used if you want to import supported data from other browsers only once while setting up your device.

OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 120. If you enable this policy, WebRTC peer connections can downgrade to obsolete versions of the TLS/DTLS (DTLS 1.0, TLS 1.0 and TLS 1.1) protocols. If you disable or don't set this policy, these TLS/DTLS versions are disabled. This policy was removed in Microsoft Edge 121 and is ignored if set.

When this policy is set to enabled, extensions installed by enterprise policy are allowed to use the Enterprise Hardware Platform API. When this policy is set to disabled or isn't set, no extensions are allowed to use the Enterprise Hardware Platform API. This policy also applies to component extensions.

Use this policy to control whether websites can access the built-in AI APIs, including the LanguageModel API, Summarization API, Writer API, and Rewriter API. Enable this policy to allow pages to use the APIs. If you don’t configure this policy, the APIs are still allowed. Disable this policy to block access to the APIs. The APIs will return an error when used. For more information, see https://github.com/webmachinelearning/writing-assistance-apis/blob/main/README.md.

This policy allows users to reload unconfigured sites (ones that aren't configured in the Enterprise Mode Site List) in Internet Explorer mode when browsing in Microsoft Edge, and a site requires Internet Explorer for compatibility. After a site is reloaded in Internet Explorer mode, "in-page" navigation stays in Internet Explorer mode (for example, a link, script, or form on the page, or a server-side redirect from another "in-page" navigation). Users can choose to exit from Internet Explorer mode, or Microsoft Edge automatically exits from Internet Explorer mode when a navigation that isn't "in-page" occurs (for example, using the address bar, the back button, or a favorite link). Users can also optionally tell Microsoft Edge to use Internet Explorer mode for the site in the future. This choice is remembered for a length of time managed by the 'InternetExplorerIntegrationLocalSiteListExpirationDays' (Specify the number of days that a site remains on the local IE mode site list) policy. If the 'InternetExplorerIntegrationLevel' (Configure Internet Explorer integration) policy is set to 'IEMode', then sites explicitly configured by the 'InternetExplorerIntegrationSiteList' (Configure the Enterprise Mode Site List) policy's site list to use Microsoft Edge aren't reloaded in Internet Explorer mode, and sites configured by the site list or by the 'SendIntranetToInternetExplorer' (Send all intranet sites to Internet Explorer) policy to use Internet Explorer mode can't exit from Internet Explorer mode. If you enable this policy, users are allowed to reload unconfigured sites in Internet Explorer mode. If you disable this policy, users aren't allowed to reload unconfigured sites in Internet Explorer mode. If you enable this policy, it takes precedence over how you configured the 'InternetExplorerIntegrationTestingAllowed' (Allow Internet Explorer mode testing) policy, and that policy is disabled. For more information about Internet Explorer mode, see https://go.microsoft.com/fwlink/?linkid=2094210

Allows you to set whether websites can check if the user has payment methods saved. If you disable this policy, websites that use PaymentRequest.canMakePayment or PaymentRequest.hasEnrolledInstrument API will be informed that no payment methods are available. If you enable this policy or don't set this policy, websites can check if the user has payment methods saved.

This policy defines a list of allowed HTTPS origins for remote desktop client applications that initiate WebAuthn API requests from a browsing session on a remote host. Origins specified in this policy can request WebAuthn authentication for Relying Party IDs (RP IDs) they wouldn't typically be authorized to claim. Only HTTPS origins are supported. Wildcards aren't permitted. Entries that don't meet these requirements will be ignored. For more information about the WebAuthn Remote Desktop Support feature, see https://github.com/w3c/webauthn/wiki/Explainer:-Remote-Desktop-Support/a4e158c569f456c759d0ddd294a9015bd4d4eb9a. Example value: https://server:8080/

This policy configures the on-device real-time video translation feature in Microsoft Edge. With this feature, users can watch videos translated into their selected language in real time. When a user selects the Translate icon and chooses a source (video language) and target language (translated language), translation components are downloaded on first use (approximately 200 MB per language pair). These components can be updated periodically to improve performance and translation quality. Translation is performed locally on the user’s device and no data is sent outside of the device. The feature is available only for non-DRM videos, on supported high-end devices, with select language pairs, and in select regions. For more information, see https://www.microsoft.com/en-us/edge/features/real-time-video-translation. If you enable or don’t configure this policy, the on-device real-time video translation feature is enabled and users will see the Translate button when hovering over videos. If you disable this policy, the on-device real-time video translation feature is disabled and the Translate button is not shown.

If you enable this policy, all supported datatypes and settings from the specified browser are silently and automatically imported at first run. During the First Run Experience, the import section is also skipped. The browser data from Microsoft Edge Legacy is always silently migrated at the first run, irrespective of the value of this policy. If you set this policy to 'FromDefaultBrowser' to FromDefaultBrowser, then the datatypes corresponding to the default browser on the managed device are imported. If the browser specified as the value of this policy isn't present in the managed device, Microsoft Edge simply skips the import without any notification to the user. If you set this policy to DisabledAutoImport, the import section of the first-run experience is skipped entirely, and Microsoft Edge doesn't import browser data and settings automatically. If you set this policy to FromInternetExplorer, the following datatypes are imported from Internet Explorer: 1. Favorites or bookmarks 2. Saved passwords 3. Search engines 4. Browsing history 5. Home page If you set this policy to FromGoogleChrome, the following datatypes are imported from Google Chrome: 1. Favorites 2. Saved passwords 3. Addresses and more 4. Payment info 5. Browsing history 6. Settings 7. Pinned and Open tabs 8. Extensions 9. Cookies Note: For more details on what is imported from Google Chrome, see https://go.microsoft.com/fwlink/?linkid=2120835 If you set this policy to FromSafari, user data is no longer imported into Microsoft Edge. This is because of the way in which Full Disk Access works on Mac. On macOS Mojave and above, it's no longer possible to have automated and unattended import of Safari data into Microsoft Edge. Starting with Microsoft Edge version 83, if you set this policy to 'FromMozillaFirefox', the following datatypes are imported from Mozilla Firefox: 1. Favorites or bookmarks 2. Saved passwords 3. Addresses and more 4. Browsing History If you want to restrict specific datatypes from getting imported onto the managed devices, use this policy with other policies such as 'ImportAutofillFormData' (Allow importing of autofill form data), 'ImportBrowserSettings' (Allow importing of browser settings), 'ImportFavorites' (Allow importing of favorites), and so on. Policy options mapping: * FromDefaultBrowser (0) = Automatically imports all supported datatypes and settings from the default browser * FromInternetExplorer (1) = Automatically imports all supported datatypes and settings from Internet Explorer * FromGoogleChrome (2) = Automatically imports all supported datatypes and settings from Google Chrome * FromSafari (3) = Automatically imports all supported datatypes and settings from Safari * DisabledAutoImport (4) = Disables automatic import, and the import section of the first-run experience is skipped * FromMozillaFirefox (5) = Automatically imports all supported datatypes and settings from Mozilla Firefox Use the preceding information when configuring this policy.

This policy controls how long specific types of browsing data are retained. If Sync is enabled, this policy has no effect. You can specify the following data types: 'browsing_history' 'download_history' 'cookies_and_other_site_data' 'cached_images_and_files' 'password_signin' 'autofill' 'site_settings' 'hosted_app_data' Microsoft Edge periodically deletes data of the selected types that's older than the value set by 'time_to_live_in_hours'. Expired data is removed 15 seconds after browser startup and every hour while the browser is running. Note: Deleting cookies using this policy doesn't sign the user out of their profile, the user stays signed in. Example value: [ { "data_types": [ "browsing_history" ], "time_to_live_in_hours": 24 }, { "data_types": [ "password_signin", "autofill" ], "time_to_live_in_hours": 12 } ]

Specifies the list of Microsoft Edge for Business Data Loss Prevention Connector service settings that apply when users paste data from the clipboard or drag and drop web content into Microsoft Edge. Connector Fields 1. url_list, tags, enable, disable These fields determine whether the connector sends data for analysis when content is entered on a specific page, and which tags to include in the analysis request. A tag associated with an enable pattern is included in the request if the page URL matches the pattern—unless a corresponding disable pattern also matches. Analysis is triggered if at least one tag is included in the request. 2. service_provider Identifies the analysis service provider the configuration applies to. 3. block_until_verdict If set to 1, Microsoft Edge waits for a response from the analysis service before giving the page access to the data. Any other integer value allows the page to access the data immediately. 4. default_action If set to block, Microsoft Edge denies page access to the data if an error occurs while contacting the analysis service. Any other value permits the page to access the data. 5. minimum_data_size Specifies the minimum size (in bytes) that the entered data must meet or exceed to be scanned. Default: 100 bytes if the field isn't set. This policy requires further setup to take effect. For configuration guidance, see https://go.microsoft.com/fwlink/?linkid=2320413. Example value: [ { "block_until_verdict": 0, "default_action": "allow", "disable": [ { "tags": [ "malware" ], "url_list": [ "*.us.com" ] } ], "enable": [ { "tags": [ "malware" ], "url_list": [ "*" ] }, { "tags": [ "dlp" ], "url_list": [ "*.them.com", "*.others.com" ] } ], "minimum_data_size": 100, "service_provider": "local_system_agent" } ]

Specifies the list of Microsoft Edge for Business Data Loss Prevention Connectors service settings that apply when users attach files in Microsoft Edge. Connector Fields 1. url_list, tags, enable, disable These fields determine whether the connector sends data for analysis when content is entered on a specific page, and which tags to include in the analysis request. A tag associated with an enable pattern is included in the request if the page URL matches the pattern—unless a corresponding disable pattern also matches. Analysis is triggered if at least one tag is included in the request. 2. service_provider Identifies the analysis service provider the configuration applies to. 3. block_until_verdict If set to 1, Microsoft Edge waits for a response from the analysis service before giving the page access to the data. Any other integer value allows the page to access the data immediately. 4. default_action If set to block, Microsoft Edge denies page access to the data if an error occurs while contacting the analysis service. Any other value permits the page to access the data. This policy requires additional setup to take effect. For configuration guidance, see https://go.microsoft.com/fwlink/?linkid=2320413. Example value: [ { "block_until_verdict": 0, "default_action": "allow", "disable": [ { "tags": [ "malware" ], "url_list": [ "*.us.com" ] } ], "enable": [ { "tags": [ "malware" ], "url_list": [ "*" ] }, { "tags": [ "dlp" ], "url_list": [ "*.them.com", "*.others.com" ] } ], "service_provider": "local_system_agent" } ]

Defines the Microsoft Edge for Business Reporting Connectors service settings that apply when a security event occurs in Microsoft Edge. These events include negative verdicts from Data Loss Prevention Connectors, password reuse, navigation to unsafe pages, and other security-sensitive actions. The service_provider field specifies the reporting service provider. The enabled_event_names field lists the security events enabled for that provider. This policy can only be configured through the Microsoft 365 Admin Center. It requires additional setup to take effect. For configuration guidance, see https://go.microsoft.com/fwlink/?linkid=2325446. Example value: [ { "enabled_event_names": [ "passwordChangedEvent", "sensitiveDataEvent" ], "enabled_opt_in_events": [ { "name": "loginEvent", "url_patterns": [ "*" ] }, { "name": "passwordBreachEvent", "url_patterns": [ "example.com", "other.example.com" ] } ], "service_provider": "microsoft" } ]

Specifies the list of Microsoft Edge for Business Data Loss Prevention Connectors service settings that apply when users print a page or file from Microsoft Edge. Connector Fields 1. url_list, tags, enable, disable These fields determine whether the connector sends data for analysis when content is entered on a specific page, and which tags to include in the analysis request. A tag associated with an enable pattern is included in the request if the page URL matches the pattern—unless a corresponding disable pattern also matches. Analysis is triggered if at least one tag is included in the request. 2. service_provider Identifies the analysis service provider the configuration applies to. 3. block_until_verdict If set to 1, Microsoft Edge waits for a response from the analysis service before giving the page access to the data. Any other integer value allows the page to access the data immediately. 4. default_action If set to block, Microsoft Edge denies page access to the data if an error occurs while contacting the analysis service. Any other value permits the page to access the data. This policy requires additional setup to take effect. For configuration guidance, see https://go.microsoft.com/fwlink/?linkid=2320413. Example value: [ { "block_until_verdict": 0, "default_action": "allow", "disable": [ { "tags": [ "dlp" ], "url_list": [ "*.us.com" ] } ], "enable": [ { "tags": [ "dlp" ], "url_list": [ "*.them.com", "*.others.com" ] } ], "service_provider": "local_system_agent" } ]

Enables the use of Azure Active Directory (Azure AD) accounts for automatic sign in if your users' machines are Domain Joined and if your environment isn't hybrid joined. If you want users automatically signed in with their Azure AD accounts instead, Azure AD join (See https://go.microsoft.com/fwlink/?linkid=2118197 for more information) or hybrid join (See https://go.microsoft.com/fwlink/?linkid=2118365 for more information) your environment. On every launch, Microsoft Edge tries to sign in using this policy, as long as the first profile being launched isn't signed in or an auto sign in doesn't happen before. If you configure the 'BrowserSignin' (Browser sign-in settings) policy to disabled, this policy doesn't take any effect. If you enable this policy and set it to 'SignInAndMakeDomainAccountNonRemovable', Microsoft Edge automatically signs in users that are on domain-joined machines using their Azure AD accounts. If you set this policy to 'Disabled' or don't set it, Microsoft Edge doesn't automatically sign in users that are on domain-joined machines with Azure AD accounts. From Microsoft Edge version 89, if there's an existing on-premises profile with 'RoamingProfileSupportEnabled' (Enable using roaming copies for Microsoft Edge profile data) policy disabled, and if the machine is now hybrid joined, that is, it has an Azure AD account, it autoupgrades the on-premises profile to Azure AD profile to get full Azure AD sync facilities. From Microsoft Edge version 93, if policy 'ImplicitSignInEnabled' (Enable implicit sign-in) is disabled, this policy doesn't take any effect. From Microsoft Edge version 94, if policy 'OnlyOnPremisesImplicitSigninEnabled' (Only on-premises account enabled for implicit sign-in) is enabled, and this policy is set to 'SignInAndMakeDomainAccountNonRemovable', it takes effect even on hybrid-joined environment. Microsoft Edge automatically signs in users using their Azure AD domain account even if there are Microsoft Account (MSA) or Azure AD accounts. Policy options mapping: * Disabled (0) = Disabled * SignInAndMakeDomainAccountNonRemovable (1) = Sign in and make domain account non-removable Use the preceding information when configuring this policy.

For guidance about configuring the optimal experience for Internet Explorer mode see https://go.microsoft.com/fwlink/?linkid=2094210 Policy options mapping: * None (0) = None * IEMode (1) = Internet Explorer mode * NeedIE (2) = Internet Explorer 11 Use the preceding information when configuring this policy.

OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 109. This policy is deprecated as it served only as a short-term mechanism to give enterprises more time to update their environments and report issues if they're found to be incompatible with Hardware-enforced Stack Protection. It doesn't work in Microsoft Edge starting with version 109. Microsoft Edge includes a Hardware-enforced Stack Protection security feature. This feature can result in the browser crashing unexpectedly in cases that don't represent an attempt to compromise the browser's security. Using this policy, you can control the behavior of the Hardware-enforced Stack Protection feature after a crash triggered by this feature is encountered. Set this policy to 'Disable' to disable the feature. Set this policy to 'DisableUntilUpdate' to disable the feature until Microsoft Edge updates next time. Set this policy to 'Enable' to keep the feature enabled. Policy options mapping: * Disable (0) = Disable Hardware-enforced Stack Protection * DisableUntilUpdate (1) = Disable Hardware-enforced Stack Protection until the next Microsoft Edge update * Enable (2) = Enable Hardware-enforced Stack Protection Use the preceding information when configuring this policy.

For guidance about configuring the optimal experience for Internet Explorer mode see https://go.microsoft.com/fwlink/?linkid=2094210 Example value: https://internal.contoso.com/sitelist.xml

Configure the list of Microsoft Edge commands for which keyboard shortcuts must be disabled. See https://go.microsoft.com/fwlink/?linkid=2186950 for a list of possible commands to disable. If you enable this policy, commands in the 'disabled' list are no longer activated by keyboard shortcuts. If you disable this policy, all keyboard shortcuts behave as usual. Note: Disabling a command only removes its shortcut mapping. Commands in the 'disabled' list still function if accessed via browser UI. Example value: { "disabled": [ "new_tab", "fullscreen" ] } Compact example value: {"disabled": ["new_tab", "fullscreen"]}

Configure the list of enhance security untrusted domains. This means that enhance security mode is always enforced when loading the sites in untrusted domains. Example value: mydomain.com myuniversity.edu

Configures the list of enhance security trusted domains. This means that enhance security mode isn't enforced when loading the sites in trusted domains. Example value: mydomain.com myuniversity.edu

Setting the policy specifies a list of hostnames that bypass preloaded HSTS (HTTP Strict Transport Security) upgrades from http to https. Only single-label hostnames are allowed in this policy, and this policy only applies to static HSTS-preloaded entries (for example, "app", "new", "search", and "play"). This policy doesn't prevent HSTS upgrades for servers that have dynamically requested HSTS upgrades using a Strict-Transport-Security response header. Supplied hostnames must be canonicalized: Any IDNs must be converted to their A-label format, and all ASCII letters must be lowercase. This policy only applies to the specific single-label hostnames specified and not to subdomains of those names. Example value: meet

OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 129. This policy is obsolete because Token Binding is no longer supported, starting with Microsoft Edge 130. Configure the list of URL patterns for sites that the browser attempts to perform the Token Binding protocol with. For the domains on this list, the browser sends the Token Binding ClientHello in the TLS handshake (See https://tools.ietf.org/html/rfc8472). If the server responds with a valid ServerHello response, the browser creates and sends Token Binding messages on subsequent https requests. See https://tools.ietf.org/html/rfc8471 for more info. If this list is empty, Token Binding is disabled. This policy is only available on Windows 10 devices with Virtual Secure Mode capability. Starting in Microsoft Edge 86, this policy no longer supports dynamic refresh. Example value: mydomain.com [*.]mydomain2.com [*.].mydomain2.com

If you enable this policy, all the specified data types are excluded from synchronization. This policy can be used to limit the type of data uploaded to the Microsoft Edge synchronization service. You can provide one of the following data types for this policy: "favorites", "settings", "passwords", "addressesAndMore", "extensions", "history", "openTabs", "edgeWallet", "collections", "apps", and "edgeFeatureUsage". The "edgeFeatureUsage" data type are supported starting in Microsoft Edge version 134. These data type names are case sensitive. Users can't override the disabled data types. Example value: favorites

If you enable this policy, all the specified data types are included for synchronization for Azure AD/Azure AD-Degraded user profiles. This policy can be used to ensure the type of data uploaded to the Microsoft Edge synchronization service. You can provide one of the following data types for this policy: "favorites", "settings", "passwords", "addressesAndMore", "extensions", "history", "openTabs", "edgeWallet", "collections", "apps", and "edgeFeatureUsage". The "edgeFeatureUsage" data type is supported starting in Microsoft Edge version 134. Note that these data type names are case sensitive. Users can't override the enabled data types. Example value: favorites

If you set this policy to 'ShareAllowed' (the default), users can access the Share experience from the Settings and More Menu in Microsoft Edge to share with other apps on the system. If you set this policy to 'ShareDisallowed', users can't access the Share experience. If the Share button is on the toolbar, it's hidden as well. Policy options mapping: * ShareAllowed (0) = Allow using the Share experience * ShareDisallowed (1) = Don't allow using the Share experience Use the preceding information when configuring this policy.

OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 130. This policy provides a temporary opt-out for two related fixes to the behavior of the confirmation dialog that’s shown by the beforeunload event. If you've enabled this policy, the new (correct) behavior is used. If you've disabled this policy, the old (legacy) behavior is used. If you haven't configured this policy, the default behavior is used. Note: This policy is a temporary workaround and is going to be removed in a future release. New and correct behavior: In `beforeunload`, calling `event.preventDefault()` triggers the confirmation dialog. Setting `event.returnValue` to the empty string doesn’t trigger the confirmation dialog. Old and legacy behavior: In `beforeunload`, calling `event.preventDefault()` doesn’t trigger the confirmation dialog. Setting `event.returnValue` to the empty string triggers the confirmation dialog.

Controls whether users can access developer tools in Microsoft Edge. If you set this policy to 'DeveloperToolsDisallowedForForceInstalledExtensions' (default), users can access developer tools and the JavaScript console, except in the context of extensions installed by enterprise policy. If you set this policy to 'DeveloperToolsAllowed', users can access developer tools and the JavaScript console in all contexts, including extensions installed by enterprise policy. If you set this policy to 'DeveloperToolsDisallowed', users cannot access developer tools or inspect website elements. Keyboard shortcuts, menu options, and context menu entries that open developer tools or the JavaScript console are disabled. As of version 99, this policy also controls access to the 'View page source' feature. If you set this policy to 'DeveloperToolsDisallowed', users cannot view page source through keyboard shortcuts or the context menu. To fully block source viewing, add 'view-source:*' to the 'URLBlocklist' (Block access to a list of URLs) policy. As of version 119, this policy also controls whether developer mode for Isolated Web Apps can be enabled. As of version 128, this policy does not control developer mode on the extensions page if the 'ExtensionDeveloperModeSettings' (Control the availability of developer mode on extensions page) policy is configured. Developer tools availability is determined in the following order of precedence: 1. If a URL matches a pattern in 'DeveloperToolsAvailabilityAllowlist' (List of URL patterns for which developer tools are allowed to be opened), developer tools are allowed. 2. If the allowlist is configured and the blocklist is not, URLs not on the allowlist are blocked. 3. If a URL matches a pattern in 'DeveloperToolsAvailabilityBlocklist' (List of URL patterns for which developer tools are blocked), developer tools are blocked. 4. If a URL is not covered by either list, this policy ('DeveloperToolsAvailability' (Control where developer tools can be used)) applies. Policy options mapping: * DeveloperToolsDisallowedForForceInstalledExtensions (0) = Block the developer tools on extensions installed by enterprise policy, allow in other contexts * DeveloperToolsAllowed (1) = Allow using the developer tools * DeveloperToolsDisallowed (2) = Don't allow using the developer tools Use the preceding information when configuring this policy.

Specifies a list of origins (URLs) or hostname patterns (like "*.contoso.com") for which security restrictions on insecure origins don't apply. This policy allows you to specify permitted origins for legacy applications that can't deploy TLS or for internal web development staging servers. It enables developers to test features requiring secure contexts without the need to configure TLS on the staging server. Patterns are only accepted for hostnames; URLs or origins with schemes must be exact matches. This policy also prevents the origin from being labeled "Not Secure" in the omnibox. Setting a list of URLs in this policy has the same effect as setting the command-line flag '--unsafely-treat-insecure-origin-as-secure' to a comma-separated list of the same URLs. If you enable this policy, it overrides the command-line flag. For more information on secure contexts, see https://www.w3.org/TR/secure-contexts/. Example value: http://testserver.contoso.com/ *.contoso.com

Disables data synchronization in Microsoft Edge. This policy also prevents the sync consent prompt from appearing. This policy disables cloud synchronization only and has no impact on the 'RoamingProfileSupportEnabled' (Enable using roaming copies for Microsoft Edge profile data) policy. If you don't set this policy or apply it as recommended, users can turn on or turn off sync. If you apply this policy as mandatory, users won't be able to turn on sync.

Lets you display zoom in IE Mode tabs similar to how it was displayed in Internet Explorer, where the DPI scale of the display is factored in. For example, if you have a page zoomed to 200% on a 100 DPI scale display and you change the display to 150 DPI, Microsoft Edge would still display the zoom as 200%. However, Internet Explorer factors in the DPI scale and displays 300%. If you enable this policy, zoom values will be displayed with the DPI scale included for IE Mode tabs. If you disable or don't configure this policy, zoom values will be displayed without DPI scale included for IE Mode tabs

This policy configures a local switch that can be used to disable DNS interception checks. These checks attempt to discover whether the browser is behind a proxy that redirects unknown host names. This detection might not be necessary in an enterprise environment where the network configuration is known. It can be disabled to avoid additional DNS and HTTP traffic on start-up and each DNS configuration change. If you enable or don't set this policy, the DNS interception checks are performed. If you disable this policy, DNS interception checks aren't performed.

This policy configures a single global per profile cache with HTTP server authentication credentials. If you disable or don't set this policy, the browser uses the default behavior of cross-site auth. This behavior is to scope HTTP server authentication credentials by top-level site. So, if two sites use resources from the same authenticating domain, credentials need to be provided independently in the context of both sites. Cached proxy credentials are reused across sites. If you enable this policy, HTTP auth credentials entered in the context of one site is automatically used in the context of another site. Enabling this policy leaves sites open to some types of cross-site attacks, and allows users to be tracked across sites even without cookies by adding entries to the HTTP auth cache using credentials embedded in URLs. This policy is intended to give enterprises depending on the legacy behavior a chance to update their login procedures and will be removed in the future.

Enable support for Signed HTTP Exchange (SXG). If this policy isn't set or enabled, Microsoft Edge accepts web contents served as Signed HTTP Exchanges. If this policy is set to disabled, Signed HTTP Exchanges can't be loaded.

This policy controls whether or not the network service process runs sandboxed. If this policy is enabled, the network service process runs sandboxed. If this policy is disabled, the network service process runs unsandboxed. This leaves users open to other security risks related to running the network service unsandboxed. If this policy isn't set, the default configuration for the network sandbox will be used. This may vary depending on Microsoft Edge release, currently running field trials, and platform. This policy is intended to give enterprises flexibility to disable the network sandbox if they use third party software that interferes with the network service sandbox.

DEPRECATED: This policy is deprecated. It is currently supported but will become obsolete in a future release. This policy is deprecated because we are moving to a new policy. It won't work in Microsoft Edge as soon as version 104. The new policy to use is 'EdgeAssetDeliveryServiceEnabled' (Allow features to download assets from the Asset Delivery Service). Lets you enable or disable background updates to the list of available templates for Collections and other features that use templates. Templates are used to extract rich metadata from a webpage when the page is saved to a collection. If you enable this setting or the setting is unconfigured, the list of available templates are downloaded in the background from a Microsoft service every 24 hours. If you disable this setting the list of available templates are downloaded on demand. This type of download might result in small performance penalties for Collections and other features.

This policy lets you enhance the security state in Microsoft Edge. If you set this policy to 'StandardMode', the enhanced mode is turned off, and Microsoft Edge falls back to its standard security mode. If you set this policy to 'BalancedMode', the security state is in balanced mode. If you set this policy to 'StrictMode', the security state is in strict mode. If you set this policy to 'BasicMode', the security state is in basic mode. Note: Sites that use WebAssembly (WASM) aren't supported on 32-bit systems when 'EnhanceSecurityMode' (Enhance the security state in Microsoft Edge) is enabled. If you require access to a site that uses WASM, consider adding it to your exception list as described in https://go.microsoft.com/fwlink/?linkid=2183321. Starting from Microsoft Edge version 113, 'BasicMode' is deprecated and is treated the same as 'BalancedMode'. It doesn't work in Microsoft Edge version 116. For detailed information about Enhanced Security Mode, see https://go.microsoft.com/fwlink/?linkid=2185895. Policy options mapping: * StandardMode (0) = Standard mode * BalancedMode (1) = Balanced mode * StrictMode (2) = Strict mode * BasicMode (3) = (Deprecated) Basic mode Use the preceding information when configuring this policy.

If you enable this policy, the top autosuggest result in the address bar suggestion list navigates to intranet sites if the text entered in the address bar is a single word without punctuation. Default navigation when typing a single word without punctuation conducts a navigation to an intranet site matching the entered text. If you enable this policy, the second autosuggest result in the address bar suggestion list conducts a web search exactly as it was entered, if this text is a single word without punctuation. The default search provider is used unless a policy to prevent web search is also enabled. Two effects of enabling this policy are: Navigation to sites in response to single word queries that would typically resolve to a history item will no longer happen. Instead, the browser will attempt navigate to internal sites that may not exist in an organization's intranet. This will result in a 404 error. Popular, single-word search terms will require manual selection of search suggestions to properly conduct a search.

Force-disables spellcheck languages. Unrecognized languages in that list will be ignored. If you enable this policy, spellcheck will be disabled for the languages specified. The user can still enable or disable spellcheck for languages not in the list. If you don't set this policy, or disable it, there is no change to the user's spellcheck preferences. If the 'SpellcheckEnabled' (Enable spellcheck) policy is set to disabled, this policy has no effect. If a language is included in both the 'SpellcheckLanguage' (Enable specific spellcheck languages) and the 'SpellcheckLanguageBlocklist' policy, the spellcheck language is enabled. Example value: fr es

This policy gives an option to hide the "Restore pages" dialog after Microsoft Edge has crashed. The "Restore pages" dialog gives users the option to restore the pages that were previously open before Microsoft Edge crashed. If you enable this policy, the "Restore pages" dialog isn't shown. In the event of a crash, Microsoft Edge doesn't restore previous tabs and starts the session with a new tab page. If you disable or don't set this policy, the "Restore pages" dialog is shown. If you set this policy, don't set the 'ClearBrowsingDataOnExit' (Clear browsing data when Microsoft Edge closes) or 'SavingBrowserHistoryDisabled' (Disable saving browser history) policy since that prevents history from being saved which also disables the dialog.

This policy gives an option to disable one-time redirection dialog and the banner. If you enable this policy, users don't see both the one-time dialog and the banner. Users continue to be redirected to Microsoft Edge when they encounter an incompatible website on Internet Explorer; however, their browsing data isn't imported. - If you enable this policy, the one-time redirection dialog and banner are never shown to users. Users' browsing data isn't imported when a redirection happens. - If you disable or don't set this policy, the redirection dialog is shown on the first redirection, and the persistent redirection banner is shown to users on sessions that begin with a redirection. Users' browsing data will be imported every time user encounters such redirection (ONLY IF user consents to it on the one-time dialog).

Setting the policy specifies a list of hostnames or hostname patterns (such as '[*.]example.com') that won't be upgraded to HTTPS. Organizations can use this policy to maintain access to servers that don't support HTTPS, without needing to disable 'HttpsUpgradesEnabled' (Enable automatic HTTPS upgrades). Supplied hostnames must be canonicalized: Any IDNs must be converted to their A-label format, and all ASCII letters must be lowercase. Blanket host wildcards (that is, "*" or "[*]") aren't allowed. Instead, HTTPS-First Mode and HTTPS Upgrades should be explicitly disabled via their specific policies. Note: This policy doesn't apply to HSTS upgrades. Example value: testserver.example.com [*.]example.org

This policy allows you to override the value returned by the CPU Performance API (that is, navigator.cpuPerformance). If you enable this policy, the value of navigator.cpuPerformance is overridden with the specified value. If you don’t configure this policy, the default performance tier calculation is used. You can specify a value from 0 through 4. For more information, see https://github.com/WICG/cpu-performance.