Microsoft Edge

—

Allows you to set whether websites are allowed to set local data. Setting local data can be either allowed for all websites or denied for all websites.

Enabling this setting prevents cookies from being set by web page elements that are not from the domain that is in the browser's address bar.

Allows you to set a list of url patterns that specify sites which are allowed to set cookies.

Allows you to set a list of url patterns that specify sites which are not allowed to set cookies.

Cookies set by pages matching these URL patterns will be limited to the current session, i.e. they will be deleted when the browser exits.

Allows you to set whether websites are allowed to display images. Displaying images can be either allowed for all websites or denied for all websites.

Control use of insecure content exceptions

List of URLs to allow insecure content

List of URLs to block insecure content

Allows you to set whether websites are allowed to run JavaScript. Running JavaScript can be either allowed for all websites or denied for all websites.

Allows you to set whether websites are allowed to automatically run the Flash plugin. Automatically running the Flash plugin can be either allowed for all websites or denied for all websites.

Allows you to set whether websites are allowed to show pop-ups. Showing popups can be either allowed for all websites or denied for all websites.

Allows you to set whether websites are allowed to get access to nearby Bluetooth devices. Access can be completely blocked, or the user can be asked every time a website wants to get access to nearby Bluetooth devices.

Allows you to set whether websites are allowed to get access to connected USB devices. Access can be completely blocked, or the user can be asked every time a website wants to get access to connected USB devices.

Allows you to set a list of url patterns that specify sites which are allowed to display images.

Allows you to set a list of url patterns that specify sites which are not allowed to display images.

Allows you to set a list of url patterns that specify sites which are allowed to run JavaScript.

Allows you to set a list of url patterns that specify sites which are not allowed to run JavaScript.

Enable default legacy SameSite cookie behavior setting

Revert to legacy SameSite behavior for cookies on specified sites

Allows you to set a list of url patterns that specify sites which are allowed to run the Flash plugin.

Allows you to set a list of url patterns that specify sites which are not allowed to run the Flash plugin.

Third-party storage partitioning is on by default for some users starting with Microsoft Edge version 115, but it can be disabled with edge://flags. If this policy is configured to "AllowPartitioning" or not configured, third-party storage partitioning can be enabled. If this policy is set to "BlockPartitioning", third-party storage partitioning can't be enabled.

Lets you set a list of url patterns that specify top-level origins (the url in the tab's address bar) that block third-party (cross-origin iframe) storage partitioning. If this policy isn't set or a top-level origin doesn't match, then the value from DefaultThirdPartyStoragePartitioningSetting will be used.

Allows you to set a list of url patterns that specify sites which are allowed to open popups.

Allows you to set a list of url patterns that specify sites which are not allowed to open popups.

Allows you to specify a list of url patterns that specify sites for which Google Chrome should automatically select a client certificate, if the site requests a certificate.

Allows you to set whether websites are allowed to track the users' physical location. Tracking the users' physical location can be allowed by default, denied by default or the user can be asked every time a website requests the physical location.

Allows you to register a list of protocol handlers. This can only be a recommended policy. The property |protocol| should be set to the scheme such as 'mailto' and the property |url| should be set to the URL pattern of the application that handles the scheme. The pattern can include a '%s', which if present will be replaced by the handled URL.

Allows you to set a list of urls that specify which sites will automatically be granted permission to access a USB device with the given vendor and product IDs.

Allows you to control if videos can play automatically (without user consent) with audio content in Google Chrome.

Continue running background apps after Microsoft Edge closes.

If you enable this setting or the setting is unconfigured, the list of available templates will be downloaded in the background from a Microsoft service every 24 hours.

Block all ads on Bing search results.

Allows you to set whether websites are allowed to display desktop notifications. Displaying desktop notifications can be allowed by default, denied by default or the user can be asked every time a website wants to show desktop notifications.

Allows you to create a list of url patterns to specify sites that are allowed to display notifications.

Allows you to create a list of url patterns to specify sites that are not allowed to display notifications.

Enables the use of a default search provider.

Specifies the character encodings supported by the search provider. Encodings are code page names like UTF-8, GB2312, and ISO-8859-1. They are tried in the order provided.

Specifies the URL of the search engine used to provide image search. Search requests will be sent using the GET method. If the DefaultSearchProviderImageURLPostParams policy is set then image search requests will use the POST method instead.

Specifies the parameters used when doing image search with POST. It consists of comma-separated name/value pairs. If a value is a template parameter, like {imageThumbnail} in above example, it will be replaced with real image thumbnail data.

Specifies the keyword, which is the shortcut used in the omnibox to trigger the search for this provider.

Specifies the name of the default search provider. If left empty or not set, the host name specified by the search URL will be used.

Specifies the URL of the search engine used when doing a default search. The URL should contain the string '{searchTerms}', which will be replaced at query time by the terms the user is searching for.

Specifies the URL of the search engine used to provide search suggestions. The URL should contain the string '{searchTerms}', which will be replaced at query time by the text the user has entered so far.

Controls the installation of external extensions.

Controls which app/extension types are allowed to be installed and limits runtime access.

Allows you to specify which URLs are allowed to install extensions, apps, and themes.

Allows you to specify which extensions the users can NOT install. Extensions already installed will be disabled if denied, without a way for the user to enable them. Once an extension is disabled due to the denylist being removed, it will automatically get re-enabled.

Allows you to specify which extensions are not subject to the denylist.

Specifies a list of apps and extensions that are installed silently, without user interaction, and which cannot be uninstalled nor disabled by the user. All permissions requested by the apps/extensions are granted implicitly, without user interaction, including any additional permissions requested by future versions of the app/extension. Furthermore, permissions are granted for the enterprise.deviceAttributes and enterprise.platformKeys extension APIs. (These two APIs are not available to apps/extensions that are not force-installed.)

Configures extension management settings for Google Chrome. A default configuration can be set for the special ID "*"

If this policy is set to true or is not set, Google Cast will be enabled, and users will be able to launch it from the app menu, page context menus, media controls on Cast-enabled websites, and (if shown) the Cast toolbar icon.

If this policy is set to true, the Cast toolbar icon will always be shown on the toolbar or the overflow menu, and users will not be able to remove it.

Controls whether third-party sub-content on a page is allowed to pop-up an HTTP Basic Auth dialog box.

Servers that Microsoft Edge may delegate to.

Specifies which HTTP authentication schemes are supported by Microsoft Edge. Possible values are 'basic', 'digest', 'ntlm' and 'negotiate'. Separate multiple values with commas.

Specifies which servers should be allowed for integrated authentication. Integrated authentication is only enabled when Microsoft Edge receives an authentication challenge from a proxy or from a server which is in this permitted list.

Specifies whether the generated Kerberos SPN is based on the canonical DNS name or the original name entered.

Specifies whether the generated Kerberos SPN should include a non-standard port.

If you don't configure this policy, NTLMv2 is enabled by default.

Allows you to set whether ads should be blocked on sites with intrusive ads.

Enables deleting browser history and download history in Microsoft Edge and prevents users from changing this setting.

Allows access to local files on the machine by allowing Microsoft Edge to display file selection dialogs.

This policy allows an admin to specify that a page may show popups during its unloading.

Enables or disables the built-in surf game. Game accessible via edge://surf.

This policy lets you specify that a page can send synchronous XHR requests during page dismissal.

Configure the list of URL patterns that are excluded from tracking prevention.

Enables the use of alternate error pages that are built into Microsoft Edge (such as 'page not found') and prevents users from changing this setting.

Disables the internal PDF viewer in Microsoft Edge. Instead it treats it as download and allows the user to open PDF files with the default application.

Allows the AppCache feature to be re-enabled, even if it's turned off by default

Set application locale

If enabled or not configured (default), the user will be prompted for audio capture access except for URLs configured in the AudioCaptureAllowedUrls list which will be granted access without prompting.

Patterns in this list will be matched against the security origin of the requesting URL. If a match is found, access to audio capture devices will be granted without prompt.

If you enable this policy, Microsoft Edge automatically imports all supported datatypes and settings from either the default browser or another specified browser. This also forces Microsoft Edge to skip the import section of the first-run experience.

URLs where AutoOpenFileTypes can apply. If you set URLs in this policy, files will only automatically open by policy if the URL is part of this set and the file type is listed in AutoOpenFileTypes. If either condition is false, the download won't automatically open by policy.

List of file types that should be automatically opened on download. Note: The leading separator should not be included when listing the file type, so list "txt" instead of ".txt".

Enables Microsoft Edge's AutoFill feature and allows users to auto complete address information in web forms using previously stored information.

Enables Microsoft Edge's AutoFill feature and allows users to auto complete credit card information in web forms using previously stored information.

If you enable this setting, Microsoft Edge will show a bookmark bar.

Enable profile creation from the Identity flyout menu or the Settings page

Enable the option to allow the use of guest profiles in Microsoft Edge. In a guest profile, the browser doesn't import browsing data from existing profiles, and it deletes browsing data when all guest profiles are closed.

If set to false, prevents Microsoft Edge from occasionally sending queries to a browser network time service to retrieve an accurate timestamp.

Specify whether a user can sign into Microsoft Edge with their account and use account-related services like sync and single sign on.

Determines whether the built-in certificate verifier will be used to verify server certificates.

Controls whether to use the built-in DNS client.

Controls the mode of DNS-over-HTTPS

Specify URI template of desired DNS-over-HTTPS resolver. To specify multiple DNS-over-HTTPS resolvers, separate the corresponding URI templates with spaces.

Disables enforcing Certificate Transparency requirements for a list of subjectPublicKeyInfo hashes.

Disables enforcing Certificate Transparency requirements for a list of Legacy Certificate Authorities.

Disables enforcing Certificate Transparency requirements to the listed URLs. Form your URL pattern according to https://go.microsoft.com/fwlink/?linkid=2095322

If you enable this policy, all browsing data is deleted each time Microsoft Edge closes.

Clear cached images and files when Microsoft Edge closes.

Block user access to a specified list of services and export targets in Collections. This includes displaying additional data from Bing and exporting collections to Microsoft products or external partners.

If disabled, prevents security warnings from appearing when Edge is launched with some potentially dangerous command-line flags.

Enables component updates for all components in Microsoft Edge when not set or set to True.

Specify whether to send Do Not Track requests to websites that ask for tracking info.

If you enable or don't configure this policy, web-based applications that use the SpeechSynthesis API can use Online Text to Speech voice fonts.

Specify a link for the Help menu or the F1 key.

This policy configures a local switch that can be used to disable DNS interception checks. These checks attempt to discover whether the browser is behind a proxy that redirects unknown host names.

Configures the default browser checks in Microsoft Edge and prevents users from changing them. If set to true, Edge will always checks on startup whether it is the default browser and automatically registers itself, if possible.

Allow default search provider context menu search access

Allows you to control where Developer Tools can be used.

Send required and optional diagnostic data about browser usage. 'RequiredData' sends required diagnostic data but turns off optional diagnostic data collection. Microsoft Edge will send required diagnostic data to keep Microsoft Edge secure, up to date and performing as expected. 'OptionalData' sends optional diagnostic data includes data about browser usage, websites that are visited, crash reports sent to Microsoft for product and service improvement.

Enabling this setting prevents web pages from accessing the graphics processing unit (GPU). Specifically, web pages can not access the WebGL API and plugins can not use the Pepper 3D API.

If enabled, screenshots cannot be taken using keyboard shortcuts or extension APIs.

Configures the directory that Microsoft Edge will use for storing cached files on the disk. See https://www.chromium.org/administrators/policy-list-3/user-data-directory-variables for a list of variables that can be used. To avoid data loss or other unexpected errors this policy should not be set to a volume's root directory or to a directory used for other purposes, because Edge manages its contents

Configures the cache size that Microsoft Edge will use for storing cached files on the disk. The value specified in this policy is not a hard boundary but rather a suggestion to the caching system, any value below a few megabytes is too small and will be rounded up to a sane minimum. If the value of this policy is 0, the default cache size will be used but the user will not be able to change it.

Configures the directory that Microsoft Edge will use for downloading files. If you set this policy, Edge will use the provided directory regardless whether the user has specified one or enabled the flag to be prompted for download location every time. If this policy is left not set the default download directory will be used and the user will be able to change it. See https://go.microsoft.com/fwlink/?linkid=2095041 for a list of variables that can be used.

Configures the type of downloads that Microsoft Edge will completely block, without letting users override the security decision.

Lets you allow users to access the Collections feature, where they can collect, organize, share, and export content more efficiently and with Office integration.

If you enable this setting, favorites can be added, removed or modified. This is the default also when this policy is not set.

ExampleDeprecatedFeature_EffectiveUntil20080902 - Enable ExampleDeprecatedFeature API through 2008/09/02 Specify a list of deprecated web platform features to re-enable temporarily.

If you enable this policy, the list of Domain Actions will continue to be downloaded from the Experimentation and Configuration Service.

In light of the fact that soft-fail, online revocation checks provide no effective security benefit, they are disabled by default in Google Chrome version 19 and later. By setting this policy to true, the previous behavior is restored and online OCSP/CRL checks will be performed.

Allow certificates signed using SHA-1 when issued by local trust anchors (deprecated).

When this policy is set to enabled, extensions installed by enterprise policy are allowed to use the Enterprise Hardware Platform API.

Control communication with the Experimentation and Configuration Service

If you set to True, when an external protocol confirmation prompt is shown, the user can select "Always open". The user won't get any future confirmation prompts for this protocol.

If set to enabled this policy forces the profile to be switched to ephemeral mode. If this policy is specified as an OS policy (e.g. GPO on Windows) it will apply to every profile on the system; if the policy is set as a Cloud policy it will apply only to a profile signed in with a managed account.

Forces queries in Google Web Search to be done with SafeSearch set to active and prevents users from changing this setting.

Configure whether Microsoft Edge should automatically select a certificate when there are multiple certificate matches for a site configured with "AutoSelectCertificateForUrls" (https://docs.microsoft.com/en-us/deployedge/microsoft-edge-policies#autoselectcertificateforurls).

Forces queries in Google Web Search to be done with SafeSearch set to active and prevents users from changing this setting.

Use a default referrer policy of no-referrer-when-downgrade.

Enforces a minimum Restricted Mode on YouTube and prevents users from picking a less restricted mode.

Allow full screen mode

If you enable this policy, the top auto-suggest result in the address bar suggestion list will navigate to intranet sites if the text entered in the address bar is a single word without punctuation.

Hostnames specified in this list will be exempt from the HSTS policy check that could potentially upgrade requests from "http://" to "https://". Only single-label hostnames are allowed in this policy.

If this policy is set to true or left unset, hardware acceleration will be enabled unless a certain GPU feature is on the denylist.

If you enable this policy, the First-run experience and the splash screen will not be shown to users when they run Microsoft Edge for the first time.

Show the Sidebar launcher bar.

This policy forces the autofill form data to be imported from the previous default browser if enabled. If enabled, this policy also affects the import dialog.

Allows users to import browser settings from another browser into Microsoft Edge.

Allow importing of cookies.

Allow importing of extensions.

This policy forces bookmarks to be imported from the current default browser if enabled. If enabled, this policy also affects the import dialog.

This policy forces the browsing history to be imported from the current default browser if enabled. If enabled, this policy also affects the import dialog.

This policy forces the home page to be imported from the current default browser if enabled.

Allows users to import open and pinned tabs from another browser into Microsoft Edge.

Allows users to import payment info from another browser into Microsoft Edge.

This policy forces the saved passwords to be imported from the previous default browser if enabled. If enabled, this policy also affects the import dialog.

This policy forces search engines to be imported from the current default browser if enabled. If enabled, this policy also affects the import dialog.

Allow importing of shortcuts.

Specifies whether the user may open pages in Private mode in Microsoft Edge.

Specify origins to run in isolation, in their own process. This policy also isolates origins named by subdomains - for example, specifying https://contoso.com/ will cause https://foo.contoso.com/ to be isolated as part of the https://contoso.com/ site. If the policy is enabled, each of the named origins in a comma-separated list will run in its own process. If you disable this policy, then both the 'IsolateOrigins' and 'SitePerProcess' features are disabled. Users can still enable 'IsolateOrigins' policy manually, via command line flags. If you don't configure the policy, the user can change this setting.

Configures a list of managed bookmarks.

Manage Search Engines

Configure the new tab page search box experience. You can configure the new tab page search box to use "Search box (Recommended)" or "Address bar" to search on new tabs.

Specifies the maximal number of simultaneous connections to the proxy server.

If this policy is set to true, Google Cast will connect to Cast devices on all IP addresses, not just RFC1918/RFC4913 private addresses.

Enables anonymous reporting of usage and crash-related data about Microsoft Edge to Microsoft and prevents users from changing this setting.

Shows content promoting the Microsoft Edge Insider channels on the About Microsoft Edge settings page.

Enables the display of relevant MSB suggestions in omnibox when user types a search string in the addressbar

Allows you to set whether websites can check if the user has payment methods saved.

This policy prevents Microsoft from collecting a user's Microsoft Edge browsing history to be used for personalizing advertising, search, news and other Microsoft services.

Lets you configure whether to turn on Proactive Authentication.

Enables network prediction and prevents users from changing this setting. This controls DNS prefetching, TCP and SSL preconnection, and prerendering of web pages.

The policy specifies a list of origins (URLs) or hostname patterns (such as "*.example.com") to be treated as secure contexts. The intent is to allow organizations to set up a staging server for internal web development, so that their developers can test out features requiring secure contexts without having to deploy TLS on the staging server. Setting a list of URLs in this policy has the same effect as setting the command-line flag '--unsafely-treat-insecure-origin-as-secure' to a comma-separated list of the same URLs. If the policy is set, it will override the command-line flag. For more information on secure contexts, see https://www.w3.org/TR/secure-contexts/

Refresh rate for user policy. Specifies the period in milliseconds at which the device management service is queried for user policy information. Setting this policy overrides the default value of 3 hours. Valid values for this policy are in the range from 1800000 (30 minutes) to 86400000 (1 day).

Allows you to control the presentation of full-tab promotional and/or educational content in Microsoft Edge.

If the policy is enabled, the user will be asked where to save each file before downloading. If the policy is disabled, downloads will start immediately, and the user will not be asked where to save the file. If the policy is not configured, the user will be able to change this setting.

Configures the proxy settings for Google Chrome. These proxy settings will be available for ARC-apps too. If you enable this setting, Google Chrome and ARC-apps ignore all proxy-related options specified from the command line.

QUIC is a transport layer network protocol that can improve performance of web applications that currently use TCP.

Notify users that Microsoft Edge must be relaunched to apply a pending update.

Allows you to set the time period, in milliseconds, over which users are notified that Microsoft Edge must be relaunched to apply a pending update.

Allow Microsoft Edge to issue a dataless connection to a web service to probe networks for connectivity in cases like hotel and airport Wi-Fi.

Determines which accounts can be set as browser primary accounts in Microsoft Edge (the account that is chosen during the Sync opt-in flow)

If you enable this setting, all Flash content embedded on websites that have been set to allow Flash in content settings -- either by the user or by enterprise policy -- will be run, including content from other origins or small content.

Edge shows a warning page when users navigate to sites that have SSL errors. By default or when this policy is set to true, users are allowed to click through these warning pages. Setting this policy to false disallows users to click through any warning page.

If this policy is not configured then Microsoft Edge uses a default minimum version which is TLS 1.0.

Save cookies when Microsoft Edge closes. When this policy is enabled, the specified set of cookies is exempt from deletion when the browser closes.

Disables saving browser history in Microsft Edge and prevents users from changing this setting.

Enables search suggestions in Microsoft Edge's omnibox and prevents users from changing this setting.

Specifies URLs and domains for which no prompt will be shown when attestation certificates from Security Keys are requested. Additionally, a signal will be sent to the Security Key indicating that individual attestation may be used. Without this, users will be prompted in Chrome 65+ when sites request attestation of Security Keys.

This policy enables sending info about websites visited in Microsoft Edge to Microsoft to improve services like search.

Specifies whether to include a shortcut to Office.com in the favorites bar. For users signed into Microsoft Edge the shortcut takes users to their Microsoft Office apps and docs.

Enable support for Signed HTTP Exchange (SXG).

You might want to look at the IsolateOrigins policy setting to get the best of both worlds, isolation and limited impact for users, by using IsolateOrigins with a list of the sites you want to isolate. This setting, SitePerProcess, isolates all sites. If the policy is enabled, each site will run in its own process. If the policy is disabled, no explicit Site Isolation will happen and field trials of IsolateOrigins and SitePerProcess will be disabled. Users will still be able to enable SitePerProcess manually. If the policy is not configured, the user will be able to change this setting. On Google Chrome OS, it is recommended to also set the DeviceLoginScreenSitePerProcess device policy to the same value. If the values specified by the two policies don't match, a delay may be incurred when entering a user session while the value specified by user policy is being applied.

If this policy is not set or enabled, the user is allowed to use spellcheck.

Enable stricter treatment for mixed content.

Suppresses the warning that appears when Microsoft Edge is running on a computer or operating system that is no longer supported.

Disables data synchronization in Google Chrome using Google-hosted synchronization services and prevents users from changing this setting.

Configure the list of types that are excluded from synchronization.

Enable a TLS 1.3 security feature for local trust anchors

Specify the TLS cipher suites to disable. If you don't configure this policy, the browser will choose which TLS cipher suites to use. This policy does not affect QUIC-based connections.

Controls whether Microsoft Edge can freeze tabs that are in the background for at least 5 minutes.

If set to false, the 'End process' button is disabled in the Task Manager.

Configures the amount of memory that a single Microsoft Edge instance can use before tabs start getting discarded to save memory. The memory used by the tab will be freed and the tab will have to be reloaded when switched to.

Block tracking of users' web-browsing activity

Enables the integrated Typosquatting Checker on Microsoft Edge.

Enables the integrated Microsoft translation service on Microsoft Edge.

Define a list of sites, based on URL patterns, that are blocked (your users can't load them). Format the URL pattern according to https://go.microsoft.com/fwlink/?linkid=2095322.

Enable the User-Agent Client Hints feature.

Allow access to the listed URLs, as exceptions to the URL denylist. Format the URL pattern according to https://go.microsoft.com/fwlink/?linkid=2095322.

Allow user feedback. If the policy is set to false, users can not send feedback to Microsoft.

Configures the directory that Microsoft Edge will use for storing user data. See https://go.microsoft.com/fwlink/?linkid=2095041 for a list of variables that can be used.

If enabled or not configured (default), the user will be prompted for video capture access except for URLs configured in the VideoCaptureAllowedUrls list which will be granted access without prompting.

Patterns in this list will be matched against the security origin of the requesting URL. If a match is found, access to audio capture devices will be granted without prompt.

Allows you to turn off WPAD (Web Proxy Auto-Discovery) optimization in Microsoft Edge

Specifies a list of websites that are installed silently, without user interaction, and which cannot be uninstalled nor disabled by the user.

Re-enable Web Components v0 API until M84.

This policy allows users of the WebDriver feature to override policies which can interfere with its operation. This policy is deprecated. It is currently supported but will become obsolete in a future release.

Manage exposure of local IP addressess by WebRTC

Manage exposure of local IP addressess by WebRTC

If the policy is set, the UDP port range used by WebRTC is restricted to the specified port interval (endpoints included).

Allows you to specify which native messaging hosts that should not be loaded. A denylist value of '*' means all native messaging hosts are on the denylist unless they are explicitly listed in the allowlist.

Enables user-level installation of Native Messaging hosts.

Allows you to specify which native messaging hosts are not subject to the denylist. A denylist value of * means all native messaging hosts are on the denylist and only native messaging hosts listed in the allowlist will be loaded.

If this setting is enabled, users can have Microsoft Edge memorize passwords and provide them automatically the next time they log in to a site.

Allow Microsoft Edge to monitor user passwords.

Overrides Microsoft Edge default printer selection rules.

Force 'headers and footers' to be on or off in the printing dialog.

Enables printing in Microsoft Edge and prevents users from changing this setting.

If you enable this policy, Microsoft Edge opens the system print dialog instead of the built-in print preview when a user prints a page.

Causes Microsoft Edge to use the system default printer as the default choice in Print Preview instead of the most recently used printer.

Microsoft Edge will bypass any proxy for the list of hosts given here.

Allows you to specify the proxy server used by Microsoft Edge and prevents users from changing proxy settings.

You can specify a URL to a proxy .pac file here.

You can specify the URL of the proxy server here.

Configure Microsoft Defender SmartScreen

Lets you decide whether users can override the Microsoft Defender SmartScreen warnings about potentially malicious websites.

Lets you determine whether users can override Microsoft Defender SmartScreen warnings about unverified downloads.

Configure the list of domains for which Microsoft Defender SmartScreen won't trigger warnings.

Force Microsoft Defender SmartScreen checks on downloads from trusted sources

Configure Microsoft Defender SmartScreen to block potentially unwanted apps

Configure the change password URL (HTTP and HTTPS schemes only). Password protection service will send users to this URL to change their password after seeing a warning in the browser.

Configure the list of enterprise login URLs (HTTP and HTTPS schemes only) where Microsoft Edge should capture the salted hashes of passwords and use it for password reuse detection.

Allows you to control the triggering of passwore protection warning. Password protection alerts users when they reuse their protected password on potentially suspicious sites.

Configures the type of the default home page in Microsoft Edge and prevents users from changing home page preferences. The home page can either be set to a URL you specify or set to the New Tab Page.

Configures the default home page URL in Microsoft Edge and prevents users from changing it.

Configures the background types allowed for the new tab page layout.

Set new tab page company logo. The logo must be in PNG or SVG format, and its file size must not exceed 16 MB. For help with determining the SHA-256 hash, see https://docs.microsoft.com/powershell/module/microsoft.powershell.utility/get-filehash.

Allow Microsoft News content on the new tab page in Microsoft Edge.

Hides the default top sites from the new tab page in Microsoft Edge.

Configures the default New Tab page URL and prevents users from changing it.

Set new tab page managed quick links

Configure the Microsoft Edge new tab page experience

Allows you to specify the behavior on startup.

If 'Open a list of URLs' is selected as the startup action, this allows you to specify the list of URLs that are opened. If left not set no URL will be opened on start up.

Shows the Home button on Microsoft Edge's toolbar.

Allows you to set a list of url patterns that specify sites which are allowed to ask the user to grant them access to a USB device.

Allows you to set a list of url patterns that specify sites which are prevented from asking the user to grant them access to a USB device.

Define a list of protocols that can launch an external application from listed origins without prompting the user. If this policy is set, a protocol will only be permitted to launch an external application without prompting by policy if the protocol is listed, and the origin of the site trying to launch the protocol matches one of the origin patterns in that protocol's allowed_origins list.

Specifies whether the AutoLaunch Protocols component should be enabled. This component allows Microsoft to provide a list similar to that of the AutoLaunchProtocolsFromOrigins policy, allowing certain external protocols to launch without prompt or blocking certain protocols (on specified origins). By default, this component is enabled.

A policy to control whether users are prompted to allow sites to ask for Local Network Access.

A policy to automatically grant specific sites Local Network Access.

A policy to automatically deny specific sites Local Network Access.

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

Maps to a string indicating the installation mode for the extension.

Maps to a string indicating where Chrome can download a force_installed or normal_installed extension.

Maps to a list of strings indicating the blocked API permissions for the extension.

Maps to a version string.

Each item in this list is an extension-style match pattern.

This setting sets the allowed types of extension/apps that can be installed in Google Chrome.

This maps to a string specifying the error message to display to users if they're blocked from installing an extension.

Maps to a list of strings representing hosts whose webpages the extension will be blocked from modifying.

Maps to a list of strings representing hosts that an extension can interact with regardless of whether they are listed in "runtime_blocked_hosts".

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

The top-level managed favorites folder name.

Name of the favorite.

URL for the favorite.

—

—

—

—

—

—

—

—

—

—

Specifies the proxy server Microsoft Edge uses and prevents users from changing proxy settings. Microsoft Edge ignores all proxy-related options specified from the command line.

Specifies the URL of the proxy server

Defines a comma-separated list of hosts for which Microsoft Edge bypasses any proxy.

Specifies the URL for a proxy auto-config (PAC) file.

Prevents the network stack from falling back to direct connections with invalid or unavailable PAC script.

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

—

A list of allowed origin patterns for the specified protocol.

—

—

—

—