Forum Discussion
Edge 116 Beta: Policies are blocked if MDM-Managed & Userprofile-Sync personal Account
On most current Edge Beta & DEV Versions there is a NEW BUG regarding accepting the Configuration of "sensitive Policies" which need the device to be Enterprise Managed (AD-Join or MDM-Enrolled). [Edit on next day 22.08.2023: see newer post below, not only sensitive Policies but much more policies are ignored! Therefore I modified the title of this Discussion and removed "sensitive"]
First, the affected Versions are:
Beta: Version 116.0.1938.54
Dev: Version 117.0.2045.1
NOT affected, still working as expected is:
Stable: Version 115.0.1901.203
To reproduce the issue, use a Windows 10 or Windows 11 22H2 Machine which is MDM-Enrolled.
Fresh Edge-Browser install, first NO Profile Sync / logged on User Account in Edge: OK; Policies work, are applied - as you see in this screenshot:
Now enable Profile-Sync / log on with personal Microsoft Account in Edge Browser (Profile). After Syncing Profile now restart Browser. => Problem: Device is not recognised as "MDM-Enrolled" any more, the "sensitive policies" are now ignored:
If you "sign out" (no need to delete Favorites, just "sign out" is enough) the policies start working again after next browser-start:
As I already said in the beginning, this is "brand new" problem in the most recent Beta- and DEV-Version. Was definitely not there in the last Beta-Version last week before (I think Beta Version 116.0.1938.51 was still OK). And Problem is not there in current Stable, only in Beta&Dev.
So please look into this and fix this before it gets into Stable!
Thank you!
mkruger& Kelly_Y I hope you are still working on the Edge team and can bring this to the attention of the right person? Thank you!
Not sure if this is an Edge Issue or an underlying Chromium-Issue. If it is a Chromium-Issue it maybe could be this Change: https://chromium-review.googlesource.com/c/chromium/src/+/4762065/1?tab=comments
26 Replies
Apologies, I don't know if this is related, but I managed to resolve the issue by signing-out of the Microsoft account within Edge
Devices in question are not MDM-Managed
Affected Policies; InternetExplorerIntegrationLevel, InternetExplorerIntegrationSiteList and EnterpriseModeSiteListManagerAllowed
Stable Version 115.0.1901.203 - Policy Status OK regardless of Microsoft Account signed in/out
Stable Version 116.0.1938.54 - Policy Status Ignored when Microsoft Account signed in, Policy Status OK when Microsoft Account signed outRobert_Holcombe yes, I think your troubles are related to my Issue described above.
Last night (August 21st to 22nd) new Edge v116.0.1938.54 Stable got rolled out via EdgeUpdate. Yesterday I wrote (see post above), that STABLE v115 is not affected so far. Today with the rollout of v116 now all machines using Stable are affected.
You are listing some affected policies: InternetExplorerIntegrationLevel, InternetExplorerIntegrationSiteList and EnterpriseModeSiteListManagerAllowed - but those three policies are NOT so called "sensitive Policies"
Yesterday when I was writing my initial post above I thought only the "sensitive Policies" are affected.
"Sensitive Policies" are Policies like e.g. those:
- DefaultSearchProviderEnabled
- PreventSmartScreenPromptOverride
- SmartScreenAllowListDomains
- HomepageIsNewTabPage
- HomepageLocation
- NewTabPageLocation
- RestoreOnStartup
- RestoreOnStartupURLs
- AutoOpenFileTypes
- CustomHelpLink
All "Sensitive Policies" are marked in the Microsoft Edge Policy Documentation as "This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, Windows 10 Pro, or Enterprise instances enrolled for device management."
BUT: You are right, not only "Sensitive Policies" are affected by this behaviour but also most of the other policies are affected and show up as ignored.
It seems Kelly_Y has already pointed out the right core issue, it is Edge for Business added with v116. But according to the documentation and FAQ for Edge for Business it should not be activated by default without having a work-profile.
Here we find the list of Policies which are filtered out as ignored when "Edge for Business" is used with an Enterprise personal browser (MSA profile) ... and "Signing in" with a personal Microsoft Account to get Favorites synced seem to kick in this filtered mode regardless of Edge for Business is used or not. In my case it is NOT used, not activated. No visual signs like the "Icon updated with the briefcase" shows up. There is no "one-time banner will appear at the top of the browser after first launching Edge for Business informing the user of the change with a link to learn more". Nothing of this described experiences which would give me an information that "Edge for Business" is activated are shown. No Idea why the "Edge for Business" behaviour for a Browser only having a single Profile (which is a "Personal Profile") kicks in. There is NO Work Profile configured / available, so no Idea why Edge thinks it should filter the policies out from the single profile available. We are not using Entra ID (which I read would enable Edge for Business by default).
So for me stripping out almost all policies we set because user is "Signed in" with a personal Microsoft Account is a huge issue. If this is not a bug but a wanted behaviour by Microsoft they really immediately have to add a policy to configure this / turn this off. I understand the concept of "Edge for Business" to have a Work-Profile having assigned the policies and a Personal-Profile having stripped off most of the Policies. But in my case there is no Work-Profile and Edge for Business is not used. So with Edge v116 all Users can just disable almost all Policies by just signing in with a Microsoft Account to sync their Favorites. Thats crazy.
Asking Kelly_Y , mkruger for help and advice.
So if want to use Edge with policies, I have to use a local account, hilarious. Edge forcing me not to use MSA, lol. Well, sync does not work properly anyway, cards get removed, so I am might as well do it.
- Kelly_Y
Microsoft
Gunnar-Haslinger Hello! You mentioned this is occurring when signing in with a personal MSA account. This might be related to the new Microsoft Edge for Business feature. Microsoft Edge for Business | Microsoft Learn
More information here: Microsoft Edge for Business FAQ - Microsoft Community Hub
If it is a separate issue, please let us know so we can investigate. Thanks!
-Kelly
Thanks Kelly_Y for the pointer to Edge for business, but no. Not using Edge for Business Preview and even not using Azure AD (Microsoft Entra ID login). Problem as described above, not Edge for business related.
- Gunnar
