Enable implicit sign-in

Question

I tried to get an automatically created work profile on my MS Edge using the 'Enable implicit sign-in' policy.

I'm logged on to the PC with my work AAD account. I deleted all my profiles closed the browser and set the reg.key ImplicitSignInEnabled=1. After starting the browser there is no work profile. I even can not determine any difference in the profile fly-out or settings pane. This is still true, independent from whether I set the reg.key to 0 or 1.

Can anybody explain the intended behavior of this policy?

Thanks,

Joe

kelly_y · Answer

Johannes Goerlich&nbsp;Hi - I looked in the archive to find background information about this policy and it appears it was created to stop implicit sign in.&nbsp; Here is the Release Notes for v93 Stable:&nbsp;Archived release notes for Microsoft Edge Stable Channel | Microsoft Docs
&nbsp;

&nbsp;
I believe that is why enabling or not configuring the policy will have the same effect.&nbsp;&nbsp;
&nbsp;
Also, I do not know if it will specifically create a new profile.&nbsp; Thanks!&nbsp;
&nbsp;
-Kelly
&nbsp;
&nbsp;

johannes goerlich · Answer

Kelly_Y&nbsp;Hi @Kelly_Ythe description reads:"If you enable or don't configure this setting, implicit sign-in will be enabled, Edge will attempt to sign the user into their profile based on what and how they sign in to their OS."&nbsp;Independent from wether I enabled or disable the policy, it always (just) recommends to use my OS account for login:(browser was restarted of course)&nbsp;Indeed, there is no enforcement or automated account creation.&nbsp;Enabling ImplicitSignInEnabled is a precondition for ConfigureOnPremisesAccountAutoSignIn and NonRemovableProfileEnabled, therefore I'm wondering what exactly is affected by this policy.&nbsp;At&nbsp;https://docs.microsoft.com/en-us/deployedge/microsoft-edge-security-identity#automatic-sign-in&nbsp;it says generally "The device is hybrid/AAD-J: ...&nbsp;The user gets automatically signed in with their Azure AD account."&nbsp;BR,Joe

kelly_y · Answer

Johannes Goerlich&nbsp;Just checking, have you&nbsp;configured the&nbsp;BrowserSignin&nbsp;policy to 'Disable browser sign-in'?&nbsp; This would cause the policy to have no effect.&nbsp;&nbsp;
&nbsp;
Also you mentioned, ConfigureOnPremisesAccountAutoSignIn&nbsp;and&nbsp;NonRemovableProfileEnabled, they won't take effect if&nbsp;ImplicitSignInEnabled&nbsp;is disabled.&nbsp;&nbsp;
&nbsp;
I'm not quite sure what your specific goals are but it appears that there are a lot of Identity questions right now&nbsp;.&nbsp; I would recommend either reaching out FastTrack&nbsp;or Support, they would be able to work with you one on one and make sure MS Edge is set up and configured for your specific needs.&nbsp; Thanks!&nbsp;
&nbsp;
-Kelly

johannes goerlich · Answer

Kelly_Y&nbsp;&nbsp;BrowserSignIn is configured to 'Enable browser sign-in'.&nbsp;I try to understand what a policy is made for by reading its description&nbsp;&nbsp;and then verify this by testing.Setting up the browser to enterprise needs is not as easy as one could think, because browser sign-in combines various feature like sync and different SSO capabilities which differ based on Windows Account type and can be controlled by settings, domain patterns and built-in automatisms, which sometimes interfere each other.&nbsp;At the moment I couldn't get my user automatically signed in to a work profile. Even with BrowserSignIn set to "Force users to sign-in to use the browser". Even if I have only one profile and am logged on to Windows with a work account, I always have to manually select an account:&nbsp;Whether&nbsp;ImplicitSignInEnabled is set to Enabled or Disabled - same behavior.&nbsp;If i remember correctly, when I was testing this stuff with v85, Edge behaved differently and i was automatically signed-in.&nbsp;Best,Joe&nbsp;P.S.: I'm currently updating our internal policy as well as contributing to the next version of the CIS benchmark for Microsoft Edge.

mikey365 · Answer

You are on the Edge team and you are not sure her specific goal??? It's quite obvious what her goal is and she said it many times: Have Edge automatically sign in the user's profile into the browser. Your description of the setting is the opposite of what Intune/Endpoint Manager says:"If you enable or don't configure this setting, implicit sign-in will be enabled, Edge will attempt to sign the user into their profile based on what and how they sign in to their OS. If you disable this setting, implicit sign-in will be disabled."I can also confirm the setting doesn't work as described.

Forum Discussion

Enable implicit sign-in

Share

Resources