Event details
47 Comments
- Since putting in Defender for Endpoint, the most vulnerable software at the top of the list is mostly Edge Chromium and Chrome. The frequency of these updates which supersede previous versions is getting in the way of getting this consistent. The release of a functional release days after a security release exasperates the process. In these two products cases, there are 60-70+ versions across the organization and many cases machines report having multiple versions of the browsers in both Chrome and Edge cases. Part of this could be due to process issues in the past from our deployment software. We are getting to the point of doing something quite radical with "uninstall ALL" and then install latest version. With 3000+ desktops you can imagine this is a very impactful decision. We do have approx 1.3 to 1.9 K on the latest version so this really pertains to the remaining 1.1 to 1.7 K of the machines.
- Altiris Patch Management is the delivery mechanism. The bulletin is MEDGE-221020 - Delivers both 64 and 32 bit but all our machines are 64. The MSI is MicrosoftEdgeEnterprise_106.0.1370.52_x64.msi. I do realize that this is an older method but it is a supported stream of patch delivery. Success is greater than 50% so overall things are working, we were just looking to see if there was a way to diagnose the stragglers and the reasons. Defender for Endpoint has helped raise the visibility on this. I was hoping for some diagnostic script we could run on those machines or we might need to run an uninstall across all machines with browser older than 105.
- Heather_Poulsen
Community Manager
Don't be shy. This is a great forum to ask your questions about the latest Microsoft Edge features, but also to share information about use cases and scenarios you need to support. Post your feedback and questions below.
- I like the security improvements to the inbuilt password manager. To further this can you better alert when there is password reuse or a detected breached password used? Perhaps with a pop up? Right now, users would need to manually go to the password settings and hover over the password health indicator which seems pretty hidden.
Unfortunately the IT admin cannot force Password monitor to be enabled for users. We have it enabled and get the below error. Would love to see this forced on for end users.
This policy value is ignored because the Password Monitor feature requires the consent of the individual user for it to be turned on. You can ask users in your Organization to go to Settings > Profile > Password and turn on the feature.
- Does Microsoft apply the same changes regarding extensions that Google has now announced for their Chrome browser? If you could point me to any news on this by Microsoft I'd be happy.
- Eric_Lawrence
Microsoft
The Edge team's plan and timeline are published at https://learn.microsoft.com/en-us/microsoft-edge/extensions-chromium/developer-guide/manifest-v3 ; I have sent an email to the extensions team to confirm that the document is up-to-date. Thanks!
- Both Chrome and Edge (potentially all Chromium based browsers) have issues when upgrading via MSI. Upgrades fail. We have seen other orgs have this issue. This creates a long tail of devices with old versions. We use ConfigMgr packages/apps and also software updates to perform upgrades. We are evaluating using policy based controls for version upgrades to see if this helps. Are there recommendations for the most successful method to perform upgrades?
- We update via Configuration Manager Software Updates w/o any issues. Can you check if these machines fail to update on auto-update too?
- Same here for Chrome updates, we have minimal issues. One thing I noticed is that if individuals somehow install Chrome from a web site instead of through the controlled installer through Software Center, that it can take a while for the correct version of Chrome we release to install on their PCs. I handle this through collections based on if Chrome is installed on the PC.
- I'm sure I saw that Collections were going to become shareable with colleagues; this would be extremely useful for teams that want to share research right inside the browser - is it still on the roadmap and can you say when we might see it?
- thanks Colleen 😀 definitely looking forward to trying out workspaces - I think the mix of synchronous and asynchronous sharing will be really powerful!
- Heather_Poulsen
Welcome to the Microsoft Edge AMA. Let's get started! Post your questions in the Comments. We will be answering questions in the live stream—and others will be answering here in the chat.
- Edge really does sell itself for the users in our enterprise. One gap is themes. We use the ExtensionInstallAllowList policy to control what extensions users are allowed to install. Unfortunately, this also impacts themes, which we don't care to control. Are there any plans to make themes more accessible when you control extensions with an allow list?
- Perhaps you could flip it on its head and have an ExtensionInstallDenyList?
- How many extensions are in the Chrome and Edge stores? I bet it could be automated! lol
- Heather_PoulsenPlease tell us more about your scenario and how you'd ideally like to see it working in your enterprise. Theme policy? Other solution?
- Yes, a theme policy would work!
- Heather_Poulsen
The Microsoft Edge AMA starts soon. Post your questions in the Comments now!
Is there a possibility to only apply this setting > Force synchronization of browser data and do not show the sync consent prompt per profile (or just the primary (user) profile) and not on the entire Edge application? If you work for several customers and have multiple profiles this policy will also be deployed on all those other profiles which can be annoying at times. Not sure if there is a good solution for this...?
We are currently working on supporting MAM scenarios for Edge which would allow configuring this setting for a particular user but currently we only support Device level settings.
