Event details
Good morning. My question is how I can ban any user profile level installation of browsers eg Chrome Firefox Brave etc via Intune. I've asked Copilot about this and have been given many versions of solutions, but none would work. Thank you.
- Joe_Lurie
Microsoft
bigmanjohn This is a common question since browsers like Chrome and Firefox can install into the user's AppData folder without requiring admin rights. There are a couple of possible workarounds you can take with Intune:
- App Control for Business: This is the modern application control solution in Windows. You can create policies in Intune under Endpoint Security > App Control for Business that only allow approved applications to run, blocking everything else including user-profile-installed browsers. You can use publisher rules, file path rules, or file hash rules. Here's the guide: Manage approved apps for Windows devices with App Control for Business policy and Managed Installers in Microsoft Intune - Microsoft Intune | Microsoft Learn.
- Device Restriction settings: In a device configuration profile, you can set "Apps from Store only" to block │ installations from outside the Microsoft Store, which covers most user-profile browser installs. See: Device restriction settings for Windows devices in Microsoft Intune - Microsoft Intune | Microsoft Learn.
Hope this helps!
--Joe.
