Early preview of Microsoft Edge group policies

[Sean Lyndersay]

Update July 22nd 2019:

Hey folks,

Thanks for all the great feedback! We announced last week that Edge is now ready for Enterprise evaluations. 

You can find the latest ADMX files and MSIs/PKGs here:

https://www.microsoftedgeinsider.com/enterprise  

And you can find all the enterprise-focused documentation here:

https://docs.microsoft.com/DeployEdge

There is also an Enterprise-focused section of these Insider forums which the team will be monitoring. Direct link here:

https://techcommunity.microsoft.com/t5/Enterprise/bd-p/EdgeInsiderEnterprise

Thanks again for the great feedback and engagement. Looking forward to continuing to hear from all of you!

(Note: I have removed the ADMX zip file which was originally attached to this mail. Please see the latest versions at the links above)

Original post follows:

Hi everyone,

We've been asked fairly regularly what policies we intend to support. We're still working on the list, but I’d like to share an early preview of the management policies we are working on for the new version of Microsoft Edge.

You can find a zip file attached to this post, that includes the ADMX file, an English (US) version of the ADML file, and an English (US) HTML doc with the list of policies and descriptions.

Please note that not all of the associated policies have been implemented by current canary or dev builds!

Please send us feedback on the list, or the description text in the policies if something seems unclear.

IMPORTANT

1. This is a work in progress. We are sharing this early draft with you for your feedback, but the list will change between now and our final release, with policies being added, removed or changed based on feedback.
2. The HTML file includes both Mac and Windows policies.
3. Policies for managing updates aren’t included; those will be in a separate administrative template file.
4. These are only in English (US). We are working to localize the policy descriptions and documentation before our final release.

Please let us know if there are policies missing from the list, and give us feedback on the policy design.

Thanks for your interest!

Sean, on behalf of the Microsoft Edge team

[#2]

@Anthony Meluso Great suggestion. We're on it.

[#3]

@Sean Lyndersay  

a) Edge Chrome Beta does not have the pin favorite pane feature.

Old Edge allow us to pin the favorite pane to the right side.

b) We cannot see clearly what we highlight using the mouse for the facebook PM private messenger because both are blue in color.

In the old Edge the mouse highlight for the facebook PM is white in color.

[#4]

@Sean Lyndersay Recent issue with new 78.0.246.0 build of the New edge browser. I have disabled the location tracker for all browsers and will probably never enable this feature for most sites. The problem is that Edge will continue to throw a prompt for the browser to re-enable the location and the prompt has to be closed to navigate further threw the site. I have searched around and can't find a setting or Registry/Group policy to stop this.

[#5]

@JustMack Error can be ignored. Turns out it was a PEBCAK error. Someone enabled location tracker in the browser. This caused it to continually throw the prompt to adjust the location settings. I would recommend maybe changing the prompt to take you to the browser location tracker before the windows location settings.

[#6]

@Sean Lyndersay 

The Beta Edge product is smoking hot. Real fast, the best browser MS has ever built

[#7]

Right. Each Beta release will get better and better and worked out into Stable comes along which will (and/or still will) incorporate Beta into Stable. If one likes Beta and hasn't tried Dev or Canary I high suggest it. Especially Canary to see the features that haven't yet hit Beta. 

[#8]

Any way to configure edge://flags/#edge-windows-credentials-for-http-auth via GPO? That setting being Enabled disallows users from copying credentials from Password management extensions so we'd need a way to disable that.

[#9]

Announcing the draft Security Baseline for Microsoft Edge version 79

https://blogs.windows.com/msedgedev/2019/12/18/security-baseline-draft-edge-79/

[#10]

@Jussi Palo We don't currently have a way to configure this setting using policy. Just wondering, since Windows hello lets users enter their pin or biometric identity instead of a password, why do you see the need to have copy/paste supported. Furthermore, if the user is signed into the browser profile (happens automatically), they'll benefit from ambient authentication and won't even need to see this dialog.

[#11]

@Avi Vaid 

That does not work for users that have their own MS profile, which is not tied to our domain (we don't allow that).

[#12]

@Keith Davis Thanks, that makes sense. 

Two things that we're working on here:

1. We're working on a feature that will help users get back to their work profile from their personal MS profile when accessing these work sites.

2. We are considering revamping this HTTPAuth experience to avoid prompting users for creds. We will simply ask if we should release creds from the OS to auth users to the site. If the user then says yes, we will use ambient authentication to auth them to the website. Would love to hear your thoughts on this.

With these features coming, do you think you would still need the policy to use the username password field instead of windows hello?

[#13]

@HotCakeX 

The FINAL Security Baseline for Microsoft Edge 79 announcement: 

https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-final-for-chro...

[#14]

Thank you, by the way is there any difference between Edge stable retail and Edge stable enterprise which has an offline installer?

[#15]

@HotCakeX No. As you called out, the only difference is we provide the offline installer for enterprise.

[#16]

Thank you :)

[#17]

Has anyone found the policy to set it to use the System Default theme instead of Light by default? I have a split down the office of dark and light users and some swap between them

We're managed via Intune but can't see policies on there or in the admx so not sure if I'm just blind

[#18]

Well all of the Edge GPs must be in here
https://docs.microsoft.com/en-us/deployedge/microsoft-edge-policies

doing a search through the contents on that page for "themes" didn't reveal any related result. so i assume such policy doesn't exist yet

[#19]

@Avi Vaid 

---

1. We're working on a feature that will help users get back to their work profile from their personal MS profile when accessing these work sites.

But switching profiles just to login? That makes for more work, plus that means their Favorites and other settings will have to be duplicated across profiles.

---

2. We are considering revamping this HTTPAuth experience to avoid prompting users for creds. We will simply ask if we should release creds from the OS to auth users to the site. If the user then says yes, we will use ambient authentication to auth them to the website. Would love to hear your thoughts on this.

Right now, using Integrated Authorization (https://techcommunity.microsoft.com/t5/discussions/integrated-authorization-for-intranet-sites/m-p/1...), we don't have to do this, except when the users are remote.

[#20]

@Avi Vaid 

BTW, even with the work profile Edge automatically created, we still get the prompt when working over a remote connection. FYI, that runs over SSL on a non-standard port for us, if that makes a difference.

[#21]

@Avi Vaid 

There are different customer/corporate systems requiring using credentials other than your personal ones you've used when logging into Windows, e.g., internal Microsoft SharePoint on-prem systems commonly using Windows authentication. That combined with dev/test/prod instances of said systems, and you suddenly have 30 different credentials you need to use - not feasible nor even possible to use browser profiles or anything else except copy pasting from browser password extension.