AAD account logon data: where does Edge store this?

[Henno_Keers]

Some explanation is valid here:

We are currently preparing to roll out Edge Chromium in the coming weeks. In january we ran into a problem that Edge would try to log on a profiel using domain\user, whereas we have a upn of uers@han.nl. A couple of gpo setting fixed that but it went on.

On our managed desktops we roam our user data using VMware UEM, we also created a setting for Edge, which transfers it to a zip fiel while logging of. Local profiles are deleted afterwards.

Info how we dit this is here: https://www.avanite.com/blog/roaming-edge-chromium

What we found: the UEM config is not complete. 

We have 2 variants of users that are stuck:

* Users that cancelled the first run wizard and get a Profile 1 profile. If they want to login with their Work account they get the message:

We can't sign you in right now
The Microsoft Edge Team has been notified of this issue.
Please try again later. Error code: -2146893811

This is with Edge 79 and 80.

* Users that went through the firest run wizard and succesfully signed in could this only once. After logging of the local profile is gone and after logging in the user sees her/his picture in the menu-bar but it does not synch, and cannot be switched on. Sync is greyed out.

If they remove the profile they end up like the other group above.

 I investigated the issue in trying to get Windows to sync it using Enterprise State Roaming (https://docs.microsoft.com/nl-nl/azure/active-directory/devices/enterprise-state-roaming-overview) but that seems to be deliberately broken by Microsoft on domain joined systems:

https://social.technet.microsoft.com/Forums/windows/en-US/e5926328-5f9e-4317-9fb5-8d7f55dec68d/quots...

So syncing the security settings of Edge with MS solutions  seems a dead end, as with UEM.

Does anyone have a working solution?

Does anyone know where the AAD logon / Edge data is stored?

Thanks in advance.... HELP!!!

Henno

[#2]

Ok. Update:

We worked out that the data for logon on the Microsoft account is destroyed when UEM puts back the profile data.

If we do not do this and remove the Windows profile (as is done on our VMware Horizon machines and most Citrix solutions) and log on again then Edge presents users with the first run wizard, which works.

But that means that Users have to go though this very time, that is stupid.

Has someone worked out how to implement Edge in an environment where Windows profiles are not preserved and a working Azure / Microsoft logon, which is preserved??

This is not rocket science, normal stuff in an Enterprise environment.

Come one Microsoft Edge Team, we need solutions..!

Regards, Henno

[#3]

Update 2.

We figured out that Edge fails when a MFA is used for authentication of the Microsoft account (Office365).

Most of the time it fails to recognize that this is needed. edge://sync-internals/ shows that all the connection info is not available.

Pitty, this is major stumbling block for a roll-out since users cannot fix it themselves either.

We are going to file a support ticket via premium support tomorrow morning.

reg, Henno