Security baseline for Microsoft Edge version 151
We are pleased to announce the enterprise-ready release of the security baseline for Microsoft Edge version 151! We have reviewed the settings in Microsoft Edge version 151 and updated our guidance with six new recommendations. We have also identified one additional setting that organizations should consider evaluating in their environments. A new Microsoft Edge security baseline package was just released to the Download Center. You can download the new package from the Security Compliance Toolkit. Enable Process Isolation (added) We are enforcing ‘Enable Process Isolation’ to help protect Microsoft Edge from unauthorized access, modification, and tampering by other applications running on the device. This setting strengthens browser process integrity and helps safeguard sensitive data used by Microsoft Edge. Organizations that encounter compatibility issues with software that depends on browser process injection should treat such configurations as exceptions requiring explicit risk acceptance and compatibility validation. Enable renderer in app container (added) We are enforcing the default and enabling ‘Enable renderer in app container’ to strengthen Microsoft Edge’s browser isolation protections by ensuring renderer processes run within the additional restrictions provided by AppContainer. This helps reduce the impact of browser-based attacks and limits the ability of exploited renderer processes to interact with system resources. Organizations that require this setting to be disabled due to incompatible software should treat such configurations as exceptions that require explicit risk acceptance. Enable the network service sandbox (added) We are enforcing the default and enabling ‘Enable the network service sandbox’ to ensure Microsoft Edge network-facing processes operate within sandbox isolation boundaries that help reduce the impact of exploitation and limit access to system resources. Because disabling the network service sandbox weakens a core browser security protection, organizations should treat any requirement to disable this setting as an exception scenario requiring explicit risk acceptance and compatibility validation. Configure browser process code integrity guard (added) We are enabling ‘Configure browser process code integrity guard setting’ with a value of ‘Enable code integrity guard enforcement in the browser process’. The setting strengthens protections against unauthorized code injection into Microsoft Edge browser processes. Some enterprise applications, extensions, accessibility tools, or security products may still rely on legacy injection techniques and require compatibility validation. We encourage organizations to fully test this setting in their environments and work with vendors to identify or remediate incompatible software. Enable Application Bound Encryption (added) We are enabling ‘Enable Application Bound Encryption’ to strengthen protections for browser-stored credentials, authentication tokens, and other sensitive data by binding encryption more closely to the browser process. This helps reduce the risk of unauthorized access to protected browser data by malware or other untrusted software. Because disabling this setting weakens an important protection boundary, organizations should treat any requirement to disable the feature as an exception requiring explicit risk review. Enhance the security state in Microsoft Edge (added) We are enabling ‘Enhance the security state in Microsoft Edge’ and configuring the setting to Balanced to provide additional protection against modern web-based attacks while maintaining compatibility for most enterprise users. In Balanced mode, Microsoft Edge applies additional mitigations such as disabling just-in-time (JIT) JavaScript compilation and enabling added operating system protections on processes used to load sites that users do not frequently visit, helping reduce the risk of memory-related vulnerabilities. Because these protections can introduce compatibility issues for some applications or workflows, organizations should validate critical business sites and applications during their normal testing process prior to broad deployment and configure exceptions as needed. Additional details can be found here. Configure Automatic HTTPS (worth considering) We previously released a blog discussing a new feature called Automatic HTTPS. This setting can automatically switch your connections to websites from HTTP to HTTPS on sites that are highly likely to support the more secure protocol. This option helps ensure that users' network traffic is more secure and less susceptible to SSL stripping attacks. The best part, the end user doesn’t get prompted, it just works! This new feature has two configuration options: Navigations delivered over HTTP are switched to HTTPS’ (UpgradeCapableDomains) and ‘All navigation delivered over HTTP are switched to HTTPS’ (AlwaysUpgrade). There are trade-offs for each configuration: the UpgradeCapableDomains option only upgrades to HTTPS if Microsoft believes the site is likely to work over HTTPS, and this setting is unavailable if you’ve disabled the ComponentUpdatesEnabled policy. The more secure AlwaysUpgrade option unconditionally updates all HTTP requests to HTTPS, which will result in a user-visible error page if the target site does not support HTTPS. We encourage organizations to consider implementing and testing Automatic HTTPS within their environment. Collectively, these changes continue our focus on strengthening browser isolation, sandboxing, process integrity, and protection of sensitive browser data while balancing enterprise compatibility requirements. Microsoft Edge version 151 introduced 4 new computer and user settings. We have included a spreadsheet listing the new settings in the release to make it easier for you to find them. As a friendly reminder, all available settings for Microsoft Edge are documented here, and all available settings for Microsoft Edge Update are documented here. Please continue to give us feedback through the Security Baseline Community or in comments on this post.Security Review for Microsoft Edge version 150
We have reviewed the new settings in Microsoft Edge version 150 and determined that there are no additional security settings that require enforcement. The Microsoft Edge version 139 security baseline continues to be our recommended configuration which can be downloaded from the Microsoft Security Compliance Toolkit. Microsoft Edge version 150 introduced 8 new Computer and User settings; we have included a spreadsheet listing the new settings to make it easier for you to find. As a friendly reminder, all available settings for Microsoft Edge are documented here, and all available settings for Microsoft Edge Update are documented here. Please continue to give us feedback through the Security Baselines Discussion site or this post.
Feature Request: Native Multi-Container Tabs (Session Isolation) for Edge Workspaces and Tab Groups
Microsoft Edge developer team, As a developer who regularly tests complex web applications locally and on staging environments, I rely heavily on Microsoft Edge's Tab Groups and Workspaces to keep my projects organized. However, testing multi-role workflows—such as simultaneously testing Admin, Manager, and Standard User accounts on localhost—is currently very frustrating. When logging into a secondary account in another tab within the same Edge window, the newly created authentication token overwrites the existing cookies, localStorage, and session context across all open tabs for that domain. This causes the first tab to automatically switch sessions upon refresh or navigation, breaking side-by-side workflow testing. Mozilla Firefox solves this problem cleanly with Multi-Account and Temporary Containers, allowing tabs inside the same window to maintain fully isolated storage contexts. Bringing native container tabs or tab-level session isolation to Microsoft Edge, especially tightly integrated with Tab Groups, would eliminate the need to run multiple heavy browser profiles or separate windows. It would make Edge the absolute premier browser for developers, QA engineers, and power users who manage multiple user roles daily. Please consider adding tab-level container isolation to the Edge product roadmap.
Dynamic Code Setting in Version 139 Causing Printing Issues
Microsoft Edge security baseline version 139 via Intune sets the Dynamic Code value to 'Prevent the browser process from creating dynamic code'. The setting causes Microsoft Edge to close down / crash when trying to print. Reverting the setting value back to version 128 'Default dynamic code settings' resolves Microsoft Edge not closing down when trying to print.
Feature Request: Add toggle to fully disable VideoOverlayToolbar (video overlay buttons)
In recent Microsoft Edge versions, a built-in VideoOverlayToolbar appears automatically on top of web videos. It contains Picture-in-Picture, Video Enhancement, Video Summary, Video Translation buttons. Current limitations: 1. We can only disable the corresponding functions, but cannot hide these overlay buttons on video. 2. Legacy flag #edge-video-super-resolution is removed. 3. Launch parameter --disable-features=VideoOverlayToolbar no longer works on new Edge builds. Request: Add a unified switch in Edge Settings to let users completely hide this entire overlay toolbar, to avoid covering video content and improve viewing experience.
Copilot on Edge Android InPrivate Now Requires Sign‑In — Guest Mode No Longer Accessible
Hello, I’m experiencing an issue when trying to use Copilot on the web while browsing in InPrivate mode on Microsoft Edge for Android. Until recently, I was able to open Copilot and start a guest conversation without signing in. This allowed me to keep separate chats easily. Starting today, whenever I open the Copilot website in an InPrivate tab, I immediately get a pop‑up screen that says: > Sign in to Copilot > Upload files, use Voice without limits, and make Copilot yours with memory across conversations. It then gives me three sign‑in options: Microsoft, Apple, and Google. None of these let me continue as a guest, and there is no “Maybe later” or “Continue without signing in” option anymore. Problem I am no longer able to access Copilot as a guest. The sign‑in screen appears every time, and I cannot bypass it. It seems like guest access has been removed, at least on Edge Android InPrivate. Expected Behavior Previously, Copilot allowed free guest access without requiring an account login. I would like to continue using Copilot in this way, especially for keeping conversations separate. Actual Behavior Copilot forces a sign‑in screen and does not allow guest access at all. Questions 1. Has guest access to Copilot been officially removed? 2. Is this change intentional or a temporary bug? 3. Can the previous behavior be restored so users can chat without signing in? Scenario Summary - Service: Copilot - Issue: Unable to open Copilot without signing in - Result: Copilot shows the “Sign in to Copilot” screen and blocks guest access - Device: Microsoft Edge (Android), InPrivate mode Any clarification or fix would be appreciated. Thank you.New Security Controls in Edge for Business
Extend Conditional Access, Purview DLP, and Defender controls into every session, across managed and unmanaged devices. Block sensitive data from reaching unsanctioned AI services, lock contractors into your data boundary on devices you don’t manage, and control clipboard and screenshot actions by location. Manage extensions by permission type from the Microsoft 365 admin center and shut down scareware before users respond. Jeremy Chapman, Microsoft 365 Director, shares how to deploy these controls using the security stack you already have. Contractors access your SharePoint. Saves redirect to your OneDrive. Edge for Business enforces your data protection policies on unmanaged devices through Intune App Protection Policies — no dedicated device required. Check it out. Your clipboard, with a corporate boundary. Copy from work, paste in work. Edge for Business blocks paste into unapproved apps automatically. Try it here. Help shut down threats. Edge for Business uses on-device AI and computer vision to detect and block fake support scam pages in real time. See how it works. QUICK LINKS: 00:00 — Security built into the browser 01:30 — Shadow AI Data Blocking 03:03 — Contractor Work Profiles 04:22 — Configuration 05:16 — Advanced DLP & Clipboard Controls 06:29 — How to set it up 07:07 — Extension Management 09:20 — Protect from threats 10:13 — Wrap up Link References To get started, check out https://aka.ms/EdgeforBusiness Unfamiliar with Microsoft Mechanics? As Microsoft’s official video series for IT, you can watch and share valuable content and demos of current and upcoming tech from the people who build it at Microsoft. Subscribe to our YouTube: https://www.youtube.com/c/MicrosoftMechanicsSeries Talk with other IT Pros, join us on the Microsoft Tech Community: https://techcommunity.microsoft.com/t5/microsoft-mechanics-blog/bg-p/MicrosoftMechanicsBlog Watch or listen from anywhere, subscribe to our podcast: https://microsoftmechanics.libsyn.com/podcast Keep getting this insider knowledge, join us on social: Follow us on Twitter: https://twitter.com/MSFTMechanics Share knowledge on LinkedIn: https://www.linkedin.com/company/microsoft-mechanics/ Enjoy us on Instagram: https://www.instagram.com/msftmechanics/ Loosen up with us on TikTok: https://www.tiktok.com/@msftmechanics Video Transcript: -They say the most secure device is the one that isn’t connected, but in reality, more than half of the work we do happens in one app, the browser. It’s always connected, always in use, and it’s constantly exposed to threat activity. It’s the one place where identity, data, and apps come together, and it’s also where security has to be enforced. Microsoft Edge for Business applies security controls directly inside the browser, where the activity is happening. Threat signals are evaluated in real time during the session, without routing traffic through external proxies. And controls are enforced, powered through native integration with the Microsoft security stack with identity and access management in Microsoft Entra, data security controls in Purview, and threat detection and response in Defender. -In fact, just as you manage users and applications today, Edge allows browser sessions to be governed on a managed device and by using a work profile also on unmanaged devices. A work profile provides a separate browser space linked to the user’s work account in Microsoft Entra to keep company data isolated from personal browsing. -When a user is signed into their work profile your existing security policies such as access controls through Conditional Access, data security, with Data Loss Prevention controls and extension restrictions, can be enforced. This lets you establish clear boundaries for what’s allowed and what isn’t, without disrupting how people work. Let me make this real, by showing you how policies are applied in practice across five common everyday scenarios, starting with Shadow AI apps and services and preventing company data leakage. Here, I’m an employee on my managed device using the consumer AI service, DeepSeek. -In this case, our company has already flagged it as an unsanctioned AI app and blocks it from being used with sensitive work information. So, I’ll type in a prompt that includes details about an acquisition that Contoso is planning. This is classified as confidential information, and tied to existing DLP policies in Microsoft Purview So, when I hit submit, the prompt is blocked in real time, with a clear explanation for why. The sensitive data never leaves the browser and is never sent to DeepSeek. And the user is guided to use trusted AI, in this case Copilot, for our organization. -Importantly, these same protections would also apply across all Edge profiles on my managed device whether work, personal or guest profiles. In fact, let me show you how this was set up using policies. This uses a Microsoft Purview Data Loss Prevention Policy to protect Inline web traffic. This is a pay-as-you-go licensed option, which is scoped to managed cloud apps and it can be targeted using adaptive app scopes for all unmanaged AI apps. And its enforcement is set to Edge for Business, as you can see here. The rest is configured like any other Purview DLP policy that you’re already using. Next, let me show you how Edge work profiles create a secure boundary for temporary or contract workers to securely access company data without exposing it to their personal environment. Using Work Profiles in Edge, you can enforce policies that require contractors to sign-in to an account in your company’s Microsoft Entra directory to access internal information. -Here, I’m logged into Microsoft Edge as a contractor at Woodgrove working temporarily for Contoso. I have an acquisition document open in Word online, which is stored in a Contoso SharePoint site. Importantly, I’m using my Work Profile with an Entra ID account that Contoso provisioned for me on my corporate device, which is managed by my employer, Woodgrove. -Let’s see what happens if I try to download a local copy of this file containing sensitive information. And you can see it redirects the save to a Contoso-managed OneDrive location, so it never leaves Contoso’s information protection boundary. Even when the device is controlled by another organization, Edge for Business still enforces Contoso’s data protection policies through the work profile. So, as a contractor, I get the access I need, and my contracting company stays in control without the added cost and complexity of giving me a dedicated device or virtual machine. Now let me show you how this was configured using policy. It starts with giving contract workers an account in your directory so that you can apply management policies to them, along with a eligible Microsoft 365 license, including Business Premium or E3. -From there, in Microsoft Intune, you’ll use an App Protection Policy, like this one I’ve started. In Properties, we can see that it’s applied to Microsoft Edge. And when I open Data Protection, there are controls to receive and send data, as well as controls to prevent cut/copy/paste from or to external accounts, docs, locations and apps. These ensure that those activities stay within your work profile boundary. In the same policy, you can also allow or block printing org data. Once you’ve done that, your policies are contained within that profile even if you don’t manage their device. Let’s move onto our next scenario, Advanced DLP. If you’re using information protection policies in Microsoft Purview, those protections natively work in the Edge browser to protect your sensitive data without requiring any add-ons or extensions. -For example, if I try to capture a screenshot from a protected spreadsheet, the action is blocked. And any actions you’ve restricted by policy, like printing or downloading local copies, those are also enforced directly in the browser. And since not every protection is one size fits all, there are granular controls that permit working with sensitive information in trusted locations, but block it in untrusted locations. -Here, I’m working on a Power BI dashboard with sensitive information and I’ll copy that to my clipboard. Now if I move to a trusted location within my security boundary, like this Word Online document stored on our SharePoint site, I am allowed to paste the information from my clipboard into the doc. That said though, for any location outside of our company security boundary like this personal messaging app, I’m blocked from pasting sensitive information with a clear message telling me why. Now these protections extend to Microsoft Edge running across device platforms. Let me show you how this was set up as an admin. -First, in Microsoft Defender Settings under Cloud apps and Conditional Access App control, you can enable Edge for Business protection. And to ensure that the data security policies you set are enforced, the Enforce usage of Edge for Business makes it the browser required to access company resources. In Microsoft Entra, you’ll configure a Conditional Access policy to grant access only when an App Protection Policy is in place. -Then, in Microsoft Purview, you can use Data Loss Prevention policies with Edge for Business protections in scope. And building on those in-browser controls, let’s take a look at how you can manage extensions and control what’s allowed to run on users’ devices. In fact, extensions are one of the biggest security and data risk surfaces in the browser. They have deep access to browser data, and without control, they can become a direct path for sensitive information to leave your organization. When a user in your organization on a managed or unmanaged device using a work profile attempts to install an unallowed extension, they are blocked. -Optionally, you can allow users to request exceptions to the block, in this case, a tenant administrator needs to approve the request. In fact, let’s take a look at the Edge for Business management options. From the Microsoft 365 admin center, under Settings you’ll find new management controls for Edge for Business. This is where you can monitor extensions and you’ll see that the one request our user just made is already in my queue. -Below that, you’ll find security insights to ensure that your users’ Edge browsers are up-to-date. And moving over to the Configuration Policies tab, you can manage browser settings for users in your organization, including policies for extensions. In fact, I’ll click into this policy that I’ve created and then going into its settings, you’ll see that these policies apply across operating system platforms. And in Extensions, you can allow or block extensions, hosted apps, themes and scripts, decide whether users are allowed to install external extensions, not from the Edge add-ons store. Under that are defined locations where users can install external extensions from, and then permissions and URLs you can block interactions with defined URLs and explicitly allow extensions to interact with other host URLs. -Then for blocked extensions, you can permit users to make requests for the extensions you block, like we saw before with our user. And specifically, you can block extensions based on the types of permissions they request, like clipboard access, desktop capture, scripting and system memory. Finally, there are also options to explicitly allow managed extensions from the Edge add-on store, as well as sidebar apps, or external extensions using their their Extension ID, Name and Description from the Chrome web store. -Now, extensions are one way that risk can enter the browser, but they’re not the only way. Threats can also come directly from the web itself. So let’s switch from controlling what runs in the browser to protecting users from what they encounter online, like scams and scareware. These full-screen takeover pages are designed to pressure users into calling fake support or handing over control of their device. In a corporate setting, that creates a real risk of data exposure and unauthorized access. Now unlike site reputation-based detection, Edge helps mitigate this in real time with AI-powered on-device protection, it uses on-device computer vision for screen content to automatically block scareware, removing the burden from the user. This capability is policy configurable and enabled by default on systems with more than 2GB of RAM and four four CPU cores. -So that’s how Microsoft Edge for Business keeps your users and data secure, enforcing your existing security controls directly in the browser, where identity, apps, and data come together. To learn more and get started, check out aka.ms/EdgeforBusiness And keep watching Microsoft Mechanics for the latest deep dives and updates. Thanks for watching!
