Forum Discussion

Gunnar-Haslinger's avatar
Gunnar-Haslinger
Steel Contributor
Aug 21, 2023

Edge 116 Beta: Policies are blocked if MDM-Managed & Userprofile-Sync personal Account

On most current Edge Beta & DEV Versions there is a NEW BUG regarding accepting the Configuration of "sensitive Policies" which need the device to be Enterprise Managed (AD-Join or MDM-Enrolled). [Edit on next day 22.08.2023: see newer post below, not only sensitive Policies but much more policies are ignored! Therefore I modified the title of this Discussion and removed "sensitive"]

 

First, the affected Versions are:

Beta: Version 116.0.1938.54

Dev: Version 117.0.2045.1

 

NOT affected, still working as expected is:
Stable: Version 115.0.1901.203

 

To reproduce the issue, use a Windows 10 or Windows 11 22H2 Machine which is MDM-Enrolled.

 

Fresh Edge-Browser install, first NO Profile Sync / logged on User Account in Edge: OK; Policies work, are applied - as you see in this screenshot:

 

 

Now enable Profile-Sync / log on with personal Microsoft Account in Edge Browser (Profile). After Syncing Profile now restart Browser. => Problem: Device is not recognised as "MDM-Enrolled" any more, the "sensitive policies" are now ignored:

 

 

 

If you "sign out" (no need to delete Favorites, just "sign out" is enough) the policies start working again after next browser-start:

 

 

As I already said in the beginning, this is "brand new" problem in the most recent Beta- and DEV-Version. Was definitely not there in the last Beta-Version last week before (I think Beta Version 116.0.1938.51 was still OK). And Problem is not there in current Stable, only in Beta&Dev.

 

So please look into this and fix this before it gets into Stable!

 

Thank you!

 

mkruger& Kelly_Y  I hope you are still working on the Edge team and can bring this to the attention of the right person? Thank you!

 

Not sure if this is an Edge Issue or an underlying Chromium-Issue. If it is a Chromium-Issue it maybe could be this Change: https://chromium-review.googlesource.com/c/chromium/src/+/4762065/1?tab=comments

 

  • Kelly_Y's avatar
    Kelly_Y
    Aug 25, 2023

    meveritt Great!  Thank you for testing and following up!  

     

    Yes, Stable Version 116.0.1938.62 was released today.  For other folks on the thread, please let us know once you are able to test.  

     

    Have a great weekend, everyone! 

     

    -Kelly

    • Gunnar-Haslinger's avatar
      Gunnar-Haslinger
      Steel Contributor
      Aug 21, 2023

      Thanks Kelly_Y for the pointer to Edge for business, but no. Not using Edge for Business Preview and even not using Azure AD (Microsoft Entra ID login). Problem as described above, not Edge for business related. 

       

      - Gunnar

  • Robert_Holcombe's avatar
    Robert_Holcombe
    Copper Contributor
    Aug 22, 2023

    Apologies, I don't know if this is related, but I managed to resolve the issue by signing-out of the Microsoft account within Edge

    Devices in question are not MDM-Managed

    Affected Policies; InternetExplorerIntegrationLevel, InternetExplorerIntegrationSiteList and EnterpriseModeSiteListManagerAllowed

    Stable Version 115.0.1901.203 - Policy Status OK regardless of Microsoft Account signed in/out


    Stable Version 116.0.1938.54 - Policy Status Ignored when Microsoft Account signed in, Policy Status OK when Microsoft Account signed out

    • Gunnar-Haslinger's avatar
      Gunnar-Haslinger
      Steel Contributor
      Aug 22, 2023

      Robert_Holcombe yes, I think your troubles are related to my Issue described above.

       

      Last night (August 21st to 22nd) new Edge v116.0.1938.54 Stable got rolled out via EdgeUpdate.  Yesterday I wrote (see post above), that STABLE v115 is not affected so far. Today with the rollout of v116 now all machines using Stable are affected.

       

      You are listing some affected policies: InternetExplorerIntegrationLevel, InternetExplorerIntegrationSiteList and EnterpriseModeSiteListManagerAllowed - but those three policies are NOT so called "sensitive Policies" 

       

      Yesterday when I was writing my initial post above I thought only the "sensitive Policies" are affected.

       

      "Sensitive Policies" are Policies like e.g. those:

      • DefaultSearchProviderEnabled
      • PreventSmartScreenPromptOverride
      • SmartScreenAllowListDomains
      • HomepageIsNewTabPage
      • HomepageLocation
      • NewTabPageLocation
      • RestoreOnStartup
      • RestoreOnStartupURLs
      • AutoOpenFileTypes
      • CustomHelpLink

      All "Sensitive Policies" are marked in the Microsoft Edge Policy Documentation as "This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, Windows 10 Pro, or Enterprise instances enrolled for device management."

       

      BUT: You are right, not only "Sensitive Policies" are affected by this behaviour but also most of the other policies are affected and show up as ignored.

       

      It seems Kelly_Y has already pointed out the right core issue, it is Edge for Business added with v116. But according to the documentation and FAQ for Edge for Business it should not be activated by default without having a work-profile.

       

      Here we find the list of Policies which are filtered out as ignored when "Edge for Business" is used with an Enterprise personal browser (MSA profile) ... and "Signing in" with a personal Microsoft Account to get Favorites synced seem to kick in this filtered mode regardless of Edge for Business is used or not. In my case it is NOT used, not activated. No visual  signs like the "Icon updated with the briefcase" shows up. There is no "one-time banner will appear at the top of the browser after first launching Edge for Business informing the user of the change with a link to learn more". Nothing of this described experiences which would give me an information that "Edge for Business" is activated are shown. No Idea why the "Edge for Business" behaviour for a Browser only having a single Profile (which is a "Personal Profile") kicks in. There is NO Work Profile configured / available, so no Idea why Edge thinks it should filter the policies out from the single profile available. We are not using Entra ID (which I read would enable Edge for Business by default).

       

      So for me stripping out almost all policies we set because user is "Signed in" with a personal Microsoft Account is a huge issue. If this is not a bug but a wanted behaviour by Microsoft they really immediately have to add a policy to configure this / turn this off. I understand the concept of "Edge for Business" to have a Work-Profile having assigned the policies and a Personal-Profile having stripped off most of the Policies. But in my case there is no Work-Profile and Edge for Business is not used. So with Edge v116 all Users can just disable almost all Policies by just signing in with a Microsoft Account to sync their Favorites. Thats crazy.

       

      Asking Kelly_Y , mkruger for help and advice.

       

      • TairikuOkami's avatar
        TairikuOkami
        Brass Contributor
        Aug 22, 2023

        So if want to use Edge with policies, I have to use a local account, hilarious. Edge forcing me not to use MSA, lol. Well, sync does not work properly anyway, cards get removed, so I am might as well do it.

Resources