Forum Discussion
Edge 116 Beta: Policies are blocked if MDM-Managed & Userprofile-Sync personal Account
Apologies, I don't know if this is related, but I managed to resolve the issue by signing-out of the Microsoft account within Edge
Devices in question are not MDM-Managed
Affected Policies; InternetExplorerIntegrationLevel, InternetExplorerIntegrationSiteList and EnterpriseModeSiteListManagerAllowed
Stable Version 115.0.1901.203 - Policy Status OK regardless of Microsoft Account signed in/out
Stable Version 116.0.1938.54 - Policy Status Ignored when Microsoft Account signed in, Policy Status OK when Microsoft Account signed out
Robert_Holcombe yes, I think your troubles are related to my Issue described above.
Last night (August 21st to 22nd) new Edge v116.0.1938.54 Stable got rolled out via EdgeUpdate. Yesterday I wrote (see post above), that STABLE v115 is not affected so far. Today with the rollout of v116 now all machines using Stable are affected.
You are listing some affected policies: InternetExplorerIntegrationLevel, InternetExplorerIntegrationSiteList and EnterpriseModeSiteListManagerAllowed - but those three policies are NOT so called "sensitive Policies"
Yesterday when I was writing my initial post above I thought only the "sensitive Policies" are affected.
"Sensitive Policies" are Policies like e.g. those:
- DefaultSearchProviderEnabled
- PreventSmartScreenPromptOverride
- SmartScreenAllowListDomains
- HomepageIsNewTabPage
- HomepageLocation
- NewTabPageLocation
- RestoreOnStartup
- RestoreOnStartupURLs
- AutoOpenFileTypes
- CustomHelpLink
All "Sensitive Policies" are marked in the Microsoft Edge Policy Documentation as "This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, Windows 10 Pro, or Enterprise instances enrolled for device management."
BUT: You are right, not only "Sensitive Policies" are affected by this behaviour but also most of the other policies are affected and show up as ignored.
It seems Kelly_Y has already pointed out the right core issue, it is Edge for Business added with v116. But according to the documentation and FAQ for Edge for Business it should not be activated by default without having a work-profile.
Here we find the list of Policies which are filtered out as ignored when "Edge for Business" is used with an Enterprise personal browser (MSA profile) ... and "Signing in" with a personal Microsoft Account to get Favorites synced seem to kick in this filtered mode regardless of Edge for Business is used or not. In my case it is NOT used, not activated. No visual signs like the "Icon updated with the briefcase" shows up. There is no "one-time banner will appear at the top of the browser after first launching Edge for Business informing the user of the change with a link to learn more". Nothing of this described experiences which would give me an information that "Edge for Business" is activated are shown. No Idea why the "Edge for Business" behaviour for a Browser only having a single Profile (which is a "Personal Profile") kicks in. There is NO Work Profile configured / available, so no Idea why Edge thinks it should filter the policies out from the single profile available. We are not using Entra ID (which I read would enable Edge for Business by default).
So for me stripping out almost all policies we set because user is "Signed in" with a personal Microsoft Account is a huge issue. If this is not a bug but a wanted behaviour by Microsoft they really immediately have to add a policy to configure this / turn this off. I understand the concept of "Edge for Business" to have a Work-Profile having assigned the policies and a Personal-Profile having stripped off most of the Policies. But in my case there is no Work-Profile and Edge for Business is not used. So with Edge v116 all Users can just disable almost all Policies by just signing in with a Microsoft Account to sync their Favorites. Thats crazy.
Asking Kelly_Y , mkruger for help and advice.
- TairikuOkamiAug 22, 2023Brass Contributor
So if want to use Edge with policies, I have to use a local account, hilarious. Edge forcing me not to use MSA, lol. Well, sync does not work properly anyway, cards get removed, so I am might as well do it.
- Gunnar-HaslingerAug 22, 2023Steel Contributor
TairikuOkami as a (temporary) Workaround you can set the Policy RestrictSigninToPattern to something like ".@no-signin-allowed".
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge -> RestrictSigninToPattern
(Type: Reg-SZ) Value e.g.: ".*@no-signin-allowed"If you do this (and restart Edge, I needed to restart twice) the Sync with personal Microsoft Accounts gets paused and the Policies work again.
- Kelly_YAug 22, 2023Microsoft
Gunnar-Haslinger Robert_Holcombe TairikuOkami Thank you for your feedback and reaching out! I've heard an update from the team. In scenarios where there is only a single MSA profile and no work profile configured, policies should not be filtered out. They just made this update, and the change should already be available in Stable 116.
Please test and let us know if you are still having issues. Thanks!
-Kelly