This article describes the recommended practices for deploying Microsoft Edge in an enterprise environment.
This new Edge browser (version 79) is based on the open source Chromium Project's engine, largely fostered by Google, which is also central to Google's Chrome browser. If it works on Microsoft Edge version 45 and earlier, it will work on Microsoft Edge version 77 and later. If it works on Internet Explorer, it will work on Microsoft Edge in Internet Explorer mode. If it works on Google Chrome, it will work on Microsoft Edge. This new Microsoft Edge runs on the same Chromium web engine as the Google Chrome browser, offering you best in class web compatibility and performance. The new Chromium based Microsoft Edge is supported on all versions of Windows 7, Windows 8.1, Windows 10, Windows Server (2016 and above), Windows Server (2008 R2 to 2012 R2), and macOS.
- Msiexec /i server share$ folder MicrosoftEdgeEnterpriseX64.msi /qn /norestart. It works like a charm. After the execution, the new edge is installed and all Group Policies are working, but the old Legacy-Edge is still available. And this bastard is still working. When I install the new Edge with this setup here.
- Solution: Hi wajhikhwaja First you need to download the offline installer, you can grab it here.Since this is a MSI package you could use the options for the.
Note
This article applies to Microsoft Edge version 77 or later.
The following sections provide specific guidance for planning your Microsoft Edge deployment.
Evaluate your existing browser environment and browser needs
Take time to understand your current browser state and project vision to ensure that all project stakeholders are aligned and working towards the same result.
Start by defining your current state:
- Which browsers are currently deployed in your environment?
- Which browser is set as the default browser?
- Do you need to use Internet Explorer for some of your apps?
- Do you use an Enterprise Mode Site List to configure Internet Explorer today?
- What OS platforms are supported in your environment? (Windows 10, macOS, Windows 7, Windows Server, etc.)
- What management tools do you use for browser management?
- Who is responsible for browser configuration and management?
- What is your process for validating browser compatibility?
After you understand the current state, you can determine the desired goals for your browser deployment, taking into account the following:
- Do you want to set Microsoft Edge as your default browser?
- How will you configure Microsoft Edge?
- What features are critical to configure as part of your initial deployment?
- What is the process for addressing any identified compatibility or configuration issues?
You should also understand the pre-requisites for features you're interested in, such as:
Astropad for mac. With these answers in mind, you're ready to planning your Microsoft Edge deployment.
Make sure your Windows 10 devices are ready
The Edge Stable channel requires the Latest Cumulative Update (LCU) from October 2019 (or later). If you attempt to deploy to a Windows 10 device that has an older LCU, then the installation will fail. For more details about the minimum LCU that must be applied before deploying Edge, see Windows updates to support the next version of Microsoft Edge.
Determine your deployment methodology
After you know your desired end state, you're ready to start planning how to get there. The two main ways to deploy Microsoft Edge are by role, and by site.
Deploy to end users by role
If app compatibility is your main concern, and you don't have a firm grasp on which apps to test, you might want to consider deploying to end users by role. This enables each wave of a phased deployment to provide feedback and insights on apps that might need to have their configuration modified to address compatibility issues.
Deploy to end users by site
If bandwidth is your primary concern, you might want to consider doing application compatibility testing up front. After you finish testing, deploy to end users by site so you can leverage caching other software delivery optimizations.
Do site discovery
If you have a dependency on legacy web applications, and plan to use Internet Explorer mode (which most customers do), then you probably need to do some additional site discovery.
If you've already deployed and configured the legacy version of Microsoft Edge
If you've already configured your Enterprise Site List to work for the legacy version of Microsoft Edge, then your work is almost done! The one thing you may need to add are neutral sites.
Neutral sites are typically sites that provide Single Sign-On (SSO). If you navigate to a neutral site from Microsoft Edge, then you want to stay in Microsoft Edge to authenticate. If navigate to a neutral site in Internet Explorer mode, then you want to stay in Internet Explorer mode to authenticate.
Chromium Edge Msi Pro
Identify any SSO (or other neutral) sites that you use and add these to your Enterprise Site List.
If you've configured Internet Explorer as your default browser
If you're currently only using Internet Explorer, you might not know which sites have upgraded to modern web standards and which still require Internet Explorer. You want to find these sites and add them to the Enterprise Site List. This lets you use Internet Explorer mode only on the sites that need it.
Tip
Use the Enterprise Site Discovery tools to discover the sites that might need Internet Explorer mode. You can collect collect data on computers running Windows Internet Explorer 8 through Internet Explorer 11 on Windows 10, Windows 8.1, or Windows 7.
Analyze site discovery data
After you've collected site data, we recommend the following 4-step process to analyze the data:
Sort the data by domain, and then by URL.
Define the boundaries of an 'app' to configure for Internet Explorer mode. You want to include all the sites and web controls that define the app. But you don't want to include any extra sites and controls by defining the app too broadly. Some sites may be as simple as 'http://contoso.com/app1' while others may require you to define multiple sites and pages.
Test the app to verify that it doesn't work natively. Many sites will offer modern content when they detect a modern browser, and only offer legacy content when they detect Internet Explorer.
Add the app to your Enterprise Site list if it fails testing.
Note
As a best practice, group all of the sites that comprise an app. If the sites all need to be used to accomplish one task, and if they tend to be updated together, that is a good indication that they should be grouped. This way, when you upgrade an app, it's easier to remove the entire site from Internet Explorer mode and start using a modern browser for that app.
Determine your channel strategy
Microsoft Edge is released in multiple channels.
Note
You can install more than one channel on a device
The Stable Channel is what you will want to deploy to most devices. However, you should consider a deployment strategy that includes multiple devices and multiple channels.
Multiple devices and channels
We recommend having a representative subset of devices configured to use the Beta Channel. This lets you preview upcoming changes to the browser. You can see if these changes are going to affect your end users or apps.
You might also want to make the Dev Channel (or even the Canary Channel) available to some roles, such as web developers. Consider whether you would like to target some devices with more fluid and rapidly changing channels, or simply make these channels available for users to opt to install.
Because it's possible to install multiple channels on a device, you can mitigate the risk of testing for users who have opted to install a pre-release channel. For example, if you have a user who's using the Beta Channel, and there's a problem, they can switch to the Stable Channel and continue working. This unblocks them until the issue can be fixed.
Note
If the user enabled Sync, then their configuration will sync across channels, making it even easier to transition between channels.
Define and configure policies
After you've created your Enterprise Site List, we recommend identifying and configuring the policies that you intend to deploy with Microsoft Edge. This ensures that these policies are applied when you perform your testing.
First, consider the first-run experience you want your users to have. If you want to automatically import settings from the current browser, configure the policy for AutoImportAtFirstRun.
For security policies, we recommend starting with the Microsoft Edge Security Baseline. The Security Baseline can be applied using the recommended security configuration baseline settings or by using Microsoft Intune.
For other policies, we recommend reviewing the policy configurations for Microsoft Edge and Microsoft Edge Updates.
Define your update strategy and policies
You also want to determine how you want to do updates after you deploy Microsoft Edge:
Allow Microsoft Edge to update itself (default). If you choose to allow automatic updates of Microsoft Edge, then Microsoft Edge will automatically update itself at the pace determined by the channel(s) you deployed.
Update Microsoft Edge at your own pace. If you prefer to have explicit control over when updates are deployed, you can disable automatic updates and deploy it yourself (see the Update Policy reference.) After you disable automatic updates you can deploy updates for each channel using one of the following tools:
the deployment tool of your choice.
Regardless of your update strategy, we recommend leveraging a ringed deployment strategy. With automatic updates, this means having a representative sample of users running the Beta Channel, to identify issues with what will become the Stable Channel. With manual updates, this might also include additional validation of a pilot group after a new Stable Channel build is released. This is followed by broad deployment.
Note
Microsoft Edge support will only apply to the most recent version of Microsoft Edge in each channel
Do app compatibility testing
Application compatibility for Microsoft Edge is extremely high - so high that Microsoft provides the following compatibility promises:
- If it works on Microsoft Edge version 45 and earlier, it will work on Microsoft Edge version 77 and later.
- If it works on Internet Explorer, it will work on Microsoft Edge in Internet Explorer mode.
- If it works on Google Chrome, it will work on Microsoft Edge.
If you have an application where we don't meet our compatibility promise, then we stand behind the promise to fix it with Microsoft App Assure.
Internal line of business app testing
Despite our compatibility promise, we know that many organizations must validate some applications for their compliance or risk management reasons. Even though we expect this to be very straightforward, it's important to be organized and rigorous in app testing.
There are 2 ways to do app compatibility testing:
- Lab testing. Applications are validated in a tightly controlled environment with specific configurations.
- Pilot testing. Applications are validated by a limited number of users in their daily work environment using their own devices.
Choose the method that is most appropriate for each app, to manage risk without over-investing in compatibility testing.
Third party app support
In addition to their own line of business apps, many organizations use apps provided by external sources. The Ready for Microsoft Edge article contains a list of web applications that may be in use within your organization. This list provides links to provider support statements for their products when used with Microsoft Edge.
Deploy Microsoft Edge to a pilot group
After you've defined your policies and have finished your initial app compatibility testing, you're ready to deploy to your pilot group. Deploy to your pilot group using one of the following tools:
- Microsoft Intune for Windows, or Microsoft Intune for macOS
- Configuration Manager.
- Another management tool, download and deploy the MSI file for Microsoft Edge.
Validate your deployment
After you deploy your pilot, you want to capture all the feedback you get from your users.
- Capture feedback on compatibility. Identify sites that belong on the Enterprise Site List that weren't identified during site discovery.
- Capture feedback on the policy configuration. Ensure that users can use key features and do their work while following security guidelines.
- Capture feedback on ease of use and new features. Identify any areas where training should be developed and delivered based on user questions.
Broad deployment of Microsoft Edge
After a finishing the pilot and updating your deployment plan with lessons learned from the pilot, you're ready to do a full deployment of Microsoft Edge to all your users. Congratulations!
See also
In Windows 10 Microsoft introduced its new default web-browser Microsoft Edge. Let’s try to figure out how to centrally manage Microsoft Edge GPO settings in the enterprise Active Directory domain environment.
If you open the Local Group Policy Editor console (gpedit.msc) on the current branch Windows 10 1903, then under section Computer Configuration > Administrative Template > Windows Components > Microsoft Edge (and User Settings > Administrative Template > Windows Components > Microsoft Edge) you can find 55 different Group Policy settings (in earlier Windows 10 RTM build there available only 10 policy settings for Edge). However, it is quite a small amount compared to almost 1500 different GPO settings for the Internet Explorer browser). The following policies are available to manage Microsoft Edge settings:
- Allow Address bar drop-down list suggestions;
- Configure Autofill;
- Allow Microsoft Compatibility List;
- Allow clearing browsing data on exit;
- Allow configuration updates for the Books Library;
- Allow Developer Tools;
- Configure Do Not Track;
- Allow Extensions;
- Allow Adobe Flash;
- Configure the Adobe Flash Click-to-Run setting;
- Allow FullScreen Mode;
- Allow InPrivate browsing;
- For PDF files that have both landscape and portrait pages, print each in its own orientation;
- Configure Password Manager;
- Configure Pop-up Blocker;
- Allow Microsoft Edge to pre-launch at Windows startup, when the system is idle, and each time Microsoft Edge is closed;
- Allow printing;
- Allow Saving History;
- Allow search engine customization;
- Configure search suggestions in Address bar;
- Allow Sideloading of extension;
- Configure Windows Defender SmartScreen;
- Allow Microsoft Edge to start and load the Start and New Tab page at Windows startup and each time Microsoft Edge is closed;
- Allow web content on New Tab page;
- Always show the Books Library in Microsoft Edge;
- Configure additional search engines;
- Configure Favorites Bar;
- Configure Home Button;
- Configure kiosk mode;
- Configure kiosk reset after idle timeout;
- Configure Open Microsoft Edge With;
- Provision Favorites;
- Configure cookies;
- Disable lockdown of Start pages;
- Allow extended telemetry for the Books tab;
- Configure the Enterprise Mode Site List;
- Configure Favorites;
- Prevent using Localhost IP address for WebRTC;
- Configure Start pages;
- Prevent changes to Favorites on Microsoft Edge;
- Prevent access to the about:flags page in Microsoft Edge;
- Prevent certificate error overrides;
- Prevent the First Run webpage from opening on Microsoft Edge;
- Prevent Microsoft Edge from gathering Live Tile information when pinning a site to Start;
- Prevent bypassing Windows Defender SmartScreen prompts for sites;
- Prevent bypassing Windows Defender SmartScreen prompts for files;
- Prevent turning off required extensions;
- Send all intranet sites to Internet Explorer 11;
- Set default search engine;
- Set Home Button URL;
- Set New Tab page URL;
- Show message when opening sites in Internet Explorer;
- Keep favorites in sync between Internet Explorer and Microsoft Edge;
- Unlock Home Button;
- Allow a shared Books folder.
In the each next Windows 10 build, the number of Microsoft Edge settings that can be managed via Group Policy progressively increased.
You can get the actual list of all available Microsoft Edge policies to manage your browser settings with the detailed description
Updating Microsoft Edge Group Policy Administrative Template
To get the later Edge group policies for your Windows 10, you need:
- Download the latest version of registry-based Administrative Templates (.admx) for Windows 10 1903 (v3.0, 8/28/2019);
- To install new .admx files, run the file Administrative Templates (.admx) for Windows 10 May 2019 Update v3.msi;
- If you want to manage Microsoft Edge settings using local Group Policy, copy all content (or only two files: MicrosoftEdge.admx and en-USMicrosoftEdge.adml) from a folder C:Program Files (x86)Microsoft Group PolicyAdministrative Templates (.admx) for Windows 10 May 2019 Update v3Policy Definitions to the local directory C:WindowsPolicyDefinitions;
- If you want to use new administrative templates to manage Edge settings on computers in the AD domain, copy the content of a local folder C:Program Files (x86)Microsoft Group PolicyAdministrative Templates (.admx) for Windows 10 May 2019 Update v3Policy Definitions to the Group Policy Central Store folder on the domain controller. Now you can create a new domain GPOs with Edge settings using Group Policy Management Console (GPMC).
After installing new administrative templates under section Computer Configuration > Administrative Template > Windows Components > Microsoft Edge, you will get all currently available Edge policy settings.
Group Policies for Chromium-based Edge
Microsoft recently released a preliminary version of local group policies to support the new Microsoft Edge based on the Chromium project. These administrative templates set that will allow administrators to manage certain browser features in a production environment.
You can download a preview of ADMX files for Chromium-based Edge
It’s interestingly enough that over 180 GPO settings were provided for the Chromium-based Edge version since the classical Edge had only about 60 policy parameters.
A full description of the Chromium-based Edge policies can be found in the microsoftedge_policy_list.html file in the archive with ADMX templates.
How to Enable/Disable History Saving in Microsoft Edge using GPO?
Chromium Edge Download
To disable browsing history in Microsoft Edge through Group Policy, use the following steps:
- Run the local (gpedit.msc) or domain group policy editor (gpmc.msc);
- Go to the GPO section Computer Configuration > Administrative Template > Windows Components > Microsoft Edge;
- Find a policy with the name Allow Saving History;
- Change its value from Not Configured to Disabled;
- Run the
gpupdate command and restart Edge. Now the browser should not be saving the user’s browsing history.
How to Disable Microsoft Edge Pre-launch in Windows 10?
One of the features Microsoft is trying to draw attention to is the Edge browser’s ability to get started quickly. Immediately after the Windows 10 boot, you can click on the Edge icon and it will open almost instantly.
You can disable pre-launch of the Microsoft Edge browser in Windows 10 through GPO. This will help to reduce the consumption of RAM and CPU on the computer.
To disable Microsoft Edge pre-launch on Windows 10 1809 and later:
- Open the policy “Allow Microsoft Edge to pre-launch at Windows startup, when the system is idle, and each time Microsoft Edge is closed”. Set its value to Enabled;
- In the Configure pre-launching option, select Prevent pre-launching;
- Save the change and restart your computer to take effect.