In what has now become a ‘5 Things To Check’ series, this time we’re looking at Microsoft Edge. The Center for Internet Security’s (CIS) Microsoft Edge benchmark is up to v2.0.0, so again I’ll pick my favourite 5 things listed, along with giving my own explanation of why they matter and other considerations.
By the way, did you know there’s now a whole ‘Policies for Microsoft Edge’ area of the Microsoft 365 admin center? More details on the Microsoft Edge management service here.
OK let’s jump into the top 5!
1. Ensure ‘Configure extension management settings’ is set to ‘Enabled: *’
Browser extensions can do a bunch of useful things, including potentially reading everything you do and sending it off to a third party. Even if it’s not for malicious purposes, your users certainly aren’t looking into what an extension does permission wise, and thinking about data sovereignty (I know there will be exceptions to this!). Just like any other app, extensions should be controlled and go through an approval process before they’re allowed on a work device. Moreso, the tie-in with using Microsoft Edge with a work profile to both be required to access certain resources, as well as pulling down policies automatically to configure the profile in a secure state goes a long way to providing a full secure experience.
By default, all users can install whatever extensions they like.
Microsoft have full documentation on how to manage Microsoft Edge extensions here Detailed guide to the ExtensionSettings policy | Microsoft Learn but this setting is the start of enabling it, and blocking all by default unless there’s an exception – which is why it’s being set to a wildcard *. Exceptions to the global block can be granted with the setting ‘Allow specific extensions to be installed.’. There’s several ways to manage and deploy this:
Group Policy – https://learn.microsoft.com/en-us/deployedge/microsoft-edge-manage-extensions-policies#allow-or-block-extensions-in-group-policy
Microsoft Edge management service (the new way!) https://learn.microsoft.com/en-us/deployedge/microsoft-edge-management-service#manage-settings-for-all-extensions
Yes there is management overhead in blocking all extensions and looking at each case on what you should allow, and yes you need to consider other browsers like Google Chrome – you can’t just lock down Microsoft Edge and leave Google Chrome to be a free for all, or users will go there instead.
2. Ensure ‘Enable profile creation from the Identity flyout menu or the Settings page’ is set to ‘Disabled’
I called out profiles in the first tip – Edge profiles are a core component of Microsoft Edge security. A work or school account signed into Microsoft Edge can pull down Microsoft 365 tenant settings, including the new Microsoft Edge Management Service which to quote the start of the learn.microsoft.com article:
The Microsoft Edge management service is a platform in the Microsoft 365 admin center that enables admins to easily configure Microsoft Edge browser settings for their organization. These configurations are stored in the cloud and the settings can be applied to a user’s browser through group assignment or group policy. Users must be logged into Microsoft Edge to retrieve these settings.
https://learn.microsoft.com/en-us/deployedge/microsoft-edge-management-service
Either Single Sign-on should enforce Edge to automatically sign in with the same account as the PC is logged in as, or on BYOD the requirement to create a profile with the work account can allow for application management – things like stopping data exiting the browser session, screenshots, the blocking of extensions etc.
On the flip side, letting users create profiles throws all that security and control out the window. If someone can create a new profile even as a guest, a lot of the controls drop off – as well as potentially treating the browser session as a consumer one, and things like Microsoft Rewards turn up. You also have history, bookmarks, password managers etc potentially being saved against a Microsoft account (rather than a work/school one). That Microsoft account may not even have MFA on it – so a compromised Microsoft account used to sync browser information could grab a lot of company related data if it’s being used for the wrong purposes.
The setting can be set by Group Policy if you download the Microsoft Edge for Business pack (worth doing if you’re living in Group Policy land still) – Download Edge for Business (microsoft.com), or the registry setting:
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge]
“BrowserAddProfileEnabled”=0
You can also set this via Microsoft Edge management service https://admin.cloud.microsoft/#/Edge/PolicyConfiguration/
3. Ensure ‘Enable AutoFill for addresses’ is set to ‘Disabled’
Ever walked up to an iPad at a business that you need to register your details on, and as you click on the first part of the form it shows you a bunch of other people’s data? That’s AutoFill enabled by default, when it definitely should not be.
This is a tough one, because AutoFill is so handy. You go to a website and need to fill in a form, but instead you get a dropdown, pick your name and the form is mostly filled out! In a work environment though, this can be a big catch. Are you ever putting in personally identifiable information for someone else? It could be as simple as an email address. That data gets saved in a manner that isn’t that much different to having a text file in your profile that contains the same data – so it shouldn’t be allowed.
You’d probably get user pushback on this, but a decent password manager should also have AutoFill functionality, but where it prompts you before it saves the data, and it’s easily readable against a profile rather than the more obfuscated method that Edge (and other browsers) generally use.
The AutofillAddressEnabled is easy to disable via registry, Group Policy with Download Edge for Business (microsoft.com) or via Microsoft Edge management service (and untick that ‘Allow users to override’ option which is ticked by default!).
4. Ensure ‘Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads’ is set to ‘Enabled’
Microsoft Defender SmartScreen
Microsoft’s support site explains to users about Defender SmartScreen, including the Screening downloads part. Seems like a pretty good idea, if a user downloads something and it matches a file that Microsoft has already found unsafe, it’ll warn you:
Screening downloads: SmartScreen checks your downloads against a list of reported malicious software sites and programs known to be unsafe. If it finds a match, SmartScreen warns you that the download has been blocked for your safety. SmartScreen also checks your downloaded files against a list of well-known and popular downloads by Microsoft Edge users and warns you if your download is not on this list.
https://support.microsoft.com/en-au/microsoft-edge/how-can-smartscreen-help-protect-me-in-microsoft-edge-1c9a874a-6826-be5e-45b1-67fa445a74c8#:~:text=Screening%20downloads%3A%20SmartScreen%20checks%20your,been%20blocked%20for%20your%20safety.
You can just bypass this warning and download the file anyway. A home user may want this experience to make the decision themselves, but this probably isn’t the decision you want an end user to make in a corporate environment and on a work device. Arguably, several other layers should protect you anyway including Defender for Endpoint or whatever EDR solution is in place, but this is a pretty safe extra layer to have in place.
Preventing user bypass of a SmartScreen detected suspicious download seems like an obvious one. Again, PreventSmartScreenPromptOverrideForFiles is a single setting via registry, Group Policy, or Microsoft Edge management service:
5. Ensure ‘Enhance the security state in Microsoft Edge’ is set to ‘Enabled: Balanced mode’
This is disabled by default. Clicking the ? next to ‘Enhance your security on the web’ will tell you:
What is enhanced security mode?
This runs your unfamiliar sites without the just in time (JIT) compilation to provide added protection. Running JIT-less reduces attack surface, making it difficult for malicious sites to exploit.
The additional protection includes Windows operating system mitigations such as Hardware Enforced Stack Protection, Arbitrary Code Guard (ACG), and Control Flow Guard (CFG).
Although there is a caveat ‘Most sites work as expected’, it’s an adaptive setting that learns behavour and what’s common the more it gets used. Admins can also add exceptions or forced enhanced security to certain sites: Browse more safely with Microsoft Edge | Microsoft Learn
I’ve been running this setting on at home for several months and haven’t noticed any issues, but I’m sure there are some sites that would be affected by this. You can decide if you let users toggle the option off on a per-website basis too.
The ‘Balanced mode option under ‘EnhanceSecurityMode’ setting can be set via registry, Group Policy with Download Edge for Business (microsoft.com) or via Microsoft Edge management service:
Bonus because I couldn’t pick between this and #5!
6. Ensure ‘Allow personalization of ads, Microsoft Edge, search, news and other Microsoft services by sending browsing history, favorites and collections, usage and other browsing data to Microsoft’ is set to ‘Disabled’
This is enabled by default. Regardless of trust in Microsoft or not, unnecessarily sending information such as browser history, favorites/collections etc is worth blocking. At the cost of ad personalisation, which should be irrelevant in a corporate setting. Enable this one!
The PersonalizationReportingEnabled setting is easy to disable via registry, Group Policy with Download Edge for Business (microsoft.com) or via Microsoft Edge management service:
It’s also worth calling out that Microsoft have their own Security Baseline for Microsoft Edge included in this: Download Microsoft Security Compliance Toolkit 1.0 from Official Microsoft Download Center which lists out all the policies with recommended settings, along with a bunch of other products. You should be keeping track of the Security Baseline for Microsoft Edge and following the guidance where possible on each release.