Enabling Microsoft Edge Work Profile Sync on Personal Devices Despite Conditional Access Policies

Question

I have implemented Conditional Access (CA) policies to block staff from signing into desktop applications on their personal devices.

The purpose is to ensure that company resources can only be accessed via secure, compliant, and Entra-joined devices. However, this restriction has unintentionally blocked the ability for staff to use Microsoft Edge to sync their work profiles on their personal devices.

They can only sign into their Microsoft accounts to access web apps (Outlook, Word, Excel, OneDrive, SharePoint) via office.com using Edge Browser on their personal devices.

As soon as they try to set up a work profile on Edge which will sync their history and favourites etc.

The sign in attempt gets blocked.

Current Setup:

1. Conditional Access Policy in Place:
2. Blocks access to desktop applications unless the device is Entra Joined or compliant.
3. A device filter condition is configured to exclude personal devices from accessing corporate resources. (device.deviceOwnership -ne "Company")
4. Device Platform Restrictions:
5. CA policies target platforms like Windows, macOS, and Linux
6. Client Apps Restrictions:
7. The CA policy blocks access to apps under "Mobile apps and desktop clients" for unmanaged devices.

The Problem: While this policy effectively blocks desktop applications as intended, it also prevents Microsoft Edge from syncing work profiles on personal devices. Since personal devices are blocked from Entra join or registration by the CA policy, this prevents Edge from gaining the necessary identity access to sync profiles.

Attempted Solutions (Unsuccessful):

1. Conditional Access Exclusions:
2. Adjusted CA policies to exclude "Browser" under client apps, but this didn't allow Edge sync either.
3. Adding Exceptions for Microsoft Edge:
4. Investigated if I could create exclusions specific to Microsoft Edge using device filters and CA conditions, but this approach also failed because Edge is treated as a desktop application, falling under the "Mobile apps and desktop clients" category.
5. Turned off the scope for Client apps for Mobile apps and desktop clients. This worked and allowed profile syncing as well as signing into all desktop apps like Outlook, Teams, Onedrive etc.
6. Excluding Specific Resources in CA Policy:
7. Attempted to exclude Microsoft Edge as a resource under Target Resources. This Failed because this exclusion appears to apply more to published web apps rather than the Office 365 web apps.

Desired Outcome:

Enable Microsoft Edge work profile sync on personal devices to allow users to sign in and sync their settings, passwords, and work profile data without compromising security or bypassing the Conditional Access block on other desktop applications.

Ideal Solution Requirements:

Maintain the CA policy that blocks desktop apps from unmanaged devices.

Enable Microsoft Edge work profile sync securely, ideally using a method that protects corporate data within the browser without requiring full device enrollment.

Questions for the Community:

1. Is there a Microsoft-recommended method to allow Microsoft Edge work profile sync on personal devices while still enforcing Conditional Access controls?
2. Are there any updates or alternative methods within Microsoft’s ecosystem that address this specific scenario?
3. Is there a secure workaround to distinguish Microsoft Edge sync from other desktop applications when enforcing CA policies?

I would greatly appreciate any insights, solutions, or guidance on resolving this issue. Thank you.

Answer 1

Hi @Tom,

Unfortunately, this behavior is by design and there’s nothing we can do on the Edge side to change this, since Edge completely relies on system components from a sign in perspective. You may have to re-evaluate the purpose of this conditional access policy and try to find alternative ways to ensure similar goals are met (for example, using AppLocker can be an alternative).

As a temporary solution in case users want to get access to their favorites for the time being, you can instruct them to navigate to edge://favorites/ --> ··· menu --> Export favorites on their work device, and users will get a HTML file. Then, import the same HTML file at the same location on their personal device.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Best Regards,

Shijie Li