How to enforce Edge Browser to stop using Personal and only allows Work account to sync?

EnterpriseArchitect 5,411

Would it be possible to enforce and only allow the Microsoft Edge browser to log in and open as a Work Account instead of as a Personal account?

My corporate workstation has been configured as Hybrid Azure AD Joined and managed by Intune, so I wonder if I can use AD Group Policy or can be done via Intune with an Intune P1 license.

If yes, then how can I proceed with the policy to enforce this?

Thank you.

Accepted answer

ZhoumingDuan-MSFT 13,965 Reputation points Microsoft Vendor

2024-09-16T09:19:29.7633333+00:00

@EnterpriseArchitect, Thanks for posting in Q&A.

From your description, I know you want to restrict personal account adding to Edge while only allows work account to sync.

Based on my research, we can create a configuration policy with the setting Restrict which accounts can be used to sign in to Microsoft Edge in Settings catalog to restrict personal accounts while only allow work account.

https://learn.microsoft.com/en-us/deployedge/microsoft-edge-policies#restrict-which-accounts-can-be-used-to-sign-in-to-microsoft-edge

Hope it will help.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.

1 person found this answer helpful.
EnterpriseArchitect 5,411 Reputation points

2024-09-16T11:43:31.9166667+00:00

@ZhoumingDuan-MSFT ,
OK, with the above-suggested restrictions, how can we enforce them so no personal account can log in using the Company device with Edge Browser? Do I just add all UPN domains?

Simon Burbery 681 Reputation points

2024-09-17T01:28:10.5266667+00:00

That looks like a good way to do it - you can add your accepted domains like this ".*@contoso.com". Any other suffix will be blocked from signing in.

Simon Burbery 681 Reputation points

2024-09-17T01:35:37.28+00:00

Simon Burbery 681 Reputation points

2024-09-17T01:35:44.59+00:00

ZhoumingDuan-MSFT 13,965 Reputation points Microsoft Vendor

2024-09-17T05:39:58.48+00:00

@EnterpriseArchitect, Thanks for your reply.

With this setting, you can just add the allowed work accounts like what @Simon Burbery mentioned and assign it, after that only the allowed work accounts can login in Edge. As for the rule syntax, you can refer the link.

https://learn.microsoft.com/en-us/deployedge/microsoft-edge-policies#restrict-which-accounts-can-be-used-to-sign-in-to-microsoft-edge

Hope it will help.

EnterpriseArchitect 5,411 Reputation points

2024-09-18T06:38:26.1233333+00:00

@ZhoumingDuan-MSFT & @Simon Burbery ,
What about using: https://learn.microsoft.com/en-us/deployedge/microsoft-edge-management-service ?

ZhoumingDuan-MSFT 13,965 Reputation points Microsoft Vendor

2024-09-18T08:53:55.5733333+00:00

@EnterpriseArchitect, Thanks for your reply.

Since I am not familiar with Microsoft Edge management service, I am not sure whether it can work? But if you create a configuration profile with the setting Restrict which accounts can be used to sign in to Microsoft Edge and add the allowed work account and assign it, after sync with Intune and apply, only work accounts can login in Edge.

ZhoumingDuan-MSFT 13,965 Reputation points Microsoft Vendor

2024-09-19T07:01:32.39+00:00

@EnterpriseArchitect, after discussing with Microsoft Edge support, the method mentioned in the link you provided is also to limit personal accounts from logging into Edge by creating policies and allow work accounts to log into Edge. In essence, this is similar to creating policies in Intune and can achieve your goal.

EnterpriseArchitect 5,411 Reputation points

2024-09-22T23:42:12.5833333+00:00

Thank you @ZhoumingDuan-MSFT .
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

1 additional answer

Simon Burbery 681 Reputation points

2024-09-16T05:38:31.4166667+00:00

You can use Intune to configure this. There is a good reference here:

https://mrshannon.wordpress.com/2020/07/10/configure-auto-sign-in-and-sync-for-edge-with-intune/#:~:text=To%20do%20this%20with%20Intune%2C%20go%20to%20Devices,users%20to%20sign-in%20to%20use%20the%20browser%20%E2%80%9C.

You configure "Force users to sign-in to use the browser" and "Configure whether a user always has a default profile automatically signed in with their work or school account"
Please sign in to rate this answer.
EnterpriseArchitect 5,411 Reputation points

2024-09-16T07:04:34.3566667+00:00

Thank you @Simon Burbery ,
Would it be possible to enforce these settings without reconfiguring anything on the OnPremise Group Policy side?

Simon Burbery 681 Reputation points

2024-09-17T01:25:07.8866667+00:00

You are Hybrid Joined in which case your IT team may be using SCCM (Config Manager)? If so, there are sliders they can use to transfer control of the various management components to Intune. If policies are set to be deployed by Intune, you can use an Intune policy i.e. no on-prem requirement. If policies are still set to on-prem then you would need to use an on-prem method such as GPO. Cheers

EnterpriseArchitect 5,411 Reputation points

2024-09-17T02:34:06.69+00:00

@Simon Burbery ,
No we do not have SCCM in house.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How to enforce Edge Browser to stop using Personal and only allows Work account to sync?

1 additional answer

Your answer