The enrollment token of cloud policy

Computer and userIntune-readyCloudManagementEnrollmentToken

Supported on Microsoft Edge version 157, Windows 7 or later

157.0.4341.57

What it does

This policy lets you specify the enrollment token that Microsoft Edge uses to register with the Microsoft Edge management service and download the policies associated with that enrollment. Microsoft Edge management service in the Microsoft 365 admin center provides a cloud-based management experience for configuring and deploying Microsoft Edge policies to managed users and devices. If you enable this policy, Microsoft Edge attempts to use the specified enrollment token to register with the Microsoft Edge management service and download the published policies. The registration is performed for the device, so the downloaded policies apply to the browser without requiring a user to sign in. If you disable or don't configure this policy, Microsoft Edge doesn't register with the Microsoft Edge management service. This prevents new registrations only. Browsers that already registered stay enrolled and continue to download policies, because the credential issued during registration takes precedence over the enrollment token. To stop managing a browser that's already enrolled, remove or reset its device record in the Microsoft Edge management service. If the device record is removed, the browser stops downloading policies and doesn't register again on its own. If the device record is reset, the browser registers again the next time it starts, as long as this policy is still set to a valid enrollment token. Changes to this policy take effect only after Microsoft Edge is restarted. This policy can only be set as a platform policy. Example value: AQIDBAUGBwgJCgsMDQ4PEBESExQVFhcYGRobHB0eHyAh

What it writes

Hive: HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER
Registry key: Software\Policies\Microsoft\Edge

Options

Option	Type	Registry value	Allowed values
The enrollment token of cloud policy	Text (text)	`CloudManagementEnrollmentToken`	Up to 1000000 characters

Configure and deploy

Choose a state and the option values; the output below is generated from the template for exactly that.

Enabled · Computer · template defaults

Registry file (.reg)

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge]
"CloudManagementEnrollmentToken"=""

PowerShell

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: The enrollment token of cloud policy
# Name: CloudManagementEnrollmentToken
# Scope: Machine
# State: Enabled
# Source: msedge.admx

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge' -Name 'CloudManagementEnrollmentToken' -PropertyType 'String' -Value ''

The OMA-URI is an inferred ADMX-backed Policy CSP candidate derived from the source ADMX file name and policy name.
Some Microsoft policies use built-in Policy CSP pages whose area names don't match the ADMX file name, so verify the candidate against Microsoft Learn before deployment.
The generated payload is incomplete because one or more ADMX element values were not supplied: CloudManagementEnrollmentToken

ADMX profile candidate (OMA-URI)

./Device/Vendor/MSFT/Policy/Config/ADMX_msedge/CloudManagementEnrollmentToken

Intune remediation scripts

Detection

$ErrorActionPreference = 'Stop'
$reasons = [System.Collections.Generic.List[string]]::new()

function Test-RegistryValueExists {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    return $null -ne (Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue)
}

function Test-RegistryValueEquals {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $Kind,
        [Parameter(Mandatory = $true)][object] $Expected
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    $valueObject = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue
    if ($null -eq $valueObject) {
        return $false
    }

    $actual = $valueObject.$Name
    switch ($Kind) {
        'String' { return [string]$actual -ceq [string]$Expected }
        'ExpandString' { return [string]$actual -ceq [string]$Expected }
        'DWord' { return [uint32]$actual -eq [uint32]$Expected }
        'QWord' {
            $actualBits = if ($actual -is [uint64]) { $actual } else { [BitConverter]::ToUInt64([BitConverter]::GetBytes([int64]$actual), 0) }
            $expectedBits = if ($Expected -is [uint64]) { $Expected } else { [BitConverter]::ToUInt64([BitConverter]::GetBytes([int64]$Expected), 0) }
            return $actualBits -eq $expectedBits
        }
        'MultiString' {
            $actualArray = @($actual)
            $expectedArray = @($Expected)
            if ($actualArray.Count -ne $expectedArray.Count) { return $false }
            for ($index = 0; $index -lt $actualArray.Count; $index++) {
                if ([string]$actualArray[$index] -cne [string]$expectedArray[$index]) { return $false }
            }
            return $true
        }
        'Binary' {
            $actualArray = [byte[]]$actual
            $expectedArray = [byte[]]$Expected
            if ($actualArray.Length -ne $expectedArray.Length) { return $false }
            for ($index = 0; $index -lt $actualArray.Length; $index++) {
                if ($actualArray[$index] -ne $expectedArray[$index]) { return $false }
            }
            return $true
        }
        default { return [string]$actual -ceq [string]$Expected }
    }
}

# Policy: The enrollment token of cloud policy
# Name: CloudManagementEnrollmentToken
# Scope: Machine
# State: Enabled
# Source: msedge.admx

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge' -Name 'CloudManagementEnrollmentToken' -Kind 'String' -Expected ''
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge\CloudManagementEnrollmentToken') | Out-Null
}

if ($reasons.Count -eq 0) {
    Write-Output 'Compliant'
    exit 0
}

$reasons | ForEach-Object { Write-Output $_ }
exit 1

Remediation

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: The enrollment token of cloud policy
# Name: CloudManagementEnrollmentToken
# Scope: Machine
# State: Enabled
# Source: msedge.admx

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge' -Name 'CloudManagementEnrollmentToken' -PropertyType 'String' -Value ''

History 47 retained releases

157.0.4341.425 Nov 2026

Registry key: Software\Policies\Microsoft\Edge · Value name: Not specified
- Added in this release.

2 later releases left it unchanged.

Template

Internal name: CloudManagementEnrollmentToken
Namespace: Microsoft.Policies.Edge
Template file: msedge.admx
Release: Microsoft Edge 157.0.4341.57 · file set aef15aa0bbb05530…

Definition, editor controls and support

Definition

<policy class="Both" displayName="$(string.CloudManagementEnrollmentToken)" explainText="$(string.CloudManagementEnrollmentToken_Explain)" key="Software\Policies\Microsoft\Edge" name="CloudManagementEnrollmentToken" presentation="$(presentation.CloudManagementEnrollmentToken)" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Edge:microsoft_edge" />
      <supportedOn ref="Microsoft.Policies.Edge:SUPPORTED_WIN7_V157" />
      <elements>
        <text id="CloudManagementEnrollmentToken" maxLength="1000000" valueName="CloudManagementEnrollmentToken" />
      </elements>
    </policy>

Editor controls

<presentation id="CloudManagementEnrollmentToken" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions"><textBox refId="CloudManagementEnrollmentToken"><label>The enrollment token of cloud policy</label></textBox></presentation>

Supported platforms and category

Microsoft.Policies.Edge:category:microsoft_edge
<category displayName="$(string.microsoft_edge)" name="microsoft_edge" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
Microsoft.Policies.Edge:definition:SUPPORTED_WIN7_V157
<definition displayName="$(string.SUPPORTED_WIN7_V157)" name="SUPPORTED_WIN7_V157" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
Microsoft.Policies.Edge:category:microsoft_edge
<category displayName="$(string.microsoft_edge)" name="microsoft_edge" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
<strings><string id="Microsoft.Policies.Edge:microsoft_edge">Microsoft Edge</string></strings>
Microsoft.Policies.Edge:definition:SUPPORTED_WIN7_V157
<definition displayName="$(string.SUPPORTED_WIN7_V157)" name="SUPPORTED_WIN7_V157" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
<strings><string id="Microsoft.Policies.Edge:SUPPORTED_WIN7_V157">Microsoft Edge version 157, Windows 7 or later</string></strings>