Allow access to a list of URLs in InPrivate mode.

What it does

This policy allows administrators to specify a list of URL patterns that are permitted to open in InPrivate mode. It can be used to create exceptions for URL patterns defined in 'InPrivateModeUrlBlocklist' (Block access to a list of URLs in InPrivate mode.). See how to format a URL pattern (https://go.microsoft.com/fwlink/?linkid=2095322). If both this policy and 'InPrivateModeUrlBlocklist' are configured, the allowlist takes precedence. URLs that match a pattern on this allowlist are allowed. URLs that match the blocklist but not this allowlist are blocked. URLs that match neither list fall back to 'URLBlocklist' (Block access to a list of URLs) and 'URLAllowlist' (Define a list of allowed URLs). If this policy is configured and 'InPrivateModeUrlBlocklist' is not configured, only the URLs specified in this allowlist can be opened in InPrivate mode. All other URLs are blocked. If 'InPrivateModeAvailability' (Configure InPrivate mode availability) is set to disallow (value 1) but this policy is configured, InPrivate mode is available only for URLs that match the allowlist. If this policy is not configured, no exceptions are applied to 'InPrivateModeUrlBlocklist' or 'InPrivateModeAvailability'. This policy applies only to InPrivate mode. To allow URLs across all browsing modes and profiles, use the 'URLAllowlist' policy. Blanket host wildcards (that is, "*" or "[*]") aren't allowed. Instead, use the 'InPrivateModeAvailability' policy to enable InPrivate mode globally. This policy supports up to 1000 entries. Example value: example.com https://ssl.server.com hosting.com/bad_path https://server:8080/path .exact.hostname.com file://* custom_scheme:* *

What it writes

Hive

HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER

Registry key

Software\Policies\Microsoft\Edge

Options

Configure and deploy

Choose a state and the option values; the output below is generated from the template for exactly that.

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge\InPrivateModeUrlAllowlist]

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Allow access to a list of URLs in InPrivate mode.
# Name: InPrivateModeUrlAllowlist
# Scope: Machine
# State: Enabled
# Source: msedge.admx

Clear-RegistryKeyValues -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge\InPrivateModeUrlAllowlist'

./Device/Vendor/MSFT/Policy/Config/ADMX_msedge/InPrivateModeUrlAllowlist

$ErrorActionPreference = 'Stop'
$reasons = [System.Collections.Generic.List[string]]::new()

function Test-RegistryValueExists {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    return $null -ne (Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue)
}

function Test-RegistryValueEquals {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $Kind,
        [Parameter(Mandatory = $true)][object] $Expected
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    $valueObject = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue
    if ($null -eq $valueObject) {
        return $false
    }

    $actual = $valueObject.$Name
    switch ($Kind) {
        'String' { return [string]$actual -ceq [string]$Expected }
        'ExpandString' { return [string]$actual -ceq [string]$Expected }
        'DWord' { return [uint32]$actual -eq [uint32]$Expected }
        'QWord' { return [uint64]$actual -eq [uint64]$Expected }
        'MultiString' {
            $actualArray = @($actual)
            $expectedArray = @($Expected)
            if ($actualArray.Count -ne $expectedArray.Count) { return $false }
            for ($index = 0; $index -lt $actualArray.Count; $index++) {
                if ([string]$actualArray[$index] -cne [string]$expectedArray[$index]) { return $false }
            }
            return $true
        }
        'Binary' {
            $actualArray = [byte[]]$actual
            $expectedArray = [byte[]]$Expected
            if ($actualArray.Length -ne $expectedArray.Length) { return $false }
            for ($index = 0; $index -lt $actualArray.Length; $index++) {
                if ($actualArray[$index] -ne $expectedArray[$index]) { return $false }
            }
            return $true
        }
        default { return [string]$actual -ceq [string]$Expected }
    }
}

# Policy: Allow access to a list of URLs in InPrivate mode.
# Name: InPrivateModeUrlAllowlist
# Scope: Machine
# State: Enabled
# Source: msedge.admx

$keyPath = 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge\InPrivateModeUrlAllowlist'
if (Test-Path -LiteralPath $keyPath) {
    $propertyNames = (Get-Item -LiteralPath $keyPath).Property
    if ($propertyNames.Count -gt 0) {
        $reasons.Add('Key should be empty: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge\InPrivateModeUrlAllowlist') | Out-Null
    }
}

if ($reasons.Count -eq 0) {
    Write-Output 'Compliant'
    exit 0
}

$reasons | ForEach-Object { Write-Output $_ }
exit 1

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Allow access to a list of URLs in InPrivate mode.
# Name: InPrivateModeUrlAllowlist
# Scope: Machine
# State: Enabled
# Source: msedge.admx

Clear-RegistryKeyValues -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge\InPrivateModeUrlAllowlist'

History 37 retained releases

1. 153.0.4234.3211 Sep 2026
   • Description … allow URLs across all browsing modes and profiles, use the 'URLAllowlist' policy. [added: Blanket host wildcards (that is, "*" or "[*]") aren't allowed. Instead, use the 'InPrivateModeAvailability' policy to enable InPrivate mode globally. ]This policy supports up to 1000 entries. Example value: example.com https://ssl.server.com hosting.com/bad_path …
     Whole description, marked

     This policy allows administrators to specify a list of URL patterns that are permitted to open in InPrivate mode. It can be used to create exceptions for URL patterns defined in 'InPrivateModeUrlBlocklist' (Block access to a list of URLs in InPrivate mode.). See how to format a URL pattern (https://go.microsoft.com/fwlink/?linkid=2095322). If both this policy and 'InPrivateModeUrlBlocklist' are configured, the allowlist takes precedence. URLs that match a pattern on this allowlist are allowed. URLs that match the blocklist but not this allowlist are blocked. URLs that match neither list fall back to 'URLBlocklist' (Block access to a list of URLs) and 'URLAllowlist' (Define a list of allowed URLs). If this policy is configured and 'InPrivateModeUrlBlocklist' is not configured, only the URLs specified in this allowlist can be opened in InPrivate mode. All other URLs are blocked. If 'InPrivateModeAvailability' (Configure InPrivate mode availability) is set to disallow (value 1) but this policy is configured, InPrivate mode is available only for URLs that match the allowlist. If this policy is not configured, no exceptions are applied to 'InPrivateModeUrlBlocklist' or 'InPrivateModeAvailability'. This policy applies only to InPrivate mode. To allow URLs across all browsing modes and profiles, use the 'URLAllowlist' policy. [added: Blanket host wildcards (that is, "*" or "[*]") aren't allowed. Instead, use the 'InPrivateModeAvailability' policy to enable InPrivate mode globally. ]This policy supports up to 1000 entries. Example value: example.com https://ssl.server.com hosting.com/bad_path https://server:8080/path .exact.hostname.com file://* custom_scheme:* *

2. 150.0.4078.8016 Jul 2026
   • Already present in the first release ChangeIntel keeps.

35 later releases left it unchanged.

Template

Internal name

InPrivateModeUrlAllowlist

Namespace

Microsoft.Policies.Edge

Template file

msedge.admx

Release

Microsoft Edge 155.0.4283.62 · file set 0a733b0040dbbf02…

<policy class="Both" displayName="$(string.InPrivateModeUrlAllowlist)" explainText="$(string.InPrivateModeUrlAllowlist_Explain)" key="Software\Policies\Microsoft\Edge" name="InPrivateModeUrlAllowlist" presentation="$(presentation.InPrivateModeUrlAllowlist)" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Edge:microsoft_edge" />
      <supportedOn ref="Microsoft.Policies.Edge:SUPPORTED_WIN7_V147" />
      <elements>
        <list id="InPrivateModeUrlAllowlistDesc" key="Software\Policies\Microsoft\Edge\InPrivateModeUrlAllowlist" valuePrefix="" />
      </elements>
    </policy>

<presentation id="InPrivateModeUrlAllowlist" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions"><listBox refId="InPrivateModeUrlAllowlistDesc">Allow access to a list of URLs in InPrivate mode.</listBox></presentation>

Microsoft.Policies.Edge:category:microsoft_edge
<category displayName="$(string.microsoft_edge)" name="microsoft_edge" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
Microsoft.Policies.Edge:definition:SUPPORTED_WIN7_V147
<definition displayName="$(string.SUPPORTED_WIN7_V147)" name="SUPPORTED_WIN7_V147" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
Microsoft.Policies.Edge:category:microsoft_edge
<category displayName="$(string.microsoft_edge)" name="microsoft_edge" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
<strings><string id="Microsoft.Policies.Edge:microsoft_edge">Microsoft Edge</string></strings>
Microsoft.Policies.Edge:definition:SUPPORTED_WIN7_V147
<definition displayName="$(string.SUPPORTED_WIN7_V147)" name="SUPPORTED_WIN7_V147" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
<strings><string id="Microsoft.Policies.Edge:SUPPORTED_WIN7_V147">Microsoft Edge version 147, Windows 7 or later</string></strings>