Configure Web Content Filtering

What it does

Configure this policy to block access to specific categories of websites in Microsoft Edge on Windows devices. Web Content Filtering is available exclusively in Microsoft Edge on Windows and requires the appropriate Microsoft 365 licensing. When this policy is enabled, users are blocked from accessing URLs that fall within the defined list of content categories. You can configure this by adding Category Strings to the list of blocked categories. If the policy is not configured or is disabled, no categories will be blocked. To view the list of supported content categories, including each Category String and its definition, refer to: https://learn.microsoft.com/defender-endpoint/web-content-filtering?view=o365-worldwide#category-definitions To block a specific URL outside of a category, use the “Block access to a list of URLs” policy. To allow a specific URL that falls under a blocked category, use the “Define a list of allowed URLs” policy. Note: This policy is supported only when deployed through the Edge management service, not via Microsoft Intune. To use this policy, your organization must have one of the following licenses: - Microsoft 365 A1, A3, or A5 - Microsoft 365 Business Premium - Microsoft 365 Business Basic or Standard with Intune Plan 1 or Plan 2 Policy options mapping: * chat (chat) = Chat * child_abuse_images (child_abuse_images) = Child Abuse Images * criminal_activity (criminal_activity) = Criminal Activity * download_sites (download_sites) = Download Sites * gambling (gambling) = Gambling * games (games) = Games * hacking (hacking) = Hacking * hate_and_intolerance (hate_and_intolerance) = Hate and Intolerance * illegal_drug (illegal_drug) = Illegal Drug * illegal_software (illegal_software) = Illegal Software * image_sharing (image_sharing) = Image Sharing * instant_messaging (instant_messaging) = Instant Messaging * nudity (nudity) = Nudity * peer_to_peer (peer_to_peer) = Peer to Peer * pornography_or_sexually_explicit (pornography_or_sexually_explicit) = Pornography or Sexually Explicit * professional_networking (professional_networking) = Professional Networking * self_harm (self_harm) = Self Harm * sex_education (sex_education) = Sex Education * social_networking (social_networking) = Social Networking * streaming_and_downloads (streaming_and_downloads) = Streaming Media and Downloads * tasteless (tasteless) = Tasteless * violence (violence) = Violence * weapons (weapons) = Weapons * web_based_email (web_based_email) = Web Based Email * gen_ai (gen_ai) = Gen AI * shopping (shopping) = Shopping * 3p_search_engines (3p_search_engines) = 3P Search Engines * none (none) = None Use the preceding information when configuring this policy. Example value: gambling streaming_and_downloads games

What it writes

Hive

HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER

Registry key

Software\Policies\Microsoft\Edge

Options

Configure and deploy

Choose a state and the option values; the output below is generated from the template for exactly that.

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge\WebContentFilteringBlockedCategories]

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Configure Web Content Filtering
# Name: WebContentFilteringBlockedCategories
# Scope: Machine
# State: Enabled
# Source: msedge.admx

Clear-RegistryKeyValues -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge\WebContentFilteringBlockedCategories'

./Device/Vendor/MSFT/Policy/Config/ADMX_msedge/WebContentFilteringBlockedCategories

$ErrorActionPreference = 'Stop'
$reasons = [System.Collections.Generic.List[string]]::new()

function Test-RegistryValueExists {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    return $null -ne (Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue)
}

function Test-RegistryValueEquals {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $Kind,
        [Parameter(Mandatory = $true)][object] $Expected
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    $valueObject = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue
    if ($null -eq $valueObject) {
        return $false
    }

    $actual = $valueObject.$Name
    switch ($Kind) {
        'String' { return [string]$actual -ceq [string]$Expected }
        'ExpandString' { return [string]$actual -ceq [string]$Expected }
        'DWord' { return [uint32]$actual -eq [uint32]$Expected }
        'QWord' { return [uint64]$actual -eq [uint64]$Expected }
        'MultiString' {
            $actualArray = @($actual)
            $expectedArray = @($Expected)
            if ($actualArray.Count -ne $expectedArray.Count) { return $false }
            for ($index = 0; $index -lt $actualArray.Count; $index++) {
                if ([string]$actualArray[$index] -cne [string]$expectedArray[$index]) { return $false }
            }
            return $true
        }
        'Binary' {
            $actualArray = [byte[]]$actual
            $expectedArray = [byte[]]$Expected
            if ($actualArray.Length -ne $expectedArray.Length) { return $false }
            for ($index = 0; $index -lt $actualArray.Length; $index++) {
                if ($actualArray[$index] -ne $expectedArray[$index]) { return $false }
            }
            return $true
        }
        default { return [string]$actual -ceq [string]$Expected }
    }
}

# Policy: Configure Web Content Filtering
# Name: WebContentFilteringBlockedCategories
# Scope: Machine
# State: Enabled
# Source: msedge.admx

$keyPath = 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge\WebContentFilteringBlockedCategories'
if (Test-Path -LiteralPath $keyPath) {
    $propertyNames = (Get-Item -LiteralPath $keyPath).Property
    if ($propertyNames.Count -gt 0) {
        $reasons.Add('Key should be empty: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge\WebContentFilteringBlockedCategories') | Out-Null
    }
}

if ($reasons.Count -eq 0) {
    Write-Output 'Compliant'
    exit 0
}

$reasons | ForEach-Object { Write-Output $_ }
exit 1

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Configure Web Content Filtering
# Name: WebContentFilteringBlockedCategories
# Scope: Machine
# State: Enabled
# Source: msedge.admx

Clear-RegistryKeyValues -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge\WebContentFilteringBlockedCategories'

History 37 retained releases

1. 153.0.4234.3211 Sep 2026
   • Description … supported content categories, including each Category String and its definition, refer to: https://learn.microsoft.com/[removed: en-us/]defender-endpoint/web-content-filtering?view=o365-worldwide#category-definitions To block a specific URL outside of a category, use the “Block …
     Whole description, marked

     Configure this policy to block access to specific categories of websites in Microsoft Edge on Windows devices. Web Content Filtering is available exclusively in Microsoft Edge on Windows and requires the appropriate Microsoft 365 licensing. When this policy is enabled, users are blocked from accessing URLs that fall within the defined list of content categories. You can configure this by adding Category Strings to the list of blocked categories. If the policy is not configured or is disabled, no categories will be blocked. To view the list of supported content categories, including each Category String and its definition, refer to: https://learn.microsoft.com/[removed: en-us/]defender-endpoint/web-content-filtering?view=o365-worldwide#category-definitions To block a specific URL outside of a category, use the “Block access to a list of URLs” policy. To allow a specific URL that falls under a blocked category, use the “Define a list of allowed URLs” policy. Note: This policy is supported only when deployed through the Edge management service, not via Microsoft Intune. To use this policy, your organization must have one of the following licenses: - Microsoft 365 A1, A3, or A5 - Microsoft 365 Business Premium - Microsoft 365 Business Basic or Standard with Intune Plan 1 or Plan 2 Policy options mapping: * chat (chat) = Chat * child_abuse_images (child_abuse_images) = Child Abuse Images * criminal_activity (criminal_activity) = Criminal Activity * download_sites (download_sites) = Download Sites * gambling (gambling) = Gambling * games (games) = Games * hacking (hacking) = Hacking * hate_and_intolerance (hate_and_intolerance) = Hate and Intolerance * illegal_drug (illegal_drug) = Illegal Drug * illegal_software (illegal_software) = Illegal Software * image_sharing (image_sharing) = Image Sharing * instant_messaging (instant_messaging) = Instant Messaging * nudity (nudity) = Nudity * peer_to_peer (peer_to_peer) = Peer to Peer * pornography_or_sexually_explicit (pornography_or_sexually_explicit) = Pornography or Sexually Explicit * professional_networking (professional_networking) = Professional Networking * self_harm (self_harm) = Self Harm * sex_education (sex_education) = Sex Education * social_networking (social_networking) = Social Networking * streaming_and_downloads (streaming_and_downloads) = Streaming Media and Downloads * tasteless (tasteless) = Tasteless * violence (violence) = Violence * weapons (weapons) = Weapons * web_based_email (web_based_email) = Web Based Email * gen_ai (gen_ai) = Gen AI * shopping (shopping) = Shopping * 3p_search_engines (3p_search_engines) = 3P Search Engines * none (none) = None Use the preceding information when configuring this policy. Example value: gambling streaming_and_downloads games

2. 150.0.4078.8016 Jul 2026
   • Already present in the first release ChangeIntel keeps.

35 later releases left it unchanged.

Template

Internal name

WebContentFilteringBlockedCategories

Namespace

Microsoft.Policies.Edge

Template file

msedge.admx

Release

Microsoft Edge 155.0.4283.62 · file set 0a733b0040dbbf02…

<policy class="Both" displayName="$(string.WebContentFilteringBlockedCategories)" explainText="$(string.WebContentFilteringBlockedCategories_Explain)" key="Software\Policies\Microsoft\Edge" name="WebContentFilteringBlockedCategories" presentation="$(presentation.WebContentFilteringBlockedCategories)" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Edge:microsoft_edge" />
      <supportedOn ref="Microsoft.Policies.Edge:SUPPORTED_WIN7_V135" />
      <elements>
        <list id="WebContentFilteringBlockedCategoriesDesc" key="Software\Policies\Microsoft\Edge\WebContentFilteringBlockedCategories" valuePrefix="" />
      </elements>
    </policy>

<presentation id="WebContentFilteringBlockedCategories" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions"><listBox refId="WebContentFilteringBlockedCategoriesDesc">List of blocked categories</listBox></presentation>

Microsoft.Policies.Edge:category:microsoft_edge
<category displayName="$(string.microsoft_edge)" name="microsoft_edge" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
Microsoft.Policies.Edge:definition:SUPPORTED_WIN7_V135
<definition displayName="$(string.SUPPORTED_WIN7_V135)" name="SUPPORTED_WIN7_V135" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
Microsoft.Policies.Edge:category:microsoft_edge
<category displayName="$(string.microsoft_edge)" name="microsoft_edge" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
<strings><string id="Microsoft.Policies.Edge:microsoft_edge">Microsoft Edge</string></strings>
Microsoft.Policies.Edge:definition:SUPPORTED_WIN7_V135
<definition displayName="$(string.SUPPORTED_WIN7_V135)" name="SUPPORTED_WIN7_V135" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
<strings><string id="Microsoft.Policies.Edge:SUPPORTED_WIN7_V135">Microsoft Edge version 135, Windows 7 or later</string></strings>