Microsoft Edge: 152.0.4191.137 to 154.0.4258.62

Allows users to create new profiles, using the **Add profile** option. If you enable this policy or don't configure it, Microsoft Edge allows users to use **Add profile** on the Identity flyout menu or the Settings page to create new profiles. If you disable this policy, users cannot add new profiles from the Identity flyout menu or the Settings page.[added: This policy applies to profile creation from the Microsoft Edge user interface. To further restrict profile use, configure the 'BrowserSignin' (Browser sign-in settings) and 'RestrictSigninToPattern' (Restrict which accounts can be used to sign in to Microsoft Edge) policies.]

Controls if users can take screenshots of the browser page. If you enable this policy, users can't take screenshots using keyboard shortcuts or extension APIs. If you disable or don't configure this policy, users can take screenshots. [added: As of Microsoft Edge version 154, enabling this policy also prevents extensions from attaching the debugger via 'chrome.debugger.attach()'. ]Note: Even if you disable screenshots using this policy, users might still be able to take screenshots using Web Capture within the browser or other methods outside of the browser. For example, using an operating system feature or another application.

Setting this policy controls extension management settings for Microsoft Edge, including those configured by other extension-related policies. This policy supersedes any legacy policies. This policy maps an extension ID or update URL to a specific configuration. You can define a default configuration using the special ID "*", which applies to extensions without a custom configuration. Note that any per-ID extension setting from either 'ExtensionInstallForcelist' (Control which extensions are installed silently), 'ExtensionInstallAllowlist' (Allow specific extensions to be installed), 'ExtensionInstallBlocklist' (Control which extensions cannot be installed), or 'ExtensionSettings' (Configure extension management settings) will only inherit 'installation_mode' and 'update_url' from the "*" defaults. It will not inherit any other properties. With an update URL, configuration applies to extensions with the exact update URL stated in the extension manifest. If the 'override_update_url' flag is set to true, the extension is installed and updated using the update URL specified in the 'ExtensionInstallForcelist' policy or in 'update_url' field in this policy. The flag 'override_update_url' is ignored if the 'update_url' is the Edge Add-ons website update URL. For more details, check out the detailed guide to ExtensionSettings policy available at https://go.microsoft.com/fwlink/?linkid=2161555. To block extensions from a particular third party store, you only need to block the update_url for that store. For example, if you want to block extensions from Chrome Web Store, you can use the following JSON. {"update_url:https://clients2.google.com/service/update2/crx":{"installation_mode":"blocked"}} Note that you can still use 'ExtensionInstallForcelist' and 'ExtensionInstallAllowlist' to allow / force install specific extensions even if the store is blocked using the JSON in the previous example. If the 'sidebar_auto_open_blocked' flag is set to true in an extension's configuration, the hub-app (sidebar app) corresponding to the specified extension will be prevented from automatically opening. [added: As of Microsoft Edge version 154, applying 'runtime_blocked_hosts' to an extension with the 'debugger' permission will completely disable 'chrome.debugger.attach()' on all targets. ]On Windows instances, apps and extensions from outside the Microsoft Edge Add-ons website can only be forced installed if the instance is joined to a Microsoft Active Directory domain or joined to Microsoft Azure Active Directory®. On macOS instances, apps and extensions from outside the Microsoft Edge Add-ons website can only be force installed if the instance is managed via MDM, joined to a domain via MCX. Starting in Microsoft Edge version 149, the 'Microsoft365CopilotChatIconEnabled' (Control whether Microsoft 365 Copilot Chat shows in the Microsoft Edge for Business toolbar) policy controls the display of Copilot in the toolbar. Example value: { "*": { "allowed_types": [ "hosted_app" ], "blocked_install_message": "Custom error message.", "blocked_permissions": [ "downloads", "bookmarks" ], "install_sources": [ "https://company-intranet/apps" ], "installation_mode": "blocked", "runtime_allowed_hosts": [ "*://good.contoso.com" ], "runtime_blocked_hosts": [ "*://*.contoso.com" ] }, "abcdefghijklmnopabcdefghijklmnop": { "blocked_permissions": [ "history" ], "installation_mode": "allowed", "minimum_version_required": "1.0.1", "file_url_navigation_allowed": true }, "bcdefghijklmnopabcdefghijklmnopa": { "allowed_permissions": [ "downloads" ], "installation_mode": "force_installed", "override_update_url": true, "sidebar_auto_open_blocked": true, "runtime_allowed_hosts": [ "*://good.contoso.com" ], "runtime_blocked_hosts": [ "*://*.contoso.com" ], "toolbar_state": "force_shown", "update_url": "https://contoso.com/update_url" }, "cdefghijklmnopabcdefghijklmnopab": { "blocked_install_message": "Custom error message.", "installation_mode": "blocked" }, "defghijklmnopabcdefghijklmnopabc,efghijklmnopabcdefghijklmnopabcd": { "blocked_install_message": "Custom error message.", "installation_mode": "blocked" }, "fghijklmnopabcdefghijklmnopabcde": { "blocked_install_message": "Custom removal message.", "installation_mode": "removed" }, "update_url:https://www.contoso.com/update.xml": { "allowed_permissions": [ "downloads" ], "blocked_permissions": [ "wallpaper" ], "installation_mode": "allowed" } } Compact example value: {"*": {"allowed_types": ["hosted_app"], "blocked_install_message": "Custom error message.", "blocked_permissions": ["downloads", "bookmarks"], "install_sources": ["https://company-intranet/apps"], "installation_mode": "blocked", "runtime_allowed_hosts": ["*://good.contoso.com"], "runtime_blocked_hosts": ["*://*.contoso.com"]}, "abcdefghijklmnopabcdefghijklmnop": {"blocked_permissions": ["history"], "installation_mode": "allowed", "minimum_version_required": "1.0.1", "file_url_navigation_allowed": true}, "bcdefghijklmnopabcdefghijklmnopa": {"allowed_permissions": ["downloads"], "installation_mode": "force_installed", "override_update_url": true, "sidebar_auto_open_blocked": true, "runtime_allowed_hosts": ["*://good.contoso.com"], "runtime_blocked_hosts": ["*://*.contoso.com"], "toolbar_state": "force_shown", "update_url": "https://contoso.com/update_url"}, "cdefghijklmnopabcdefghijklmnopab": {"blocked_install_message": "Custom error message.", "installation_mode": "blocked"}, "defghijklmnopabcdefghijklmnopabc,efghijklmnopabcdefghijklmnopabcd": {"blocked_install_message": "Custom error message.", "installation_mode": "blocked"}, "fghijklmnopabcdefghijklmnopabcde": {"blocked_install_message": "Custom removal message.", "installation_mode": "removed"}, "update_url:https://www.contoso.com/update.xml": {"allowed_permissions": ["downloads"], "blocked_permissions": ["wallpaper"], "installation_mode": "allowed"}}

Triggers an action when the computer is idle. If you set this policy, it specifies the length of time without user [removed: input (in minutes)][added: input, in minutes,] before the browser runs actions configured via the IdleTimeoutActions policy. If you don't set this policy, the browser doesn't run any action[added: s]. The minimum threshold is 1 minute. "User input" is defined by [removed: Operating System APIs,][added: operating system APIs] and includes [removed: things like][added: actions such as] moving the mouse or typing on the keyboard.[added: On Android, the operating system doesn't report the time since the user last interacted with the device. Instead, idle time is measured from the moment the device screen turns off, and it resets to zero when the user unlocks the device. While the screen is on, idle time is always zero, no matter how long the browser is left untouched. Idle actions therefore run after the device stays locked for longer than the configured timeout. The user sees the result the next time they unlock the device.]

This policy sets the default directory that Microsoft Edge uses to download files. Users can change the directory through browser settings. If you don't configure this policy, Microsoft Edge uses the platform-specific default download directory. This policy has no effect if the DownloadDirectory policy is set. For a list of supported variables, see https://learn.microsoft.com/[removed: en-us/]deployedge/edge-learnmore-create-user-directory-vars . Example value: /home/${user_name}/Downloads

Specifies IP address space overrides for Local Network Access restrictions. This policy allows administrators to treat specific IP address ranges as public (exempt from Local Network Access restrictions) or as local (subject to Local Network Access restrictions). IP address space overrides can be specified using one of the following formats: • [cidr]=[public|local|loopback] where [cidr] is an IP address range in CIDR notation. CIDR overrides apply to all ports. • [ip-address]:[port]=[public|local|loopback] IPv6 addresses must be specified in URL-safe (bracketed) format. For more information about Local Network Access, see https://wicg.github.io/local-network-access/. [added: This policy does not support dynamic refresh. Changes take effect only after browser restart. Overrides from the command-line switch --ip-address-space-overrides take precedence over overrides set by this policy. ]Example value: 100.64.0.0/10=public [2001:db8::]/32=local 192.168.0.1:8000=public [2001:DB8::8:800:200C:417A]:8080=local

This policy controls where developer tools can be used in Microsoft Edge by specifying an allowlist of URL patterns. URL patterns are matched against the URL of every frame on the page being inspected. If you configure this policy and do not configure the 'DeveloperToolsAvailabilityBlocklist' (List of URL patterns for which developer tools are blocked) policy, developer tools are available only when every frame on the page matches a pattern in this allowlist. If any frame does not match, developer tools are blocked for the entire page. For information on the URL format, see https://go.microsoft.com/fwlink/?linkid=2095322 . If you configure both this policy and the 'DeveloperToolsAvailabilityBlocklist' policy, this allowlist takes precedence. URLs that match this allowlist are allowed even if they also match the blocklist. URLs that match the blocklist but not this allowlist are blocked. URLs that match neither are governed by the 'DeveloperToolsAvailability' (Control where developer tools can be used) policy. If you disable or do not configure this policy, developer tools availability is determined by the 'DeveloperToolsAvailabilityBlocklist' and 'DeveloperToolsAvailability' policies. This policy applies to developer tools opened for websites, extensions, and web applications. [added: Blanket host wildcards (that is, "*" or "[*]") aren't allowed. To enable developer tools globally, use the 'DeveloperToolsAvailability' policy. ]This policy supports up to 1,000 entries. Example value: contoso.com https://ssl.server.com contoso.com/good_path https://server.contoso.com:8080/path .exact.hostname.com file://*

This policy allows for opting out of restrictions on requests to local network endpoints. If you enable this policy, Local Network Access requests will only display warnings in Edge DevTools when Local Network Access checks fail. If you disable or don't configure this policy, Local Network Access requests follow the default handling behavior. For more information about Local Network Access restrictions, see Local Network Access. To allow specific URL patterns that should automatically be granted Local Network Access permission, use the LocalNetworkAccessAllowedForUrls policy. Note: This opt-out policy is temporary and will be removed after Microsoft Edge version [removed: 156.][added: 163.]

Controls which website origins are exempt from Local Network Access checks when accessing local network endpoints. Network requests initiated from websites that match the specified URL patterns are not subject to Local Network Access checks. For origins not covered by the patterns specified in this policy, the user's personal configuration applies. For detailed information about valid URL patterns, see https://learn.microsoft.com/deployedge/edge-learnmore-ent-policy-url-patterns. For more information about Local Network Access restrictions, see https://wicg.github.io/local-network-access/. Multiple policies can list origins that affect requests to local network endpoints. If an origin matches more than one of the following policies, they take precedence in the following order: - LocalNetworkBlockedForUrls - LocalNetworkAllowedForUrls - [removed: LoopbackNetworkBlockedForUrls - LoopbackNetworkAllowedForUrls - ]LocalNetworkAccessBlockedForUrls - LocalNetworkAccessAllowedForUrls This policy controls access to local network endpoints (private IP addresses) and can be used to allow specific websites to access local network resources. Example value: http://www.example.com:8080 [*.]example.edu *

Controls which website origins are blocked from making Local Network Access requests to local network endpoints. Network requests initiated from websites that match the specified URL patterns are blocked from issuing Local Network Access requests. For origins not covered by the patterns specified in this policy, the user's personal configuration applies. For detailed information about valid URL patterns, see https://learn.microsoft.com/deployedge/edge-learnmore-ent-policy-url-patterns. For more information about Local Network Access restrictions, see https://wicg.github.io/local-network-access/. Multiple policies can list origins that affect requests to local network endpoints. If an origin matches more than one of the following policies, they take precedence in the following order: - LocalNetworkBlockedForUrls - LocalNetworkAllowedForUrls - [removed: LoopbackNetworkBlockedForUrls - LoopbackNetworkAllowedForUrls - ]LocalNetworkAccessBlockedForUrls - LocalNetworkAccessAllowedForUrls This policy controls access to local network endpoints (private IP addresses) and can be used to block specific websites from accessing local network resources. Example value: http://www.example.com:8080 [*.]example.edu *

This policy setting lets you configure when energy saver becomes active. By default, energy saver is set to 'BalancedSavings'. On devices with no battery, energy saver is disabled by default and does not become active. Please note that Windows Energy Saver settings can influence when energy saver becomes active on all devices. Individual sites may be blocked from participating in energy saver by configuring the policy 'SleepingTabsBlockedForUrls' (Block sleeping tabs on specific sites). Set this policy to 'AlwaysActive' and energy saver is always active. Set this policy to 'NeverActive' and energy saver never becomes active. Set this policy to 'ActiveWhenUnplugged' and energy saver becomes active when the device is unplugged. Set this policy to 'ActiveWhenUnpluggedBatteryLow' and energy saver becomes active when the device is unplugged and the battery is low. Set this policy to 'BalancedSavings' and when the device is unplugged, energy saver takes moderate steps to save battery. When the device is unplugged and the battery is low, energy saver takes extra steps to save battery. Set this policy to 'MaximumSavings' and when the device is unplugged or unplugged and the battery is low, energy saver takes extra steps to save battery. If the device does not have a battery, energy saver never becomes active in any mode other than 'AlwaysActive' unless the setting or 'EfficiencyModeEnabled' (Efficiency mode enabled) policy is enabled. This policy has no effect if the 'EfficiencyModeEnabled' policy is disabled. Learn more about energy saver: https://go.microsoft.com/fwlink/?linkid=2173921 Learn more about energy saver: https://learn.microsoft.com/[removed: en-us/]windows-hardware/design/component-guidelines/energy-saver Policy options mapping: * AlwaysActive (0) = Energy saver is always active * NeverActive (1) = Energy saver is never active * ActiveWhenUnplugged (2) = Energy saver is active when the device is unplugged * ActiveWhenUnpluggedBatteryLow (3) = Energy saver is active when the device is unplugged and the battery is low * BalancedSavings (4) = When the device is unplugged, energy saver takes moderate steps to save battery. When the device is unplugged and the battery is low, energy saver takes extra steps to save battery. * MaximumSavings (5) = When the device is unplugged or unplugged and the battery is low, energy saver takes extra steps to save battery. Use the preceding information when configuring this policy.

[removed: The][added: This] policy [removed: enables Digital Signature validation for][added: controls whether the native PDF reader validates certificate-based digital signatures in] PDF files in a secure environment[removed: , which show][added: and display]s the [removed: correct validation status of the signatures.][added: validation status. Starting with Microsoft Edge version 154, this capability is enabled by default on Windows. It remains disabled by default on macOS and on Windows in earlier versions.] If you enable this policy, [added: the native ]PDF [removed: files with Certificate-based][added: reader validates certificate-based] digital signatures [removed: are opened with ][added: and provides ]an option to view [removed: and verify the validity of][added: the validation status. If you don't configure this policy,] the [removed: signatures with high security.][added: default behavior described above applies.] If you disable [removed: or don't configure this policy, the capability][added: this policy, the native PDF reader doesn't validate certificate-based digital signatures or provide an option] to view [removed: and verify ]the [removed: signature isn't available.][added: validation status.]

This policy setting lets you configure when energy saver becomes active. By default, energy saver is set to 'BalancedSavings'. On devices with no battery, energy saver is disabled by default and does not become active. Please note that Windows Energy Saver settings can influence when energy saver becomes active on all devices. Individual sites may be blocked from participating in energy saver by configuring the policy 'SleepingTabsBlockedForUrls' (Block sleeping tabs on specific sites). Set this policy to 'AlwaysActive' and energy saver is always active. Set this policy to 'NeverActive' and energy saver never becomes active. Set this policy to 'ActiveWhenUnplugged' and energy saver becomes active when the device is unplugged. Set this policy to 'ActiveWhenUnpluggedBatteryLow' and energy saver becomes active when the device is unplugged and the battery is low. Set this policy to 'BalancedSavings' and when the device is unplugged, energy saver takes moderate steps to save battery. When the device is unplugged and the battery is low, energy saver takes extra steps to save battery. Set this policy to 'MaximumSavings' and when the device is unplugged or unplugged and the battery is low, energy saver takes extra steps to save battery. If the device does not have a battery, energy saver never becomes active in any mode other than 'AlwaysActive' unless the setting or 'EfficiencyModeEnabled' (Efficiency mode enabled) policy is enabled. This policy has no effect if the 'EfficiencyModeEnabled' policy is disabled. Learn more about energy saver: https://go.microsoft.com/fwlink/?linkid=2173921 Learn more about energy saver: https://learn.microsoft.com/[removed: en-us/]windows-hardware/design/component-guidelines/energy-saver Policy options mapping: * AlwaysActive (0) = Energy saver is always active * NeverActive (1) = Energy saver is never active * ActiveWhenUnplugged (2) = Energy saver is active when the device is unplugged * ActiveWhenUnpluggedBatteryLow (3) = Energy saver is active when the device is unplugged and the battery is low * BalancedSavings (4) = When the device is unplugged, energy saver takes moderate steps to save battery. When the device is unplugged and the battery is low, energy saver takes extra steps to save battery. * MaximumSavings (5) = When the device is unplugged or unplugged and the battery is low, energy saver takes extra steps to save battery. Use the preceding information when configuring this policy.

This policy allows administrators to specify a list of URL patterns that are permitted to open in InPrivate mode. It can be used to create exceptions for URL patterns defined in 'InPrivateModeUrlBlocklist' (Block access to a list of URLs in InPrivate mode.). See how to format a URL pattern (https://go.microsoft.com/fwlink/?linkid=2095322). If both this policy and 'InPrivateModeUrlBlocklist' are configured, the allowlist takes precedence. URLs that match a pattern on this allowlist are allowed. URLs that match the blocklist but not this allowlist are blocked. URLs that match neither list fall back to 'URLBlocklist' (Block access to a list of URLs) and 'URLAllowlist' (Define a list of allowed URLs). If this policy is configured and 'InPrivateModeUrlBlocklist' is not configured, only the URLs specified in this allowlist can be opened in InPrivate mode. All other URLs are blocked. If 'InPrivateModeAvailability' (Configure InPrivate mode availability) is set to disallow (value 1) but this policy is configured, InPrivate mode is available only for URLs that match the allowlist. If this policy is not configured, no exceptions are applied to 'InPrivateModeUrlBlocklist' or 'InPrivateModeAvailability'. This policy applies only to InPrivate mode. To allow URLs across all browsing modes and profiles, use the 'URLAllowlist' policy. [added: Blanket host wildcards (that is, "*" or "[*]") aren't allowed. Instead, use the 'InPrivateModeAvailability' policy to enable InPrivate mode globally. ]This policy supports up to 1000 entries. Example value: example.com https://ssl.server.com hosting.com/bad_path https://server:8080/path .exact.hostname.com file://* custom_scheme:* *

This policy configures the on-device real-time video translation feature in Microsoft Edge. With this feature, users can watch videos translated into their selected language in real time. When a user selects the Translate icon and chooses a source (video language) and target language (translated language), translation components are downloaded on first use (approximately 200 MB per language pair). These components can be updated periodically to improve performance and translation quality. Translation is performed locally on the user’s device and no data is sent outside of the device. The feature is available only for non-DRM videos, on supported high-end devices, with select language pairs, and in select regions. For more information, see https://www.microsoft.com/e[removed: n-us/e]dge/features/real-time-video-translation. If you enable or don’t configure this policy, the on-device real-time video translation feature is enabled and users will see the Translate button when hovering over videos. If you disable this policy, the on-device real-time video translation feature is disabled and the Translate button is not shown.

Specifies a list of URL patterns for which requests initiated from matching origins are exempt from Local Network Access restrictions. Network requests initiated from websites served by matching origins are not subject to Local Network Access checks. For origins not covered by the patterns specified here, the user's personal configuration and applicable local network access restrictions apply. There are multiple policies that control origins impacting requests to local device and local network endpoints. If an origin matches more than one of the following policies, the policies take precedence in the following order: - LocalNetworkBlockedForUrls - LocalNetworkAllowedForUrls - LoopbackNetwork[removed: Access]BlockedForUrls - LoopbackNetworkA[removed: ccessA]llowedForUrls - LocalNetworkAccessBlockedForUrls - LocalNetworkAccessAllowedForUrls For detailed information about valid URL pattern syntax, see: https://learn.microsoft.com/deployedge/edge-learnmore-ent-policy-url-patterns For more information about Local Network Access, see: https://wicg.github.io/local-network-access/ Note: This policy enables controlled exceptions to local network access restrictions. It allows specified public websites to access private IP addresses when required for trusted local communication scenarios. Example value: http://www.example.com:8080 [*.]example.edu *

Specifies a list of URL patterns for which requests initiated from matching origins are blocked from issuing Local Network Access requests. Network requests initiated from websites served by matching origins are prevented from accessing local device and local network endpoints. For origins not covered by the patterns specified here, the user's personal configuration applies. There are multiple policies that control origins impacting requests to local device and local network endpoints. If an origin matches more than one of the following policies, the policies take precedence in the following order: - LocalNetworkBlockedForUrls - LocalNetworkAllowedForUrls - LoopbackNetwork[removed: Access]BlockedForUrls - LoopbackNetworkA[removed: ccessA]llowedForUrls - LocalNetworkAccessBlockedForUrls - LocalNetworkAccessAllowedForUrls For detailed information about valid URL pattern syntax, see: https://learn.microsoft.com/deployedge/edge-learnmore-ent-policy-url-patterns For more information about Local Network Access, see: https://wicg.github.io/local-network-access/ Note: This policy blocks specified public websites from accessing private IP addresses. It helps reduce exposure of internal network resources unless access is explicitly permitted by policy. Example value: http://www.example.com:8080 [*.]example.edu *

This policy lets you specify the exact 4-part version of the WebView2 Runtime that specific applications should use in enterprise downgrade scenarios. Configure the policy by setting the value name to the Application User Model ID or the executable file name (for example, [added: ms-]teams.exe). Set the value to the target full version string using the 4-part numeric format (for example, 151.0.2178.0). Major-only values (for example, 151), wildcard values (for example, 151.*), and values that are not exact 4-part numeric versions are not supported. [added: Enterprise downgrade supports target versions from N-1 through N-4 relative to the current Evergreen WebView2 Runtime major version. ]The WebView2 loader resolves the runtime installation directory only when a folder that exactly matches the configured full version exists (for example, 151.0.2178.0 must match 151.0.2178.0 exactly). If no exact matching folder is found, the policy has no effect and the runtime defaults to the BrowserExecutableFolder policy or the Evergreen runtime (the default auto-updating runtime). Example value: Name: [added: ms-]teams.exe, Value: 151.0.2178.0 Name: o[removed: utloo][added: l]k.exe, Value: 152.0.2164.0

Configure this policy to block access to specific categories of websites in Microsoft Edge on Windows devices. Web Content Filtering is available exclusively in Microsoft Edge on Windows and requires the appropriate Microsoft 365 licensing. When this policy is enabled, users are blocked from accessing URLs that fall within the defined list of content categories. You can configure this by adding Category Strings to the list of blocked categories. If the policy is not configured or is disabled, no categories will be blocked. To view the list of supported content categories, including each Category String and its definition, refer to: https://learn.microsoft.com/[removed: en-us/]defender-endpoint/web-content-filtering?view=o365-worldwide#category-definitions To block a specific URL outside of a category, use the “Block access to a list of URLs” policy. To allow a specific URL that falls under a blocked category, use the “Define a list of allowed URLs” policy. Note: This policy is supported only when deployed through the Edge management service, not via Microsoft Intune. To use this policy, your organization must have one of the following licenses: - Microsoft 365 A1, A3, or A5 - Microsoft 365 Business Premium - Microsoft 365 Business Basic or Standard with Intune Plan 1 or Plan 2 Policy options mapping: * chat (chat) = Chat * child_abuse_images (child_abuse_images) = Child Abuse Images * criminal_activity (criminal_activity) = Criminal Activity * download_sites (download_sites) = Download Sites * gambling (gambling) = Gambling * games (games) = Games * hacking (hacking) = Hacking * hate_and_intolerance (hate_and_intolerance) = Hate and Intolerance * illegal_drug (illegal_drug) = Illegal Drug * illegal_software (illegal_software) = Illegal Software * image_sharing (image_sharing) = Image Sharing * instant_messaging (instant_messaging) = Instant Messaging * nudity (nudity) = Nudity * peer_to_peer (peer_to_peer) = Peer to Peer * pornography_or_sexually_explicit (pornography_or_sexually_explicit) = Pornography or Sexually Explicit * professional_networking (professional_networking) = Professional Networking * self_harm (self_harm) = Self Harm * sex_education (sex_education) = Sex Education * social_networking (social_networking) = Social Networking * streaming_and_downloads (streaming_and_downloads) = Streaming Media and Downloads * tasteless (tasteless) = Tasteless * violence (violence) = Violence * weapons (weapons) = Weapons * web_based_email (web_based_email) = Web Based Email * gen_ai (gen_ai) = Gen AI * shopping (shopping) = Shopping * 3p_search_engines (3p_search_engines) = 3P Search Engines * none (none) = None Use the preceding information when configuring this policy. Example value: gambling streaming_and_downloads games