Microsoft Edge: 153.0.4234.32 to 154.0.4258.37

Controls if users can take screenshots of the browser page. If you enable this policy, users can't take screenshots using keyboard shortcuts or extension APIs. If you disable or don't configure this policy, users can take screenshots. [added: As of Microsoft Edge version 154, enabling this policy also prevents extensions from attaching the debugger via 'chrome.debugger.attach()'. ]Note: Even if you disable screenshots using this policy, users might still be able to take screenshots using Web Capture within the browser or other methods outside of the browser. For example, using an operating system feature or another application.

Setting this policy controls extension management settings for Microsoft Edge, including those configured by other extension-related policies. This policy supersedes any legacy policies. This policy maps an extension ID or update URL to a specific configuration. You can define a default configuration using the special ID "*", which applies to extensions without a custom configuration. Note that any per-ID extension setting from either 'ExtensionInstallForcelist' (Control which extensions are installed silently), 'ExtensionInstallAllowlist' (Allow specific extensions to be installed), 'ExtensionInstallBlocklist' (Control which extensions cannot be installed), or 'ExtensionSettings' (Configure extension management settings) will only inherit 'installation_mode' and 'update_url' from the "*" defaults. It will not inherit any other properties. With an update URL, configuration applies to extensions with the exact update URL stated in the extension manifest. If the 'override_update_url' flag is set to true, the extension is installed and updated using the update URL specified in the 'ExtensionInstallForcelist' policy or in 'update_url' field in this policy. The flag 'override_update_url' is ignored if the 'update_url' is the Edge Add-ons website update URL. For more details, check out the detailed guide to ExtensionSettings policy available at https://go.microsoft.com/fwlink/?linkid=2161555. To block extensions from a particular third party store, you only need to block the update_url for that store. For example, if you want to block extensions from Chrome Web Store, you can use the following JSON. {"update_url:https://clients2.google.com/service/update2/crx":{"installation_mode":"blocked"}} Note that you can still use 'ExtensionInstallForcelist' and 'ExtensionInstallAllowlist' to allow / force install specific extensions even if the store is blocked using the JSON in the previous example. If the 'sidebar_auto_open_blocked' flag is set to true in an extension's configuration, the hub-app (sidebar app) corresponding to the specified extension will be prevented from automatically opening. [added: As of Microsoft Edge version 154, applying 'runtime_blocked_hosts' to an extension with the 'debugger' permission will completely disable 'chrome.debugger.attach()' on all targets. ]On Windows instances, apps and extensions from outside the Microsoft Edge Add-ons website can only be forced installed if the instance is joined to a Microsoft Active Directory domain or joined to Microsoft Azure Active Directory®. On macOS instances, apps and extensions from outside the Microsoft Edge Add-ons website can only be force installed if the instance is managed via MDM, joined to a domain via MCX. Starting in Microsoft Edge version 149, the 'Microsoft365CopilotChatIconEnabled' (Control whether Microsoft 365 Copilot Chat shows in the Microsoft Edge for Business toolbar) policy controls the display of Copilot in the toolbar. Example value: { "*": { "allowed_types": [ "hosted_app" ], "blocked_install_message": "Custom error message.", "blocked_permissions": [ "downloads", "bookmarks" ], "install_sources": [ "https://company-intranet/apps" ], "installation_mode": "blocked", "runtime_allowed_hosts": [ "*://good.contoso.com" ], "runtime_blocked_hosts": [ "*://*.contoso.com" ] }, "abcdefghijklmnopabcdefghijklmnop": { "blocked_permissions": [ "history" ], "installation_mode": "allowed", "minimum_version_required": "1.0.1", "file_url_navigation_allowed": true }, "bcdefghijklmnopabcdefghijklmnopa": { "allowed_permissions": [ "downloads" ], "installation_mode": "force_installed", "override_update_url": true, "sidebar_auto_open_blocked": true, "runtime_allowed_hosts": [ "*://good.contoso.com" ], "runtime_blocked_hosts": [ "*://*.contoso.com" ], "toolbar_state": "force_shown", "update_url": "https://contoso.com/update_url" }, "cdefghijklmnopabcdefghijklmnopab": { "blocked_install_message": "Custom error message.", "installation_mode": "blocked" }, "defghijklmnopabcdefghijklmnopabc,efghijklmnopabcdefghijklmnopabcd": { "blocked_install_message": "Custom error message.", "installation_mode": "blocked" }, "fghijklmnopabcdefghijklmnopabcde": { "blocked_install_message": "Custom removal message.", "installation_mode": "removed" }, "update_url:https://www.contoso.com/update.xml": { "allowed_permissions": [ "downloads" ], "blocked_permissions": [ "wallpaper" ], "installation_mode": "allowed" } } Compact example value: {"*": {"allowed_types": ["hosted_app"], "blocked_install_message": "Custom error message.", "blocked_permissions": ["downloads", "bookmarks"], "install_sources": ["https://company-intranet/apps"], "installation_mode": "blocked", "runtime_allowed_hosts": ["*://good.contoso.com"], "runtime_blocked_hosts": ["*://*.contoso.com"]}, "abcdefghijklmnopabcdefghijklmnop": {"blocked_permissions": ["history"], "installation_mode": "allowed", "minimum_version_required": "1.0.1", "file_url_navigation_allowed": true}, "bcdefghijklmnopabcdefghijklmnopa": {"allowed_permissions": ["downloads"], "installation_mode": "force_installed", "override_update_url": true, "sidebar_auto_open_blocked": true, "runtime_allowed_hosts": ["*://good.contoso.com"], "runtime_blocked_hosts": ["*://*.contoso.com"], "toolbar_state": "force_shown", "update_url": "https://contoso.com/update_url"}, "cdefghijklmnopabcdefghijklmnopab": {"blocked_install_message": "Custom error message.", "installation_mode": "blocked"}, "defghijklmnopabcdefghijklmnopabc,efghijklmnopabcdefghijklmnopabcd": {"blocked_install_message": "Custom error message.", "installation_mode": "blocked"}, "fghijklmnopabcdefghijklmnopabcde": {"blocked_install_message": "Custom removal message.", "installation_mode": "removed"}, "update_url:https://www.contoso.com/update.xml": {"allowed_permissions": ["downloads"], "blocked_permissions": ["wallpaper"], "installation_mode": "allowed"}}

Triggers an action when the computer is idle. If you set this policy, it specifies the length of time without user [removed: input (in minutes)][added: input, in minutes,] before the browser runs actions configured via the IdleTimeoutActions policy. If you don't set this policy, the browser doesn't run any action[added: s]. The minimum threshold is 1 minute. "User input" is defined by [removed: Operating System APIs,][added: operating system APIs] and includes [removed: things like][added: actions such as] moving the mouse or typing on the keyboard.[added: On Android, the operating system doesn't report the time since the user last interacted with the device. Instead, idle time is measured from the moment the device screen turns off, and it resets to zero when the user unlocks the device. While the screen is on, idle time is always zero, no matter how long the browser is left untouched. Idle actions therefore run after the device stays locked for longer than the configured timeout. The user sees the result the next time they unlock the device.]

Specifies IP address space overrides for Local Network Access restrictions. This policy allows administrators to treat specific IP address ranges as public (exempt from Local Network Access restrictions) or as local (subject to Local Network Access restrictions). IP address space overrides can be specified using one of the following formats: • [cidr]=[public|local|loopback] where [cidr] is an IP address range in CIDR notation. CIDR overrides apply to all ports. • [ip-address]:[port]=[public|local|loopback] IPv6 addresses must be specified in URL-safe (bracketed) format. For more information about Local Network Access, see https://wicg.github.io/local-network-access/. [added: This policy does not support dynamic refresh. Changes take effect only after browser restart. Overrides from the command-line switch --ip-address-space-overrides take precedence over overrides set by this policy. ]Example value: 100.64.0.0/10=public [2001:db8::]/32=local 192.168.0.1:8000=public [2001:DB8::8:800:200C:417A]:8080=local

This policy allows for opting out of restrictions on requests to local network endpoints. If you enable this policy, Local Network Access requests will only display warnings in Edge DevTools when Local Network Access checks fail. If you disable or don't configure this policy, Local Network Access requests follow the default handling behavior. For more information about Local Network Access restrictions, see Local Network Access. To allow specific URL patterns that should automatically be granted Local Network Access permission, use the LocalNetworkAccessAllowedForUrls policy. Note: This opt-out policy is temporary and will be removed after Microsoft Edge version [removed: 156.][added: 163.]

Controls which website origins are exempt from Local Network Access checks when accessing local network endpoints. Network requests initiated from websites that match the specified URL patterns are not subject to Local Network Access checks. For origins not covered by the patterns specified in this policy, the user's personal configuration applies. For detailed information about valid URL patterns, see https://learn.microsoft.com/deployedge/edge-learnmore-ent-policy-url-patterns. For more information about Local Network Access restrictions, see https://wicg.github.io/local-network-access/. Multiple policies can list origins that affect requests to local network endpoints. If an origin matches more than one of the following policies, they take precedence in the following order: - LocalNetworkBlockedForUrls - LocalNetworkAllowedForUrls - [removed: LoopbackNetworkBlockedForUrls - LoopbackNetworkAllowedForUrls - ]LocalNetworkAccessBlockedForUrls - LocalNetworkAccessAllowedForUrls This policy controls access to local network endpoints (private IP addresses) and can be used to allow specific websites to access local network resources. Example value: http://www.example.com:8080 [*.]example.edu *

Controls which website origins are blocked from making Local Network Access requests to local network endpoints. Network requests initiated from websites that match the specified URL patterns are blocked from issuing Local Network Access requests. For origins not covered by the patterns specified in this policy, the user's personal configuration applies. For detailed information about valid URL patterns, see https://learn.microsoft.com/deployedge/edge-learnmore-ent-policy-url-patterns. For more information about Local Network Access restrictions, see https://wicg.github.io/local-network-access/. Multiple policies can list origins that affect requests to local network endpoints. If an origin matches more than one of the following policies, they take precedence in the following order: - LocalNetworkBlockedForUrls - LocalNetworkAllowedForUrls - [removed: LoopbackNetworkBlockedForUrls - LoopbackNetworkAllowedForUrls - ]LocalNetworkAccessBlockedForUrls - LocalNetworkAccessAllowedForUrls This policy controls access to local network endpoints (private IP addresses) and can be used to block specific websites from accessing local network resources. Example value: http://www.example.com:8080 [*.]example.edu *

[removed: The][added: This] policy [removed: enables Digital Signature validation for][added: controls whether the native PDF reader validates certificate-based digital signatures in] PDF files in a secure environment[removed: , which show][added: and display]s the [removed: correct validation status of the signatures.][added: validation status. Starting with Microsoft Edge version 154, this capability is enabled by default on Windows. It remains disabled by default on macOS and on Windows in earlier versions.] If you enable this policy, [added: the native ]PDF [removed: files with Certificate-based][added: reader validates certificate-based] digital signatures [removed: are opened with ][added: and provides ]an option to view [removed: and verify the validity of][added: the validation status. If you don't configure this policy,] the [removed: signatures with high security.][added: default behavior described above applies.] If you disable [removed: or don't configure this policy, the capability][added: this policy, the native PDF reader doesn't validate certificate-based digital signatures or provide an option] to view [removed: and verify ]the [removed: signature isn't available.][added: validation status.]

This policy lets you specify the exact 4-part version of the WebView2 Runtime that specific applications should use in enterprise downgrade scenarios. Configure the policy by setting the value name to the Application User Model ID or the executable file name (for example, [added: ms-]teams.exe). Set the value to the target full version string using the 4-part numeric format (for example, 151.0.2178.0). Major-only values (for example, 151), wildcard values (for example, 151.*), and values that are not exact 4-part numeric versions are not supported. [added: Enterprise downgrade supports target versions from N-1 through N-4 relative to the current Evergreen WebView2 Runtime major version. ]The WebView2 loader resolves the runtime installation directory only when a folder that exactly matches the configured full version exists (for example, 151.0.2178.0 must match 151.0.2178.0 exactly). If no exact matching folder is found, the policy has no effect and the runtime defaults to the BrowserExecutableFolder policy or the Evergreen runtime (the default auto-updating runtime). Example value: Name: [added: ms-]teams.exe, Value: 151.0.2178.0 Name: o[removed: utloo][added: l]k.exe, Value: 152.0.2164.0