This post gives an overview of Edge Enterprise with Windows MAM, with the goal of protecting corporate data from being stored on personal unmanaged windows devices, and also the features that I feel are missing and hopefully to come from the solution.
By setting the following settings in Microsoft Intune you can achieve the following.
- Allow corporate Windows devices to continue to access data without restriction
- Block unmanaged personal Windows devices from accessing Corporate Office365 data from any apps apart from Microsoft Edge.
- Allow access to Office365 using personal unmanaged Windows devices through Microsoft Edge but restrict Downloads, Copy Paste and Print
Requirements
- Microsoft E3 Licensing – Intune
- Windows 10 or Windows 11 minimum 20h2
Setup
In Intune > Connectors and tokens > Mobile Threat Defense add the Windows Security Center Connector
In Devices > Enrollment > Enrollment Restrictions Windows MDM Personally Owned should be blocked otherwise your users can just join their device to Intune then they’ll be compliant and get around the point of this whole restriction
Conditional Access (2 policies will be created)
1st Conditional Access Policy (to block access using apps i.e office software on unmanaged Windows devices, and exclude corporate devices from policy)
Configure 1st conditional access with the following settings
Devices > Conditional Access
Give your policy a name and target it to a group (start small for testing)
For now we will just target Office365
In the conditions we will add
Device Platforms Windows
Client Apps
Mobile Apps and Desktop clients, Exchange Active Sync, Other Clients
Filter for devices Exclude Company devices
Grant
Grant Access to devices marked as compliant
Conditional Access Policy 2
2nd Conditional Access Policy (to allow access to Office365 using Edge on unmanaged Windows devices, and exclude corporate devices from policy)
Configure 2nd conditional access with the following settings
Give your 2nd policy a name and target it to the same group as 1st policy (start small for testing)
For now we will just target Office365
In the conditions we will add
Device Platforms Windows
Client Apps Browser
Filter for Company Devices Exclude Company owned
Require App Protection Policy Grant Access
Session see note below (not needed)
Note* Use Conditional Access App Control and Block Downloads (This may need Cloud App Security Licensing) in testing this setting seems to make no difference to MAM with Edge and you should not have to set it for all of this to work, Edge seems to still block downloads without it as the Application Management settings take care of all this.
Summary of Conditional Access
Policy 1 says a Windows device trying to connect to Office365 using apps i.e Office365 check if the device is compliant and if so allow access. The reason this policy works is you cannot become compliant on an ummanaged non MDM device, so you are effectively blocked from access
Policy 2 says grant access if using Edge and Edge has an app Protection policy so on entry Conditional Access will check for Edge and if the user has an app protection policy applied
Both Policy 1 and 2 exclude corporate devices so if you have for example an Intune device it should be seen as a company device and conditional access excludes the device from the policies altogether, and allows normal access.
App Protection Policy
Now we will set the App Protection Policy, as the policy above grants you access if you are using Edge and you have an App protection policy applied
Settings for the App protection policy
APPS > App Protection Policies > Create > Windows
Give your policy a name
Choose Microsoft Edge
These settings can be of your choosing the below is more restrictive not allowing copy and paste or sending data anywhere or printing
For the health checks its good to add disabled account as either block access or Wipe Data (Wipe data can ensure the edge session is removed if uer account is disabled in Azure
Again I’ve used the same user group the conditional access policies are pointed to
Result
Whilst the employees company device will work as normal without restriction the following should be seen on a non managed device
Scenario 1: Unmanaged Windows device attempting to Sign into Corporate Office Apps
User is informed that their device is not compliant
Also for users who had already installed Office and were signed in on an unmanaged device they will lose access i.e Outlook will not be able to reconnect
Scenario 2: Using Edge on an unmanaged Windows device and attempting to sign into Corporate Office Account you are asked to switch Edge Profile
On first use you will get this popup ensure you untick allow org to manage my device (Microsoft really need to get rid of this)
User is warned that the access is monitored
In Office apps user is also warned they cant Download, Sync or Print
If user attempts to copy data they receive a block warning
Scenario 3: Attempt to login to corporate Office Account on a different browser, user recieves message they have to use edge
Verdict
Edge Enterprise and Conditional access combined offers good protection for DLP (Data loss prevention for Windows users) there are some competitors in this field in the last year or two, coming through with Enterprise Browsers Solutions, these include, names like Talon browser, Island browser, SURF and even Google who are constantly developing chrome enterprise to provide a locked down modified Chrome to help with DLP scenarios.
Wish list for Edge Enterprise with MAM
It will be interesting to see where Microsoft further develops Edge Enterprise with MAM, some of the features that will be nice to see are some of the restrictions available in Android and iOS MAM, i.e copy paste out to other corporate apps within the edge session, Copy paste character limits where you allow users to copy and paste a limited amount of data. Also I’d love to see Microsoft get rid of the Allow Organisation to manage my device screen, that’s been a hindrance for many years now.
1 thought on “Windows MAM and Edge Enterprise Browser”