Managing Microsoft Edge with Intune gives admins strong configuration control, but it does not always provide the full visibility needed into browser extensions, update status, and cross-platform browser management. The Microsoft Edge management service helps close that gap by giving admins a centralized place to monitor extensions, review policies, track update status, and manage scenarios that are not always covered by Intune alone. In this blog post, I’ll walk through where the service adds value, how to get started, and when I recommend using Cloud policies instead of Intune policies.

This blog post will cover:

• General prerequisites
• How to get started with the Microsoft Edge management service
• Configuration policies – Cloud and Intune
• Edge extensions
• Edge updates
• Other features in the Microsoft Edge management service
• My take
• Useful links

General prerequisites

• You must be a Microsoft Edge Administrator (if you follow least privilege) or Global admin to access the experience in Microsoft 365 Admin Center.
• Enable the Microsoft Edge management service in the Microsoft 365 admin center.
• Microsoft Edge 115.0.1901.7 or greater installed.
• Users must be logged into Microsoft Edge.

How to use the Microsoft Edge management service

Let’s start with the basics

You can find the Microsoft Edge management service in the Microsoft 365 admin center(https://admin.cloud.microsoft)> Settings > Microsoft Edge.

To start using the service, select Enable then select what services should be enabled and select Save.

Configuration policies

You can monitor existing Microsoft Edge policies and create new policies directly from the dashboard. There are two available policy types: Cloud policies and Intune policies.

Let’s walk through the differences, when to use each option, and how policy conflicts are handled.

Cloud policies

Cloud policies are created and managed in the Microsoft Edge management service.

Depending on the setting you configure, Cloud policies can apply Microsoft Edge settings across supported platforms, including Windows Server.

Why would you use Cloud policies instead of Intune policies?

• Configure Microsoft Edge on supported platforms outside your Intune-managed Windows estate, including Windows Server.
• Prioritization: Configuration policies with conflicting settings will take the value of the policy with the highest priority.
• Extension requests: Admins will be able to view the extensions that users have requested and take action to approve or deny these requests.
• Organization branding: Admins will be able to apply their organization’s branding to customize the look and feel of the browser.
• Manage scenarios where the operating system is not supported by Intune or where devices are not enrolled in Intune.

Below is an example of policies in the Microsoft Edge management service. Notice the priority, policy type, scope, and platform columns. Together, these give you a useful overview of where each policy will apply.

Intune policies

A configuration policy created as an Intune policy is available in both the Microsoft Edge management service and the Intune admin center. Policy details sync between the two experiences, with some limitations:

• Scope tags: Cannot be set in the dashboard, only in Intune.
• Detailed assignment: Policies created in the Microsoft Edge management service can only be assigned to target user groups. If created in Intune, the configuration policy can target devices and exclude specific user groups. Assignment filters can also be applied when the policy is created in the Intune admin center.
• Role-based access control (RBAC): Can only be set via Intune.

My recommendation is to continue creating Microsoft Edge policies for enrolled Windows devices in Intune. For other supported platforms, Windows Server, or devices that are not enrolled in Intune, Cloud policies can be a great complement.

When to use what

Use Intune policies when…	Use Cloud policies when…
You manage enrolled Windows devices and need device targeting, scope tags, RBAC, assignment filters, and full Intune management control.	You need to manage supported platforms or scenarios not fully covered by Intune, such as Windows Server or devices that are not enrolled in Intune.

Policy conflicts

Any policies you apply with the Microsoft Edge management service will be overridden if they conflict with an existing Group Policy Object (GPO) or Mobile Device Management (MDM) policy that is set on the device.

Edge extensions

Previously, if you wanted broad visibility into browser extensions, Microsoft Defender Vulnerability Management was often part of that conversation. In practice, that meant either Microsoft Defender Vulnerability Management standalone licensing or the Microsoft Defender Vulnerability Management add-on if you were already using Microsoft Defender for Endpoint Plan 2.

With the Microsoft Edge management service, admins can now monitor and manage extensions from a more centralized experience. This is a big step forward for both security and user experience.

What can admins do with extensions in the Microsoft Edge management service?

• Extensions monitoring: Monitor installed extensions.
• Manage extension requests: Extensions requested by your users appear in the Microsoft Edge management service. You can allow users to request blocked extensions.
• Add extensions: Microsoft Edge Add-ons store or specify an external extension ID.
• Manage permissions policy: Allow, block, force install, normal install (installed but users can disable it).
• Manage extension permissions: Customize permissions by choosing which permissions are not allowed.
• Manage settings for all extensions: Configure allowed or blocked hosts, install sources, and more.

For full details, check the links under “Useful links”.

This is advanced centralized management of Microsoft Edge extensions. For this capability alone, the Microsoft Edge management service is worth enabling and exploring.

Edge updates

To monitor Microsoft Edge versions, you need to enable version monitoring. When this is enabled, Windows devices send update status to the dashboard.

You can monitor which devices are up to date, which devices have updates available, and which devices have recommended updates. You can also monitor channel status.

Keeping Microsoft Edge up to date is important from a security perspective, but it also helps users get access to new functionality and improvements faster.

For devices that are out of date, you can choose one of the following actions to keep those browsers up to date.

Force auto restart when device is idle: This automatically restarts the users’ browsers to apply the latest update when their device is detected as idle (20 minutes of no user input). Users are notified, and their tabs will be restored.

• Recommend restart: This action sends a notification to the user to restart their browser to apply the latest update.
  No action will be taken on their behalf, and users may choose whether to act upon the notification.

If a device has not sent data for 30 days, then the update information for that device will be deleted from the Edge management service.

Other features in the Microsoft Edge management service

Besides the topics covered in this blog post, the Microsoft Edge management service also lets you manage several other areas, including:

Manage site lists – Create lists of websites and specify which browser or browser mode should open each site.

Manage Edge connectors – Configure and manage device trust, reporting, and data loss prevention connectors to extend the value of your security solutions in Microsoft Edge for Business.

Manage Copilot in Edge – Manage how users in your organization interact with Microsoft 365 Copilot Chat and related AI-powered experiences in Microsoft Edge.

Sync Microsoft Purview policies – Sync Edge settings with Microsoft Purview policies that target unmanaged GenAI apps in Microsoft Edge for Business.

My take

Start using the Microsoft Edge management service today. There are no real downsides to getting more visibility into Microsoft Edge in your environment, especially when the service gives you insights that are hard to get elsewhere. My recommendation is to plan your organization’s extension strategy, use the Microsoft Edge management service to gain visibility, and then enforce what should be allowed or blocked. For configuration, I would still keep Intune as the primary management plane for enrolled Windows devices, but use Cloud policies for supported platforms and scenarios that are not covered by Intune.

I’m really happy to see this capability available, and I’m sure I’ll revisit this topic as the Microsoft Edge management service continues to evolve.

Useful links

Microsoft Learn – Monitoring dashboard

Microsoft Learn – Edge extensions monitoring

Microsoft Learn – Activate your DLP policy in Microsoft Edge

Microsoft Learn – Connectors Overview