How to enforce Edge Browser to stop using Personal and only allows Work account to sync?

Question

How to enforce Edge Browser to stop using Personal and only allows Work account to sync?

EnterpriseArchitect 6,411

Would it be possible to enforce and only allow the Microsoft Edge browser to log in and open as a Work Account instead of as a Personal account?

My corporate workstation has been configured as Hybrid Azure AD Joined and managed by Intune, so I wonder if I can use AD Group Policy or can be done via Intune with an Intune P1 license.

If yes, then how can I proceed with the policy to enforce this?

Thank you.

0 comments

Answer accepted by question author

ZhoumingDuan-MSFT 17,375 Microsoft External Staff

@EnterpriseArchitect, Thanks for posting in Q&A.

From your description, I know you want to restrict personal account adding to Edge while only allows work account to sync.

Based on my research, we can create a configuration policy with the setting Restrict which accounts can be used to sign in to Microsoft Edge in Settings catalog to restrict personal accounts while only allow work account.

https://learn.microsoft.com/en-us/deployedge/microsoft-edge-policies#restrict-which-accounts-can-be-used-to-sign-in-to-microsoft-edge

Hope it will help.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

EnterpriseArchitect 6,411 Reputation points

2024-09-16T11:43:31.9166667+00:00

@ZhoumingDuan-MSFT ,
OK, with the above-suggested restrictions, how can we enforce them so no personal account can log in using the Company device with Edge Browser? Do I just add all UPN domains?
Simon Burbery 741 Reputation points

2024-09-17T01:28:10.5266667+00:00

That looks like a good way to do it - you can add your accepted domains like this ".*@contoso.com". Any other suffix will be blocked from signing in.
Simon Burbery 741 Reputation points

2024-09-17T01:35:37.28+00:00
Simon Burbery 741 Reputation points

2024-09-17T01:35:44.59+00:00
ZhoumingDuan-MSFT 17,375 Reputation points Microsoft External Staff

2024-09-17T05:39:58.48+00:00

@EnterpriseArchitect, Thanks for your reply.

With this setting, you can just add the allowed work accounts like what @Simon Burbery mentioned and assign it, after that only the allowed work accounts can login in Edge. As for the rule syntax, you can refer the link.

https://learn.microsoft.com/en-us/deployedge/microsoft-edge-policies#restrict-which-accounts-can-be-used-to-sign-in-to-microsoft-edge

Hope it will help.
EnterpriseArchitect 6,411 Reputation points

2024-09-18T06:38:26.1233333+00:00

@ZhoumingDuan-MSFT & @Simon Burbery ,
What about using: https://learn.microsoft.com/en-us/deployedge/microsoft-edge-management-service ?
ZhoumingDuan-MSFT 17,375 Reputation points Microsoft External Staff

2024-09-18T08:53:55.5733333+00:00

@EnterpriseArchitect, Thanks for your reply.

Since I am not familiar with Microsoft Edge management service, I am not sure whether it can work? But if you create a configuration profile with the setting Restrict which accounts can be used to sign in to Microsoft Edge and add the allowed work account and assign it, after sync with Intune and apply, only work accounts can login in Edge.
ZhoumingDuan-MSFT 17,375 Reputation points Microsoft External Staff

2024-09-19T07:01:32.39+00:00

@EnterpriseArchitect, after discussing with Microsoft Edge support, the method mentioned in the link you provided is also to limit personal accounts from logging into Edge by creating policies and allow work accounts to log into Edge. In essence, this is similar to creating policies in Intune and can achieve your goal.
EnterpriseArchitect 6,411 Reputation points

2024-09-22T23:42:12.5833333+00:00

Thank you @ZhoumingDuan-MSFT .

1 additional answer

Your answer

EnterpriseArchitect 6,411 Reputation points

2024-09-16T11:43:31.9166667+00:00

@ZhoumingDuan-MSFT ,
OK, with the above-suggested restrictions, how can we enforce them so no personal account can log in using the Company device with Edge Browser? Do I just add all UPN domains?
Simon Burbery 741 Reputation points

2024-09-17T01:28:10.5266667+00:00

That looks like a good way to do it - you can add your accepted domains like this ".*@contoso.com". Any other suffix will be blocked from signing in.
Simon Burbery 741 Reputation points

2024-09-17T01:35:37.28+00:00
Simon Burbery 741 Reputation points

2024-09-17T01:35:44.59+00:00
ZhoumingDuan-MSFT 17,375 Reputation points Microsoft External Staff

2024-09-17T05:39:58.48+00:00

@EnterpriseArchitect, Thanks for your reply.

With this setting, you can just add the allowed work accounts like what @Simon Burbery mentioned and assign it, after that only the allowed work accounts can login in Edge. As for the rule syntax, you can refer the link.

https://learn.microsoft.com/en-us/deployedge/microsoft-edge-policies#restrict-which-accounts-can-be-used-to-sign-in-to-microsoft-edge

Hope it will help.
EnterpriseArchitect 6,411 Reputation points

2024-09-18T06:38:26.1233333+00:00

@ZhoumingDuan-MSFT & @Simon Burbery ,
What about using: https://learn.microsoft.com/en-us/deployedge/microsoft-edge-management-service ?
ZhoumingDuan-MSFT 17,375 Reputation points Microsoft External Staff

2024-09-18T08:53:55.5733333+00:00

@EnterpriseArchitect, Thanks for your reply.

Since I am not familiar with Microsoft Edge management service, I am not sure whether it can work? But if you create a configuration profile with the setting Restrict which accounts can be used to sign in to Microsoft Edge and add the allowed work account and assign it, after sync with Intune and apply, only work accounts can login in Edge.
ZhoumingDuan-MSFT 17,375 Reputation points Microsoft External Staff

2024-09-19T07:01:32.39+00:00

@EnterpriseArchitect, after discussing with Microsoft Edge support, the method mentioned in the link you provided is also to limit personal accounts from logging into Edge by creating policies and allow work accounts to log into Edge. In essence, this is similar to creating policies in Intune and can achieve your goal.
EnterpriseArchitect 6,411 Reputation points

2024-09-22T23:42:12.5833333+00:00

Thank you @ZhoumingDuan-MSFT .

Answer 1

Simon Burbery 741

You can use Intune to configure this. There is a good reference here:

https://mrshannon.wordpress.com/2020/07/10/configure-auto-sign-in-and-sync-for-edge-with-intune/#:~:text=To%20do%20this%20with%20Intune%2C%20go%20to%20Devices,users%20to%20sign-in%20to%20use%20the%20browser%20%E2%80%9C.

You configure "Force users to sign-in to use the browser" and "Configure whether a user always has a default profile automatically signed in with their work or school account"

EnterpriseArchitect 6,411 Reputation points

2024-09-16T07:04:34.3566667+00:00

Thank you @Simon Burbery ,
Would it be possible to enforce these settings without reconfiguring anything on the OnPremise Group Policy side?
Simon Burbery 741 Reputation points

2024-09-17T01:25:07.8866667+00:00

You are Hybrid Joined in which case your IT team may be using SCCM (Config Manager)? If so, there are sliders they can use to transfer control of the various management components to Intune. If policies are set to be deployed by Intune, you can use an Intune policy i.e. no on-prem requirement. If policies are still set to on-prem then you would need to use an on-prem method such as GPO. Cheers
EnterpriseArchitect 6,411 Reputation points

2024-09-17T02:34:06.69+00:00

@Simon Burbery ,
No we do not have SCCM in house.
Jean-Seb 25 Reputation points

2026-08-13T18:26:45.3833333+00:00

This doesn't prevent a user from adding a personnal account. That's the configuration I have and I just added my personnal account. It only force the primary account to be a work related one
Simon Burbery 741 Reputation points

2026-08-13T19:55:20.91+00:00
you can try adding these settings with Intune or registry:

prevent new profile creation: search for Enable profile creation or

HKLM\SOFTWARE\Policies\Microsoft\Edge

DWORD 0

BrowserAddProfileEnabled.

disable Browse as Guest: search for guest mode or

HKLM\SOFTWARE\Policies\Microsoft\Edge

DWORD 0

BrowserGuestModeEnabled

With the forced work profile this should achieve the goal.
Jean-Seb 25 Reputation points

2026-08-14T11:51:19.7766667+00:00

This is the same as the gpo already stated. Both of these doesn't prevent a user from clicking the profile icon, add new profile, personal. It only force corporate account sign in per default.