1.1.29 Ensure 'Browser sign-in settings' is set to 'Enabled: Disable browser sign-in'

Information

This policy setting controls whether a user can sign into Microsoft Edge with an account to use services such as sync and single sign on.

Note: To control the availability of sync, use the SyncDisabled (Disable synchronization of data using Microsoft sync services) policy.

The recommended state for this setting is: Disabled: Disable browser sign-in.

Rationale:

Users will not be able to sign in to Microsoft Edge with an account. Signing in to Edge does not automaticaly sync users data, to control the availability of sync, use the SyncDisabled (Disable synchronization of data using Microsoft sync services) policy.

Impact:

Users will not be able to sign into the Microsoft Edge browser.

Solution

To establish the recommended configuration via GP, set the following UI path to Disabled: Disable browser sign-in

Computer Configuration\Policies\Administrative Templates\Microsoft Edge\Browser sign-in settings

Note: This setting works in conjunction with the NonRemovableProfileEnabled setting which will need to be set to Disabled because the setting NonRemovableProfileEnabled disables the creation of an automatically signed in browser profile.
Note #2: This Group Policy path may not exist by default. It is provided by the Group Policy template MSEdge.admx/adml that can be downloaded from Microsoft here.

Default Value:

Not Configured - Users can decide if they want to enable the browser sign-in option and use it as they see fit.

See Also

https://workbench.cisecurity.org/files/3907

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, CSCv7|5.1

Plugin: Windows

Control ID: 4cb4ed914c64133c7fe2cf12bb8d000e49839b680e25ef7aaf6d4785ac826070