Information
This policy setting specifies whether websites can ask for write access to the host operating system's filesystem using the File System API. By default websites can ask for access. Users can change this setting. By setting this policy to (2), access is denied.
Policy options mapping:
BlockFileSystemWrite (2) = Don't allow any site to request write access to files and directories
AskFileSystemWrite (3) = Allow sites to ask the user to grant write access to files and directories
The recommended state for this setting is: Enabled: Don't allow any site to request write access to files and directories.
Rationale:
There is a large category of attack vectors that are opened up by allowing web applications access to files. By setting this policy to Enabled: Don't allow any site to request write access to files and directories implements additional protection to safeguard against accidental sharing of sensitive information contained in locals files.
Impact:
Users with creative roles that require the File System API access permission to write files for photo, video, and text editors or for creating integrated development environments will need additional permissions granted based on their role.
Solution
To establish the recommended configuration via GP, set the following UI path to Enabled: Don't allow any site to request write access to files and directories:
Computer Configuration\Policies\Administrative Templates\Microsoft Edge\Content settings\Control use of the File System API for writing
Note: This Group Policy path may not exist by default. It is provided by the Group Policy template MSEdge.admx/adml that can be downloaded from: Download Microsoft Edge for Business - Microsoft.
Default Value:
AskFileSystemWrite (3) = Allow sites to ask the user to grant write access to files and directories