Detections
Analytics

1.15.1 Ensure 'Enable sign-in to Microsoft Edge using non-Microsoft accounts' is set to 'Disabled'

Information

This policy setting controls whether users can sign in to Microsoft Edge using non-Microsoft accounts, such as Google or Apple accounts.

The recommended state for this setting is: Disabled.

Note: Disabling this policy does not prevent users from signing in with Microsoft accounts. Users can still sign in to Microsoft Edge with organizational or personal Microsoft accounts.

Allowing users to sign in to Microsoft Edge with non-Microsoft accounts introduces browser profiles that are outside the organization's identity management framework. Data associated with these profiles - including browsing history, favorites, saved passwords, and autofill data - may sync to third-party services that the organization does not control or monitor, creating an unmanaged data exfiltration path.

Solution

To establish the recommended configuration via GP, set the following UI path to Disabled :

Computer Configuration\Policies\Administrative Templates\Microsoft Edge\Identity and sign-in\Enable sign-in to Microsoft Edge using non-Microsoft accounts

Note: This Group Policy path may not exist by default. It is provided by the Group Policy template MSEdge.admx/adml that can be downloaded from: Download Microsoft Edge for Business - Microsoft.

Impact:

Users will not be able to sign in to Microsoft Edge using Google, Apple, or other non-Microsoft accounts. Sign-in entry points for non-Microsoft identity providers will not be displayed. Users who require non-Microsoft accounts for legitimate work purposes will need to access those services through the web rather than through browser-level sign-in.

See Also

https://workbench.cisecurity.org/benchmarks/28120

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-2(1), 800-53|AC-3

Plugin: Windows

Control ID: f851942e3b88fdc576bd412b3aac1de21ba27997765e2961964d4a4c9c0a6753