Detections
Analytics

1.121 Ensure 'Enable User Web App Install From Browser' is set to 'Disabled'

Information

This policy setting controls whether users can install web apps through Microsoft Edge.

The recommended state for this setting is: Disabled.

Note: This policy does not affect the WebAppInstallForceList policy. Web apps specified by that policy are installed regardless of this policy setting. This policy does not support dynamic refresh. Changes take effect only after the browser is restarted.

Allowing users to install web apps through the browser introduces applications to the enterprise environment without IT oversight. These user-installed web apps bypass standard software management controls and may originate from untrusted sources, expanding the attack surface with applications that have not been vetted by the organization.

Solution

To establish the recommended configuration via GP, set the following UI path to Disabled :

Computer Configuration\Policies\Administrative Templates\Microsoft Edge\Enable User Web App Install From Browser

Note: This Group Policy path may not exist by default. It is provided by the Group Policy template MSEdge.admx/adml that can be downloaded from: Download Microsoft Edge for Business - Microsoft.

Impact:

Users will not be able to install web apps through Microsoft Edge. Administrators can still deploy approved web apps through the WebAppInstallForceList policy.

See Also

https://workbench.cisecurity.org/benchmarks/28120

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7

Plugin: Windows

Control ID: 7e453ebce17d8b626c897bfea8f09e82f9c5f87adfb378f617f959b1966cafee