Detections
Analytics
1.4.11 Ensure 'Default idle detection setting' is set to 'Enabled: Do not allow any site to detect the user's idle state' or 'Enabled: Ask every time a site wants to detect the user's idle state'
Information
This policy setting controls whether websites can use the Idle Detection API to detect when the user is idle.The recommended state for this setting is: Enabled: Do not allow any site to detect the user's idle state (BlockIdleDetection) or Enabled: Ask every time a site wants to detect the user's idle state (AskIdleDetection).
The Idle Detection API exposes information about a user's activity state - including whether the user is away from their device or the screen is locked - to any website that requests it. Without restricting this API, websites can monitor user presence patterns, which could be used for behavioral profiling, targeted timing of social engineering prompts, or determining when a device is unattended.
Solution
To establish the recommended configuration via GP, set the following UI path to Do not allow any site to detect the user's idle state or Ask every time a site wants to detect the user's idle state :Computer Configuration\Policies\Administrative Templates\Microsoft Edge\Content settings\Default idle detection setting
Note: This Group Policy path may not exist by default. It is provided by the Group Policy template MSEdge.admx/adml that can be downloaded from: Download Microsoft Edge for Business - Microsoft.
Impact:
Websites that rely on the Idle Detection API to provide functionality, such as collaborative applications that display user availability status, will lose that functionality when BlockIdleDetection is set. When AskIdleDetection is set, users are prompted each time a site attempts to use the API.
See Also
Item Details
Audit Name: CIS Microsoft Edge v5.0.0 L2
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6, 800-53|CM-7, CSCv7|7.2
Plugin: Windows
Control ID: 407727b1e5ce3a2da97692e5cbaa935dcd6410fa99bcf8f0407c41e06ee430b7