跳到主要內容

164: MAM for Edge

Implementation Effort: Medium
User Impact: Low to Medium

Overview​

Microsoft Edge can be part of a data-protection strategy for unmanaged or lightly managed Windows devices by combining Intune app protection capabilities, app configuration, and Conditional Access controls. This is useful when the organization needs to protect browser-based access to Microsoft 365 or other web apps without fully enrolling every personal device.

For Zero Trust, the objective is to protect organizational data in the app, validate user and session conditions, and reduce copy, save, or exfiltration paths on endpoints that are not managed to the same standard as corporate devices.

Implementation Guidance​

Define the BYOD and unmanaged access policy​

  • Decide which users or device populations are allowed browser-only access instead of full device enrollment, and document what data actions must be blocked or limited.
  • Confirm the current Microsoft support matrix for Intune app protection on Windows and Microsoft Edge for Business before designing policy around it.
  • Pair browser protection with Conditional Access policies that distinguish unmanaged, compliant, and corporate-owned devices.

Configure protection controls​

  • Use Intune app configuration and supported app protection settings for Microsoft Edge to enforce organization-approved browser behavior where available.
  • Configure Conditional Access so sensitive applications require either a compliant device or the approved protected browser path, depending on risk and business need.
  • Test download controls, cut/copy/paste behavior, and sign-in continuity with representative SaaS apps before production rollout.

Operate with clear guardrails​

  • Provide user guidance that explains the difference between full device management and browser-protected access on personal devices.
  • Monitor sign-in and Conditional Access results to confirm users land in the intended access path instead of failing unexpectedly.
  • Review whether high-risk roles should be moved from protected-browser access to fully managed devices over time.

Reference​