The Edge management service brings Edge for Business under cloud control

If you want real control over Microsoft Edge for Business in your organization, the Edge management service in the Microsoft 365 admin center is turning into a tool you can't do without. Legacy Group Policy is fading in many tenants, and Intune doesn't cover every gap, so I see more and more admins managing browser settings for Entra groups right here. I think they're right to. You'll find it under Microsoft 365 admin center → Settings → Microsoft Edge. From there you create configuration profiles, manage extension lists and enforce baseline security controls, all from the cloud and with no on-premises dependencies.

Edge profiles go to Entra groups instead of old-school GPO scopes

What makes the Edge management service attractive is that it works natively with Entra security groups. You no longer have to wrestle with OU structures or GPO scoping. I regularly give HR one set of Edge policies and developers another, each mapped to the matching Entra group. Deployment is almost instant. When a user signs in with Entra ID, Edge pulls the latest policies from the cloud, so settings stay consistent even for people who switch between devices.

The flow usually looks like this:

flowchart TD
  Admin["Admin creates configuration profile"]
  Groups["Assign profile to Entra group"]
  Cloud["Edge management service syncs"]
  Device["Edge browser enforces policy at sign-in"]

  Admin-->Groups-->Cloud-->Device

Figure: How an Edge management service policy travels from the admin to the device.

If your teams change often, people work hybrid or devices come and go, this is clearly better than traditional GPOs. The details are in the official Microsoft documentation.

Extension lists block risky add-ons and allow the ones that matter

Extensions come up in almost every conversation I have with admins, usually because risky add-ons keep creeping into the environment. The Edge management service lets you allow or block extensions precisely, by ID or by publisher. My recommendation is to start with a block-all policy and then add a short allow list of vetted business extensions. Compared with the extension sprawl I find in many tenants, that's a big step forward. Changes apply at the next browser launch, and you can adjust them whenever you need to.

Practical tip: Allow only trusted extensions that someone has actually reviewed, and make a broad block policy your default. That shuts down a major attack vector, particularly add-ons that arrive through shadow IT.

Sample extension IDs and further guidance are on the Edge configuration page.

The Edge management service, Intune and GPO each cover a different job

I'm often asked whether to use the Edge management service, the Intune settings catalog or plain Group Policy. This is what I tell people based on what I see in the field:

• Edge management service: The best fit for browser-centric policies, assignment to Entra groups and cloud-only setups.
• Intune settings catalog: The right choice when browser policy is part of a broader endpoint management profile, alongside things like Defender, device compliance or VPNs.
• GPOs: Legacy only, for on-prem AD-joined devices that won't go away. In most tenants they're on their way out.

Most environments end up with a mix. The Edge management service handles core browser and extension settings, Intune takes care of device-related configuration such as proxy or update cadence, and GPO stays only where legacy systems really require it. If policies conflict, the most recently applied one wins, but Edge management service policies take priority when both are in play.

A handful of security settings belong in every Edge profile

Edge for Business has a long list of settings, but a few security essentials should be part of every profile:

• Enable Microsoft Defender SmartScreen to protect users from phishing and malware.
• Disable the built-in password manager. Enterprise credentials belong in your official password manager, not in the browser.
• Control sync so enterprise data only syncs with Entra ID accounts and never with personal ones.
• Lock down extension installs as described above.
• Restrict popups and downloads to whatever level suits your users.

In tenants I've worked with, the SmartScreen and password manager policies have directly stopped several security incidents. These risks are real, not theoretical.

Good policy visibility makes conflicts much easier to troubleshoot

People tend to underestimate how important it is to see what's actually applied. When several policy sources target the same user, confusion follows quickly. Anyone can check the current Edge policies by opening edge://policy in the browser. The page shows the active settings, where they come from and any conflicts. You can export the output as JSON for automated comparisons or troubleshooting, which I find extremely useful when testing policies through Entra group assignments.

In complex environments I recommend auditing regularly for conflicting or outdated policy settings. The Edge management service also gives you a central overview of all applied profiles and their status, and in larger deployments that overview has become essential.

The Edge management service is becoming the default for Edge in business

From what I see, the Edge management service is quickly becoming the standard way to govern Edge for Business. Direct assignment to Entra groups, simple extension controls and baseline security without GPOs or overly complex Intune setups make it a natural fit for cloud-first organizations. If you're still relying on GPO, now is the time to plan the move. My post on choosing Microsoft 365 Apps update channels covers similar migration strategies from real projects.