←All Blog Posts

What's New - CIS Microsoft Edge Benchmark v5.0.0

 — #Edge#Security#Intune

CIS released version 5.0.0 of the Microsoft Edge Benchmark on 29th September 2026, just under a year after v4.0.0. It brings Copilot under control, adds stronger protection for Edge's own processes and Microsoft's Scareware blocker, and takes NTLM off the list of allowed authentication schemes. If Copilot in the browser is on your radar, this is the release to look at.

What is the benchmark?

CIS benchmarks are consensus-driven hardening guidelines. The Microsoft Edge Benchmark hardens Edge through Edge policies, each rated Level 1 (baseline) or Level 2 (stricter, may affect functionality). The benchmark is written for Group Policy, but the policies are the same ones you configure through Intune.

There is also a separate CIS Microsoft Intune for Microsoft Edge Benchmark v1.0.0. It was released a few months after Edge v4.0.0 and hasn't been updated for v5.0.0 yet, so expect a refresh soon.

Two structural changes are worth flagging up front:

  • (L1) and (L2) prefixes have been removed from control titles, as in the M365 v7.0.0 benchmark. Levels are still shown under each recommendation's Profile Applicability.
  • GRIDs have moved from the BR- prefix to MSED-, according to the change log. Most GRID references have been removed from the v5.0.0 PDF itself, so don't rely on them for mapping just yet.

What's changed in v5.0.0?

The benchmark grows from 139 to 147 recommendations: 14 new, 6 removed, plus a handful of updates.

Tip: track controls by title or policy name, not section number, as almost every number from 1.5 onwards has moved.

New controls

Copilot and cloud data

  • Enable the Copilot new tab page (1.116, L1): Disabled. Keeps the Copilot new tab page experience off.
  • Enable Copilot address bar suggestions (1.100, L2): Disabled. Stops address bar input being sent to Copilot for suggestions.
  • Browsing with Copilot (1.86, L2): Disabled. Blocks the agent that navigates and acts on pages for the user.
  • Service-based extraction for Reading Mode (1.112, L2): Disabled. Stops page text being sent to Microsoft's online extraction service.
  • Clipboard suggestions in the address bar (1.98, L1): Disabled. Stops clipboard content (passwords, tokens, internal URLs) showing in the dropdown.

Identity and credentials

  • Sign-in using non-Microsoft accounts (1.15.1, L1): Disabled. Blocks Google and Apple account sign-in to Edge, so profiles can't sync to services you don't control.
  • Saving passkeys to the password manager (1.22.1, L1): Disabled. Keeps passkeys in Windows Hello for Business or FIDO2 keys, not the browser.

Threat protection

  • Scareware blocker protection (1.32.1, L1): Enabled. Uses an on-device ML model to detect tech-support scam pages.
  • Scareware blocker blocks tech-scam sites (1.32.2, L1): Enabled. Blocks the pages it detects, rather than just flagging them.
  • Process Isolation (1.106, L2): Enabled. Stops other apps on the device reading or modifying Edge's processes.
  • Strict MIME type checking for worker scripts (1.114, L1): Enabled. Enforces the default so it can't be relaxed.
  • Socket pool size randomisation for proxies (1.56, L1): Enabled. Removes a cross-site side channel. Also new in Chrome v1.1.0.

Attack surface reduction

  • User Web App Install From Browser (1.121, L2): Disabled. Users can't install web apps; you can still push approved ones with WebAppInstallForceList.
  • Default idle detection setting (1.4.11, L2): Block, or Ask. Stops sites seeing when a user is away or the screen is locked.

Removed controls

  • Default setting for third-party storage partitioning (was 1.4.11, L2)
  • Enable Gamer Mode (was 1.11.1, L1)
  • Block requests from public websites to devices on a user's local network (was 1.20.1, L1): only added in v4.0.0
  • Configure Related Matches in Find on Page (was 1.72, L1)
  • Edge Wallet E-Tree Enabled (was 1.89, L1)
  • Wallet Donation Enabled (was 1.136, L1)

The change log doesn't give reasons. Leaving these configured won't break anything, but they no longer count towards compliance.

Notable updates

  • Supported authentication schemes (now 1.14.3, L2): tightened from ntlm, negotiate to negotiate only. NTLM is no longer an accepted value.
  • Update policy override default (3.1.1, L1): title now reads 'Automatic silent updates only' or Higher. The audit value (1 or 3) hasn't changed.
  • Allow users to manage installed CA certificates (1.3.1, L1) and Default automatic downloads setting (1.4.9, L1): wording updated to match Microsoft's current option names. The registry value (2) is the same.

Deploying through Intune

Edge is fully native in the Intune Settings Catalog, so no ADMX import is needed. The catalog is updated as new Edge policies ship, but the very newest ones can take a little while to appear. Check that each policy below exists in your tenant before building the profile.

Some of the new policies need a recent Edge build: Process Isolation needs Edge 151+ and browsing with Copilot needs Edge 148+. Make sure your browser version are current before you rely on them.

Control Edge policy name Value
Copilot new tab page CopilotNewTabPageEnabled Disabled
Copilot address bar suggestions CopilotAddressBarSuggestionsEnabled Disabled
Browsing with Copilot AllowBrowsingWithCopilot Disabled
Reading Mode service-based extraction EdgeReadingModeServiceBasedExtractionEnabled Disabled
Clipboard suggestions in the address bar AddressBarClipboardSuggestEnabled Disabled
Non-Microsoft account sign-in NonMicrosoftAccountSignInEnabled Disabled
Save passkeys to password manager PasswordManagerPasskeysEnabled Disabled
Scareware blocker ScarewareBlockerProtectionEnabled Enabled
Scareware blocker blocks detected sites ScarewareBlockerBlocksDetectedSitesEnabled Enabled
Process Isolation ProcessIsolationEnabled Enabled
Strict MIME checking for worker scripts StrictMimetypeCheckForWorkerScriptsEnabled Enabled
Socket pool size randomisation AllowSocketPoolSizeRandomizationForProxies Enabled
User web app install WebAppInstallByUserEnabled Disabled
Default idle detection DefaultIdleDetectionSetting 2 (Block)
Supported authentication schemes AuthSchemes negotiate

Confirm the accepted values in the Microsoft Edge policy reference before building the profile.

Top 3 to implement first

1. Copilot governance (1.116 L1, 1.100 L2, 1.86 L2)

This is the headline of v5.0.0. The new tab page, the address bar and browsing with Copilot all send browsing context to a cloud AI service, and browsing with Copilot goes further: an agent that navigates and acts inside authenticated web apps for the user. Whatever your Copilot strategy, these settings should be a deliberate choice, not left at the defaults.

Deploy: set CopilotNewTabPageEnabled, CopilotAddressBarSuggestionsEnabled and AllowBrowsingWithCopilot to Disabled.

Watch out: the two L2 controls will clash with a Microsoft 365 Copilot rollout. If you're licensing Copilot, consider an exception group, or use BrowsingWithCopilotAllowList to scope browsing with Copilot to approved domains rather than turning it off entirely.

2. Process Isolation (1.106, L2)

v4.0.0 added Application Bound Encryption to protect Edge's data at rest; Process Isolation protects it while Edge is running. Infostealers running as the user can inject into the browser and pull credentials and session tokens straight from memory. Process Isolation stops other apps on the device reading or modifying Edge's running processes, including the encrypted data Edge uses.

Deploy: set ProcessIsolationEnabled to Enabled (Windows, Edge 151+). It applies on the next browser restart.

Watch out: it's L2 for a reason. Antivirus, screen readers and window managers that inject into Edge may break. Pilot with your EDR and accessibility tooling first. If you leave it unset, Microsoft is rolling it out gradually anyway, so it's better to test it on your own terms.

3. Supported authentication schemes: negotiate only (1.14.3, L2)

The breaking change. Dropping ntlm means Edge will only do Kerberos (via Negotiate) for integrated authentication. NTLM is relay-prone and Microsoft is deprecating it, so this lines Edge up with where Windows is heading.

Deploy: set AuthSchemes to negotiate.

Watch out: any intranet site, appliance or legacy app that falls back to NTLM (missing SPNs, IP-based URLs, non-domain servers) will stop authenticating. Use NTLM auditing on your servers to find these before enforcing.

Bonus: Saving passkeys to the password manager (1.22.1, L1)

This one is timely. Microsoft moved passkey profiles and synced passkeys to general availability in Entra ID in March 2026, and existing Passkey (FIDO2) configurations were automatically migrated into a Default passkey profile between May and June 2026. If attestation isn't enforced in that profile, users can now register synced passkeys, not just device-bound ones like Windows Hello for Business or FIDO2 keys.

At the same time, Edge (142+) can save and sync passkeys in Microsoft Password Manager. Today that only works for personal Microsoft account profiles, not Entra profiles. On a managed device, that means a user signed in to Edge with a personal profile could save a work passkey into a vault that syncs to their own Microsoft account, where you can't see it, revoke it or wipe it.

Deploy: set PasswordManagerPasskeysEnabled to Disabled. It's a device-wide policy, so it covers every Edge profile on the device, personal ones included.

Watch out: passkeys already saved keep working, and users can still create passkeys through platform providers such as Windows Hello and Microsoft Authenticator. If you already disable PasswordManagerEnabled, this policy has no effect. Pair it with a deliberate Entra passkey profile: device-bound with attestation for admins, and only approved providers (for example Microsoft Authenticator) where you allow synced passkeys.

In summary

v5.0.0 is an AI-governance release. The Copilot controls give you a clear, auditable position on Copilot in the browser, while Process Isolation and Scareware blocker add protection against infostealers and tech-support scams. The NTLM change is the one most likely to cause tickets, so test it first.

With the Intune for Edge benchmark still on v1.0.0, expect an update to follow. In the meantime, the Settings Catalog has everything you need to get ahead of it.

Resources