Microsoft Edge Enterprise Sync - Intune Configuration & addressing sync issues

-

When it comes to configuring Microsoft Edge Enterprise sync, it Is really a no brainer. Not only it allows a seamless browsing experience across multiple supported devices to saved information like bookmarks, browsing history, saved passwords, and other settings on any device where you sign in with the same account, it also enables Single Sign On (SSO) into Microsoft 365 web apps and sessions supporting conditional access policies in the process. So how do you configure it in the modern workplace, especially for cloud native devices? Here are the steps -

Enabling Edge enterprise sync using Intune

1. Sign-in to the Microsoft Intune admin center
2. Browse to Devices –> Configuration
3. Click Create Profile
4. Select Platform as Windows 10 and later
5. Select Profile type as Settings catalog
6. Provide a Name and hit next.
7. Click on Add settings.
8. Configure the following -

9. Assign to a device or user group as normal. 

With the above configuration in place, you may run into sync related issues due to a number of reasons. An issue in the sync will generally result in an output like the one below -


The most common reason is usually the licensing. As of writing this blog post, following scenarios and environments are supported -

1. Customers that only have Microsoft Entra ID P1 or P2 must enable Microsoft Entra Enterprise State Roaming (ESR). Even though, Microsoft Edge sync isn't part of ESR, ESR is still required to provide the Microsoft Purview functionality that's needed for the P1 and P2 configurations.

2. Microsoft 365 Business Premium, Business Standard, or Business Basic

3. Office 365 E1 and above

4. All EDU subscriptions, including:
  • Microsoft Apps for Students or Faculty
  • Exchange Online for Students or Faculty
  • O365 A1 or above
  • Microsoft 365 A1 or above
  • Azure Information Protection P1 or P2 for Students or Faculty
Other than licensing, if you are still running into issues, then check if you have sync disabled or not. Normally, this is configured and managed through a policy and if enabled, it will show up in both registry under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge and edge policy page.


The fix?

Well for start, you may have to do some digging to identify the policy disabling the sync. In my case it was a rouge policy setting that was created a result of a GPO import. (Another reason to start with a clean slate for cloud native devices. ;-) ). This is what needs to be configured -

1. Sign-in to the Microsoft Intune admin center
2. Browse to Devices –> Configuration
3. Click Create Profile
4. Select Platform as Windows 10 and later
5. Select Profile type as Settings catalog
6. Provide a Name and hit next.
7. Click on Add settings.
8. Configure the following setting as 'Disabled' or remove it as necessary.


9. Assign to a user or a device based group normally.

End result

After the policies apply, the user must sign-in and a non-removable profile will be created with the user's work or school account on Windows. This profile can't be signed out or removed.




Thanks for reading. Until next time..

Comments

Post a Comment

Popular posts from this blog

How to force escrowing of BitLocker recovery keys using Intune

-
Image
Every now and then it so happens that BitLocker recovery keys do not escrow in AAD. The usual culprits are incorrect BitLocker policies and\or the device hardware configuration failing to meet the minimum requirements. The other scenario and something I recently experienced is when everything is setup right and still the recovery key doesn’t escrow in AAD. As I understand, this can happen if the escrow process got interrupted the first time due to network or local devices related issues and the process could not resume. To circumvent this issue, one can simply push a PowerShell script to the devices to force the escrow of the recovery keys to AAD. Here is a script to do so. try{ $BitlockerVol = Get-BitLockerVolume -MountPoint $env:SystemDrive         $KPID=""         foreach($KP in $BitlockerVol.KeyProtector){             if($KP.KeyProtectorType -eq "RecoveryPassword"){              ...
Read more

Prevent users from running certain programs or applications on Windows endpoints using Intune

-
Image
  When it comes to blocking or preventing users from running an application on Windows devices, one normally uses App locker policy, Windows Defender Application Control and not so new but pretty useful method called Defender Vulnerability management within Microsoft 365 Defender Portal. A recent question on the Tech Community Microsoft forum prompted me to look for all possible alternatives. I started reminiscing over the legacy GPO policies and that is when I stumbled upon the policy  Don’t run specified Windows applications  located under User Administrative Templates - The policy setting does come with its own caveat - " This policy setting only prevents users from running programs that are started by the File Explorer process. It does not prevent users from running programs, such as Task Manager, which are started by the system process or by other processes. Also, if users have access to the command prompt (Cmd.exe), this policy setting does not prevent them from st...
Read more

Fixing Tamper Protection Blob Error 65000 using Microsoft Intune

-
Image
I recently encountered an issue with enabling Tamper protection as part of the implementation of Defender for Endpoint in one of customer's tenant and considering how unusual the behavior was and how I didn't encounter this before, I decide to blog my experience. If you have been battling with the same issue, then this blog may just help you. There are multiple ways to enable Tamper protection as part of MDE. One can enable at a tenant level using Defender portal or do it using Intune. I normally choose the Intune, especially when dealing with endpoints to maintain uniformity with other Defender policies being managed by Intune. However, in this particular instance, the issue started cropping randomly on some endpoints where tamper protection would not enable and throw an error code 65000, as show below. Additionally, the status in Defender will report as Unknown instead of reporting Active or something else like EDR in block mode to suggest that Defender Antimalware is running...
Read more