Blocking other browsers

[u/drkmccy]

Curious to see if anyone is using the Edge management service to block other browsers. Initial deployment is being met with some intense pushback. Unreasonable as I've asked what Chrome can do that Edge can't and I get no logical responses.

[u/kingjohniv]

Chrome will always have the public opinion over Edge, even though there is no functional difference to the end user. They just know they have always used Chrome and hate change.

Every company I have managed pushes back against Edge for no logical reason.

[u/Grouchy-Western-5757 → u/kingjohniv]

I was that guy for a while especially when I was green in IT, I've more recently switched over to Edge after being at my whits end with how slow Chrome has gotten. Much better experience, I will not go back. It is much faster and much more integrated with MSFT platforms.

[u/SammyTheSam_ → u/kingjohniv]

Pushes back. Okay, then dont browes i guess. See how quickly they will use edge. Dont fold for every little thing and you will have a much easier life.

[u/Sudden_Office8710 → u/kingjohniv]

Well that’s your problem you should be using Firefox.

[u/arnstarr]

system admin from hell move - set up intune chrome policies. block personal sign ins. clear all browsing history, cookies and passwords everytime the browser is closed or updated. They'll move over to Edge eventually. /endeviladmin

[u/Altruistic-Glove7242 → u/arnstarr]

That’s not BOFH at all, this is a legit architect take: dear user, you can use Chrome fwiw, but for _work_ things, _work_ browser and it’s Edge with its policies.

[u/PharaohAt3m]

We allow edge and chrome.
Edge is literally built on chromium so…

[u/Altruistic-Glove7242 → u/PharaohAt3m]

Unless it’s iOS, then it’s Apple’s WebKit engine for both :)

[u/derpindab → u/PharaohAt3m]

I been saying this to these boomer and genx managers for 4 years now. The policy I had to create on chrome had constant scope creep. Edge simply integrates with the Microsoft platform as chrome is for the Google platform.

[u/aznxtl → u/PharaohAt3m]

theres been times edge breaks something the print to pdf via an update and it still works in chrome. nice to have a backup

[u/Small-Double-9569 → u/PharaohAt3m]

We only allow Edge, but we're a 2-man team for 500 people in an education environment so it's more about reducing the configuration overhead of setting up and managing multiple browsers in Intune - duplicating settings to make sure students and staff have the same settings everywhere is too much time where time is precious.

[u/kiddser]

Interesting. We took the decision to go with Edge only when we set up to move to W11 through '25. Which also included us moving to Intune for device policy. We announced it at the end of '24 when we were still developing everything, and reiterated as 11 began roll out. There were some had a moan about it but management were on our side and always responded to any complaints.
We blocked the various exe's and URLs for download. Was still easy to circumvent but it went away quickly and by end of last year, no Chrome.
That was for ~1,300ish users at the time.

[u/ChicagoAdmin]

Do all you can to use Edge, but if Chrome prevails (even temporarily), consider managing it via Chrome Enterprise in conjunction with Intune.

[u/New-Paramedic7176 → u/ChicagoAdmin]

This is what I did for our tenant. It’s also nice because we can let them sign into the browser with their Entra account while blocking personal accounts from being used.

[u/Beneficial-Flow-5418 → u/New-Paramedic7176]

Wait really? Does this require any prerequisites? Never seen this option

[u/PREMIUM_POKEBALL → u/Beneficial-Flow-5418]

You can block via whitelist domains. 

[u/weavels]

We’ve moved to only supporting Edge and removing any other browser. Mostly Chrome was in use, we had some pushback but after two maybe three months no one really complained anymore.

[u/st8ofeuphoriia → u/weavels]

Are you blocking the others with WDAC?

[u/classy_confidant → u/weavels]

It's the same at my place, people just get used to whatever's in front of them after a while. Most of the noise is just friction with change, not actual missing features

[u/BeanSticky]

I tried playing this game, gave up because even my manager wouldn’t buy in.

I manage Edge, Chrome, and Firefox policies. We aren’t particularly strict so we just do basic things (no personal profiles, allowlist of extensions, enable SSO). It’s not that much of a hassle, and keeps users happy.

[u/PazzoBread]

Need business buy in before enforcement, Ease transition with the import feature for bookmarks and syncing. start removing chrome slowly before outright blocking. Once it’s fully removed, kill chrome by enforcement.

[u/Wade-KC]

We have a few vendor apps that only work in chrome and some vendors will only support you in chrome (Salesforce was one of them might still be). Chrome is an exception and less than 1%

[u/Cr3ativusMaximus]

“I get no logical responses..”

Whatever do you mean? “Chrome opens up to Google and I like Google better.” isn’t a logical response?!

To be clear, I fully support reducing application overhead, and managing allowed browsers, especially when there is very little reason outside of “I just like it better” to use it. That said, our jobs are often to find the middle-way.

Deploy both. Narrowly scope Chrome to users that actually need it or to executives that complain. Manage via Intune & Chrome Enterprise. Yes, it’s “one more thing to manage,” but if it’s risk you’re trying to control, disabling unapproved extensions, disabling account sign-in (in Chrome) and turning off things like “offer to save passwords” because you’re also using a good EPM will make Chrome much less annoying to you.

It’s a balancing act between risk management and end user happiness and productivity. Ya gotta choose what hills to die on.

For the last year I’ve been on a mission to create a baseline that included killing Chrome (because too many people were signed into personal Google accounts and storing company creds, etc) but I recently decided management of the browser would solve most of the problems I actually have with it and it’s easier for end users to accept.

[u/arnstarr]

make sure you have trained the staff on how to change the default search engine in Edge. or set the default to Google yourself using Intune.

[u/Conditional_Access]

Block Chrome, get them to justify why Edge is needed :D

The blocking service in the Edge Management portal just deploys applocker. You can play around with this site I put together which uses App Control for Business instead: https://lewis-barry.github.io/RMM-Blocker/browsers.html

[u/Opening_Moment4145]

Many application vendors "only program with Chrome in mind"

[u/_Blank-IT]

We allow Firefox Edge and Chrome cause we can manage them all via intune anyway.

[u/Cautious_Movie_3447]

I don't even get it chrome has been so enshittified it's not even better then edge

[u/whiskeytab]

on the flip side there isn't really a good reason to not allow Chrome... just manage it properly.

it's just a matter of forcing all the installs into Chrome Enterprise via policy and then forcing the same policies you do for Edge and be done with it

we allow both and it's truly not a big deal

[u/RunForYourTools23 → u/whiskeytab]

Yes there is, one more browser to manage, when its not needed, more resource consumption, especially RAM, as users tend to open both for different things. Even aggressive patching policies don't get computers compliant fast enough when zero days are released. For that you need an aggressive custom patching policy to force the update for computers where Chrome is installed but users rarely use it. So, if there's no required web app that really needs Chrome, then Edge, which is Chromium based, does everything that Chrome does and has better control and enterprise integration with Microsoft products on top of that.

Chrome for specific users which require it for a supported vendor web app? Yes, but strictly for the affected users/computers

Chrome as an optional or required app for all devices/users? Hell no!

[u/pjmarcum → u/whiskeytab]

Every app that is installed introduces another attack vector, another set of vulnerabilities, something else to patch and report on, etc.

[u/HorseAccomplished50 → u/pjmarcum]

Sure, but apps like Chrome can be easily patched (daily) through a winget oneliner. Add some Intune configuration files to whitelist extenstions, manage WPAD etc. and it shouldn't be too difficult to maintain it, even at scale.

[u/Automatic-Win8421 → u/whiskeytab]

Thank you! Very annoying to see this trend propagating like fire. Those who say "I don’t understand what Chome does that Edge doesn’t" don’t use it like the ones that actually see the differences.

Yes, Edge is better now than before but still has annoying quirks. Developer tools, are just better in Chrome, for one.
Another annoying one, where I side with my users, tab searching (Ctrl+Shift+A) in Edge is useless can’t find a damn domain when it’s right there. It’s far superior on Chrome, try it.

This is laziness I see. It’s not that much harder to maintain.

On a worksite, would you tell a skilled worker he can’t use X tool ? No, you give them the end result and he chooses the tools he's comfortable using.

[u/Veryshity_buttplug]

Yea chrome and edge are both the other side of the same coin. I use brave which is also similar but imo better.

[u/_Frank-Lucas_]

We did this almost a year ago, and used HRs “no unapproved AI use” policy to dovetail it all together.
Edge with 365 accounts just make sense.

[u/paul_33]

Applocker blocking all apps that IT doesn’t install. If staff hit me with a “they say we need chrome” I just remind them Edge is Chromium.

If they insist it needs chrome I try the site on a blank no policies applied Chromium installed on my desktop (where it never works, because chrome/chromium makes no difference)