2

I'm trying to figure out a way to disable the Apps option from the Microsoft Edge Settings and more (Alt+F4) drop down menu as can be done with Collections and Share options where it shows Managed by your organization. Via registry, group policy, PowerShell command, etc.

Question(s)

  • Is there a way to make Apps restricted here so it's greyed out as Managed by your organization, or a registry setting, or security a configuration that will disallow it from being selected?
  • Or a way to disallow Install this site as an app from adding new sites in the list?

Visual pointers and other detail...

Open up Edge and do this to you see it in action with whatever site you are on when you select the options, it'll make an app for it and launch the URL in a kiosk type window when selected.

enter image description here

The problem is when the Apps option is pressed, it brings up the prompt to Install this site as an app and that allows the creation of an entry in the All apps and pins of its menu area.

enter image description here

What I've done and tried...

  • The URL of edge://* is blocked via the group policy setting of Block access to a list of URLs in User Configuration | Policies | Administrative Templates | Microsoft Edge.

    • When you click on Manage Apps from the Apps option it does block that but I need to prevent the Install this site as an app action when pressed.

  • In the same User Configuration | Policies | Administrative Templates | Microsoft Edge group policy path, it's also set as...

    • [{"url": "https://www.mycoolsite.com/","default_launch_container": "tab"}]
    • Disabled for the Allow Pin to taskbar wizard
      • Both of these were made effective but it still allows other sites to be added via the Install this site as an app option.

  • Looked through every policy settings one-by-one and not seeing anything relevant so this may very well be a human error and oversight issue.

  • Tons of Googling research to see if there's a registry key that can have restrictive permissions set to disallow the Apps option from the menu.

  • Downloaded and installed the latest policy definitions and also confirmed I'm on the latest stable version of Edge [88.0.705.74] too via Download and deploy Microsoft Edge.

Improve this question
6
  • Let me know what I'm overlooking here. Hope it is something simple too. Too much going on today but figured I'd ask...
    – Vomit IT - Chunky Mess Style
    Commented Feb 25, 2021 at 22:36
  • Have you tried to disabled Developer Mode? It appears as of Chromium Edge 77, websites turned into a PWA, appear in Apps & features. I would imagine the group policies that allow the install of applications might apply. You might not be able to get rid of the option, but you should be able to, make generate a nasty message asking for Administrator rights.
    – Ramhound
    Commented Feb 26, 2021 at 0:52
  • Yes, I have developer mode disabled per the option in this screen shot i.imgur.com/pptG5nB.png and those are a couple other settings too. I have it locked down tighter. I wish there was a clear option or a way to emulate what Configure the Share experience with an Edge config file parameter or a registry key, etc. for that Apps option. If you find anything, let me know. Even a nasty message would work in this case for me if that were possible. @Ramhound
    – Vomit IT - Chunky Mess Style
    Commented Feb 26, 2021 at 2:15
  • This account definitely cannot install any apps on this machine, it is a local user non-admin user only too. The policies are locked super tight for this user at the Windows OS level. Edge may be allowing a bypass to the restriction if that is the case though which is another good reason to lock it down too. @Ramhound
    – Vomit IT - Chunky Mess Style
    Commented Feb 26, 2021 at 2:19
  • 1
    It was a wild guess; You could disable all UWP applications since I believe PWA are wrapped UWPs
    – Ramhound
    Commented Feb 26, 2021 at 2:52

1 Answer 1

Reset to default
1

I'm not satisfied with this solution but it's what I have to work with until I find a better solution or a new "stable" policy template is released that allows such restrictions to PWAs on Microsoft Edge (Chromium) which would be ideal for this particular environment still.

I use PowerShell FileSystemAccessRule Constructors to deny full control of the \Web Applications directory within the specific users profile ~\AppData\Local\Microsoft\Edge\User Data\Default path.

  • Because other MS Edge policy definition lockdown settings the MS Edge profile on this machine will always use the ~\User Data\Default path for that part and cannot be changed
  • The username will be standard or else all parts will resolve via environmental variables

PowerShell

$Folder = "C:\Users\CoolUser\AppData\Local\Microsoft\Edge\User Data\Default\Web Applications";
If ( !(Test-Path $Folder) ) { New-Item -ItemType Directory -Force -Path $Folder };
$acl = Get-Acl $Folder;
$AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule("$env:USERDOMAIN\cooluser","FullControl","ContainerInherit,ObjectInherit","None","Deny");
$acl.SetAccessRule($AccessRule);
$acl | Set-Acl $Folder;

Post the PowerShell ACL restriction (screen print)

You can manually set these permissions to deny full control or less restrictive deny rules to the folder and it may very well still do the job. Just set the permissions to propagate to all child files and folders beneath too.

enter image description here

How this solution works

Once the ACL NTFS folder permission restrictions are in place, this is what happens when you try Install this site as an app from the MS Edge Settings drop down menu.

  1. Select Apps -> Install this site as an app

    enter image description here

  2. Now if\when the Install app Edge dialogue menu pops up and Install is pressed, it does not install the app, nor does it add an entry to the All apps and pins area.

    enter image description here

  3. If you go to Apps -> Install this site as an app you'll see it didn't add the site and just allows you to select the option to do so over and over again.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .