Mass deploy the CyberArk Browser Extension for Microsoft Edge

This topic describes how to use Active Directory Group Policy Management with Microsoft Edge templates to deploy CyberArk Identity Browser Extension to all PCs in your organization.

Step 1: Add Edge policy templates

1. Open your browser and go to the following URL:

   https://www.microsoft.com/en-us/edge/business/download

2. Download a Microsoft Edge policy templates file (MicrosoftEdgeEnterpriseX64.msi, MicrosoftEdgePolicyTemplates.cab, or MicrosoftEdgeEnterpriseARM64). Make sure you download the file that matches your organization's environment and preferences.

3. Save the file in a temporary location. For example, C:\temp. Then copy the files to your domain controller.

Step 2: Add Edge .admx and .adml files to group policy

1. On your domain controller, go to the directory where you copied the Microsoft Edge templates files. Copy the msedge.admx file located within the \windows\admx directory to C:\Windows\PolicyDefinitions.

2. On the domain controller, go to the directory where you copied the Microsoft Edge templates files. Copy the msedge.adml file located within the \windows\admx\en-US directory to C:\Windows\PolicyDefinitions\en-US.

   If you want a language other than en-US, go to the correct directory. For example, es-ES.

Step 3: Create or configure your Edge policy

1. On your domain controller, open Group Policy Manager and expand the domain Group Policy Objects. If you do not have a group policy to use for Edge policies, right-click Group Policy Objects and create a new policy. Give the policy a relevant name, such as Edge Policy.

2. Right-click the new policy and select Edit.

3. Expand Edge Policy > Computer Configuration > Policies > Administrative Templates > Microsoft Edge > Extensions, then right click and edit Control which extensions are installed silently.

   If this policy will apply to users instead of computers, the Edge policies you will be expanding will be located under User Configuration -> Policies -> Administrative Templates -> Microsoft Edge.

4. Select Enabled, then click Show.

5. Add the following text and click OK.

   https://microsoftedge.microsoft.com/addons/detail/cyberark-identity-browser/mblkikdcdlfpljlmgijhccbhiijkhded

6. Click Apply, then click OK.

7. Disable Microsoft Edge's Built-In Password Manager by going to Microsoft Edge > Password manager and protection, then right- click and edit Enable saving passwords to the password manager.

8. Select Disabled, then click Apply and OK.

9. Following the same process as steps 7 - 9, go to the Microsoft Edge Administrative Templates Policy definitions. Disable Edge AutoFill by editing Enable AutoFill for addresses and Enable AutoFill for credit cards and setting them to Disabled.

10. (Optional) If you want to disable Developer Tools, to further secure against users attempting to unmask a masked password/credential, still within the Microsoft Edge Administrative Templates Policy definitions, edit Control where developer tools can be used and set it to Enabled. Select Don't allow using the developer tools and click OK.

11. Exit the Group Policy Management Editor. Right-click an organizational unit (OU) containing your computers or users, and select Link an Existing GPO.

12. Select Edge Policy and click OK.

The Edge policy automatically installs CyberArk IdentityBrowser Extension, for any PC or user within that OU, if Edge is installed on those PCs. The Edge policy also disables the Edge browser's less secure, built-in password manager and AutoFill capabilities.

Step 4: Check your Edge policies

On a target client device, open Microsoft Edge and go to edge://policy to see all applied policies. If you applied policy settings on the local computer, policies should appear immediately.

You can also check your extension by going to edge://extensions to confirm that your extensions are being installed.