What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
To centrally control whether Microsoft Edge on managed Windows devices hands ClickOnce requests to Windows, configure the Edge ClickOnceEnabled policy. In the Microsoft 365 admin center, go to Settings > Microsoft Edge > Configuration Policies, create a Windows policy, add Allow users to open files using the ClickOnce protocol, set it to Enabled or Disabled, and assign it to the intended Microsoft Entra group. Then confirm the policy reached the device at edge://policy and test with a trusted application.
What the ClickOnce policy controls
ClickOnce is a Windows application deployment technology. A website can provide a deployment manifest, commonly a .application file, that Windows handles through ClickOnce. Depending on the publisher’s deployment settings, the application can run online, be cached locally, and update automatically. Edge’s policy controls whether the browser permits this ClickOnce file handling; it does not install, package, update, or repair the application.
Microsoft calls the setting Allow users to open files using the ClickOnce protocol; its policy identifier is ClickOnceEnabled. When enabled, Edge permits ClickOnce handling. When disabled, Edge saves the requested file as a normal download instead of invoking the ClickOnce handler. The policy is mandatory, supports dynamic refresh, and is not per-profile. Microsoft lists support for Windows Edge 78 and later, but not macOS, Android, or iOS. See Microsoft’s ClickOnceEnabled policy documentation.
When the policy is not configured, Edge’s defaults and the user’s flag setting apply. Microsoft documents that ClickOnce is not enabled by default in Edge versions before 87; Edge 87 and later enable it by default, while users can turn it off at edge://flags. An enforced enterprise policy overrides that user setting, so the flags page alone cannot establish the effective policy state.
#1 Best Overall
- Brilliant Display – Stunning 13.8" PixelSense touchscreen[1], with brilliant LCD display[2], unleashes luminous whites, deeper blacks and colors so richly saturated bringing vivid life into every frame – perfect for work, school, streaming and creative tasks.
- Power that lasts all day – With 20 hours of battery life[3], the new Surface Laptop powers through your entire day, so you can create, work and stream from morning to night without reaching for a charger.
- Work at the speed of your ideas – Built with the latest Qualcomm Snapdragon X2 Elite (12 Core) processors, Surface Laptop delivers fast, AI‑accelerated performance—making it the most powerful Surface laptop for everything from multitasking to demanding workloads.
- The ports you need – Charge on-the-go, transfer data fast, or create the ultimate desktop set up with two USB-C / USB4[4] ports.
- Built-in AI Companion – Work smarter, create freely, and communicate with confidence—Copilot[5] on Windows 11 is always there to help.
Choose the policy value
| Desired behavior | Policy value | Effect |
|---|---|---|
| Allow ClickOnce handling centrally | Enabled (true) |
Edge permits the ClickOnce file handler. |
| Prevent Edge ClickOnce handling | Disabled (false) |
Edge saves the file as a normal download; ClickOnce applications may not launch properly. |
| Use Edge defaults and user choice | Not configured | Behavior depends on Edge version and the user’s ClickOnce flag. |
Choose Enabled when a validated line-of-business application depends on browser-initiated ClickOnce launch. Choose Disabled when that workflow is no longer required or your organization wants those requests handled as downloads. Leave the policy unconfigured when centrally enforced behavior is unnecessary or application dependencies are still being inventoried; do not treat that as equivalent to an explicit allow.
Enable or disable ClickOnce in the Microsoft 365 admin center
The portal’s navigation and labels can change. The workflow documented for Microsoft 365 Edge Configuration Policies is:
- Sign in to the Microsoft 365 admin center with an account authorized to manage Edge configuration policies.
- Open Settings > Microsoft Edge > Configuration Policies, then select + Create Policy.
- In Basics, enter a recognizable name and description, then choose the applicable policy type and Windows platform.
- Under Settings, select + Add settings. Search for
ClickOnceEnabledor Allow users to open files using the ClickOnce protocol. - Set the policy to Enabled to allow ClickOnce, or Disabled to stop Edge from invoking its handler. Select the setting.
- Continue through Extensions unless you also need to configure extensions.
- Under Assignments, select the Microsoft Entra group containing the intended users or devices.
- Review the configuration under Finish, then select Review and Create.
For the portal workflow and its Basics, Settings, Extensions, Assignments, and Finish stages, see the HTMD walkthrough. If the catalog does not show the setting, search by both its policy identifier and display name, confirm Windows is selected, and compare with Microsoft’s policy documentation. If it remains unavailable, use a supported Edge administrative-template or MDM policy channel.
Rank #2
- With 16 GB of memory, runs as many programs as you want without losing the execution
- The 13.5" 2256 x 1504 screen provides a great movie watching experience
- 512 GB SSD is enough to store your essential documents and files, favorite songs, movies and pictures
- 8 Hours battery run time helps you stay unwired and work longer non-stop
Assignment and policy delivery are separate steps
Creating the policy does not make it active immediately. The target group must be assigned, the managed device must receive the configuration, Windows must process it, and Edge must refresh its policy state. Initiate a device sync from the relevant management experience when appropriate, or wait for the device’s normal check-in. A user-group assignment does not by itself guarantee identical behavior in every Edge profile: device enrollment, policy scope, sign-in state, and management channel all matter.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →- Confirm the intended user or device is in the assigned Microsoft Entra group and is not excluded.
- Confirm the Windows device is enrolled with the service delivering the policy and has checked in.
- Check for another policy source setting a conflicting value.
Verify the effective setting in Edge
- On the managed Windows device, open Edge and navigate to
edge://policy. - Select Reload policies, then search for
ClickOnceEnabled. - Confirm the displayed value and source, and inspect any errors or conflicts.
This policy page is a stronger browser-side check than edge://flags/#edge-click-once. The flags page can show the user-facing setting, but an enterprise policy takes precedence over it.
Check Windows policy events when needed
For an MDM-delivered setting, open Event Viewer and inspect Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider > Admin. The HTMD walkthrough shows events 813 and 814 and an entry containing Policy: (ClickOnceEnabled) as policy-processing diagnostics. Event IDs and wording can vary with Windows build, enrollment type, and policy channel; do not rely on event 814 as the only proof. Correlate the log with the assigned configuration and edge://policy.
Rank #3
- A PREMIUM PERFORMANCE LAPTOP — Ready for work, school, and creativity. Built for busy days, big projects, and nonstop multitasking. Run video calls, school and work apps, 20+ browser tabs, and AI tools at the same time without slowing down.
- WITH AI BUILT IN — With a dedicated AI chip (Qualcomm Snapdragon X2 Elite), this Copilot+ PC[5] on Windows 11 helps you work smarter and faster. Prompt, create, and automate with ease - ready for even your most demanding tasks.
- A 13.8" TOUCHSCREEN YOU'LL ACTUALLY USE — Sharp colors, real detail, smooth 120Hz scrolling on the PixelSense touchscreen[1] with LCD display[2]. Tap, scroll, or pinch to zoom - whichever feels right for streaming, editing photos, or daily work.
- 20 HOURS OF BATTERY (LEAVE THE CHARGER) — Up to 20 hours of video playback[3] on a single charge. Work from a coffee shop, take it to class/work, or binge an entire season on a long flight — it'll keep up.
- THE PORTS YOU NEED — Two USB-C / USB4[4] ports for fast charging, big file transfers, or hooking up to three 4K monitors when you want a full desktop. Wi-Fi 7 keeps you online and fast wherever you are.
Test with a known ClickOnce application
- Use a known-good application supplied by your organization or its vendor, not an unknown public
.applicationfile. - Test on the assigned managed Windows device, in the affected Edge profile, and confirm the application site is reachable and trusted.
- Open or download the application’s
.applicationdeployment manifest. - Observe whether Windows invokes ClickOnce or Edge saves the file. Record the exact error if launch fails.
- In a controlled lab, repeat after changing the policy value and allowing that change to reach the device.
ClickOnce launches locally handled application code, so validate the publisher, signing, deployment location, and update behavior under your organization’s normal application-trust and endpoint-security rules.
Troubleshoot downloads or failed launches
The file downloads even though ClickOnce should be enabled
- Check
edge://policyfor an effective enabledClickOnceEnabledvalue and inspect its source, errors, or conflicts. - Confirm the policy assignment, group membership, enrollment, and recent device check-in.
- Verify the website is returning a valid ClickOnce deployment response and the file is a valid
.applicationmanifest. - Check whether the endpoint has supported ClickOnce infrastructure and whether the request is actually ClickOnce rather than DirectInvoke or another protocol.
- Investigate Windows security controls, SmartScreen, application control, antivirus, proxy filtering, and certificate validation for blocks.
- Ask the application publisher whether the deployment URL or signing certificate changed.
The application starts but fails afterward
ClickOnceEnabled only governs Edge’s permission to hand off the request. It does not ensure that application files or update locations are reachable, the manifest is valid, the signing certificate is trusted, required Windows or .NET components are present, network authentication succeeds, or the app supports the current Windows build.
The setting is missing or seems overridden
Search the catalog using both the identifier and friendly name, verify that the selected platform is Windows, and confirm the portal workflow supports the tenant and device scenario. If the policy is present but ineffective, check assignment exclusions, device check-in, management logs, and competing settings from Intune, Group Policy, registry, or another Edge management service. Avoid setting the same policy through competing channels unless you understand their precedence.
Rank #4
- A PREMIUM PERFORMANCE LAPTOP — Ready for work, school, and creativity. Built for busy days, big projects, and nonstop multitasking. Run video calls, school and work apps, 20+ browser tabs, and AI tools at the same time without slowing down.
- WITH AI BUILT IN — With a dedicated AI chip (Qualcomm Snapdragon X2 Elite), this Copilot+ PC[5] on Windows 11 helps you work smarter and faster. Prompt, create, and automate with ease - ready for even your most demanding tasks.
- A 15" TOUCHSCREEN YOU'LL ACTUALLY USE — Sharp colors, real detail, smooth 120Hz scrolling on the PixelSense touchscreen[1] with LCD display[2]. Tap, scroll, or pinch to zoom - whichever feels right for streaming, editing photos, or daily work.
- 19 HOURS OF BATTERY (LEAVE THE CHARGER) — Up to 19 hours of video playback[3] on a single charge. Work from a coffee shop, take it to class/work, or binge an entire season on a long flight — it'll keep up.
- Two USB-C / USB4[4] ports and a microSD card reader for fast charging, big file transfers, or hooking up to three 4K monitors when you want a full desktop. Wi-Fi 7 keeps you online and fast wherever you are.
Other ways to manage the same Edge policy
The Microsoft 365 Edge configuration experience, Intune or another MDM catalog, and Windows Group Policy are alternative delivery channels. The policy identity remains ClickOnceEnabled, although portal placement and labels can differ.
| Management route | Where it fits | Policy detail |
|---|---|---|
| Microsoft Edge administrative templates with Group Policy | Domain-joined Windows devices already managed with Active Directory Group Policy. | Administrative Templates/Microsoft Edge > Allow users to open files using the ClickOnce protocol; ADMX file: MSEdge.admx. |
| Intune Settings Catalog or MDM | Cloud-managed, Microsoft Entra joined, or hybrid-joined Windows endpoints. | Find the setting by ClickOnceEnabled or its display name; exact catalog path may vary. |
| Registry | Lab validation, scripted remediation, or troubleshooting—not usually the preferred long-term enterprise control. | HKLMSOFTWAREPoliciesMicrosoftEdge, DWORD value ClickOnceEnabled; 0 disables it. |
Microsoft lists the policy as a mandatory Boolean policy, dynamically refreshable and not per-profile. Its documentation also gives the Group Policy path and registry mapping in the policy reference. Use one authoritative management route where possible and investigate conflicts rather than assuming every channel will resolve identically.
Security and adjacent file-handler behavior
Enabling ClickOnce is not a security bypass or a guarantee that an application is safe. Microsoft notes that ClickOnce and DirectInvoke file-handler features can display additional warnings when Microsoft Defender SmartScreen flags a request as unsafe. Disabling ClickOnce makes Edge handle the file as a normal download; it does not amount to a complete Windows application-control policy. See Microsoft’s overview of ClickOnce and DirectInvoke.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Best Value
- Brilliant Display – Stunning 13.8" PixelSense touchscreen[1], with brilliant LCD display[2], unleashes luminous whites, deeper blacks and colors so richly saturated bringing vivid life into every frame – perfect for work, school, streaming and creative tasks.
- Power that lasts all day – With 20 hours of battery life[3], the new Surface Laptop powers through your entire day, so you can create, work and stream from morning to night without reaching for a charger.
- Work at the speed of your ideas – Built with the latest Qualcomm Snapdragon X2 Elite (12 Core) processors, Surface Laptop delivers fast, AI‑accelerated performance—making it the most powerful Surface laptop for everything from multitasking to demanding workloads.
- The ports you need – Charge on-the-go, transfer data fast, or create the ultimate desktop set up with two USB-C / USB4[4] ports.
- Built-in AI Companion – Work smarter, create freely, and communicate with confidence—Copilot[5] on Windows 11 is always there to help.
ClickOnceEnabled and DirectInvokeEnabled are separate policies for related but distinct browser file-handler features. Do not change DirectInvoke to troubleshoot a ClickOnce policy without first establishing that the application is actually using DirectInvoke. The separate policy is documented at DirectInvokeEnabled.
If an organization no longer needs a ClickOnce application, modernization options can include MSIX or other packaged Windows applications, Intune Win32 deployment, a web or progressive web app, or a vendor-supported replacement. The suitable choice depends on local Windows integration, offline use, update requirements, and line-of-business dependencies.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
