To keep Microsoft Edge’s sync enrollment tied to work or school identities, deploy the Intune Settings Catalog policy Restrict which accounts can be used as Microsoft Edge primary accounts. Configure it in a Windows 10 and later profile with an approved account or domain pattern, assign it to a pilot group, and confirm the effective value at edge://policy.
This setting is targeted: it controls which identity can become Edge’s primary browser account. It does not automatically remove every personal profile, block personal websites, or disable all Edge synchronization.
What the primary-account policy controls
Edge’s primary browser account is the identity selected for the profile’s main account and sync opt-in experience. The policy evaluates the account name against the pattern you configure. A matching work or school account can be selected; an account that does not match is rejected during that flow, usually with an Edge error.
Edge sync can include favorites, passwords, browsing history, extensions, settings, open tabs and autofill data. Restricting the primary identity can reduce the chance that work-related browser data is associated with a personal Microsoft account, but it is not a complete data-loss-prevention control. See Microsoft’s description of sync data at Change and customize sync settings in Microsoft Edge.
#1 Best Overall
- Brilliant Display – Stunning 13.8" PixelSense touchscreen[1], with brilliant LCD display[2], unleashes luminous whites, deeper blacks and colors so richly saturated bringing vivid life into every frame – perfect for work, school, streaming and creative tasks.
- Power that lasts all day – With 20 hours of battery life[3], the new Surface Laptop powers through your entire day, so you can create, work and stream from morning to night without reaching for a charger.​
- Work at the speed of your ideas – Built with the latest Qualcomm Snapdragon X2 Elite (12 Core) processors, Surface Laptop delivers fast, AI‑accelerated performance—making it the most powerful Surface laptop for everything from multitasking to demanding workloads.
- The ports you need – Charge on-the-go, transfer data fast, or create the ultimate desktop set up with two USB-C / USB4[4] ports.
- Built-in AI Companion – Work smarter, create freely, and communicate with confidence—Copilot[5] on Windows 11 is always there to help.​
Choose the right Edge control
| Requirement | Policy or setting | What it does |
|---|---|---|
| Allow sync only for approved organizational identities | Restrict which accounts can be used as Microsoft Edge primary accounts | Limits the account that can become Edge’s primary browser account according to your pattern. |
| Disable Edge cloud synchronization completely | SyncDisabled |
Prevents users from turning sync on and suppresses the sync-consent prompt. It does not disable roaming-profile support. See Microsoft’s policy reference. |
| Prevent all Edge browser sign-in | BrowserSignin = Disable |
Disables browser sign-in, a broader control than restricting sync. Microsoft recommends considering NonRemovableProfileEnabled as well when browser sign-in is disabled. See BrowserSignin. |
| Prevent Google, Apple and other non-Microsoft identities | NonMicrosoftAccountSignInEnabled = Disable |
Hides non-Microsoft account sign-in entry points while Microsoft accounts can still be allowed. The current reference lists Windows and macOS version 150 or later for this control. See the policy documentation. |
| Keep an automatically signed-in work profile from being removed | NonRemovableProfileEnabled |
Controls removal of the automatically signed-in profile; it is not a personal-account sync restriction. See Microsoft’s policy reference. |
Prerequisites and planning
- Intune administrative permissions and Windows 10 or later devices enrolled in Intune.
- Microsoft Edge installed and receiving managed policies.
- A target user or device group, with exclusions understood.
- The approved UPN domains and any legitimate aliases or alternate suffixes.
- A pilot group for testing before broad assignment.
Microsoft documents the Windows Settings Catalog approach in Configure Microsoft Edge with Intune. Check the individual Edge policy page for platform and minimum-version requirements because they vary by setting.
Create the Windows Intune policy
- Open the Microsoft Intune admin center.
- Go to Devices, then Configuration or Configuration policies (the label depends on the current portal layout).
- Select Create or Create policy.
- Choose Windows 10 and later for Platform and Settings catalog for Profile type.
- Name the profile, for example
Restrict Microsoft Edge Personal Accounts Sync, and select Next. - Under Configuration settings, select Add settings, search for Microsoft Edge, and select Restrict which accounts can be used as Microsoft Edge primary accounts.
- Enable the setting and enter the permitted account pattern.
- Continue through Assignments, Scope tags and Review + create.
- Assign it to the pilot population first. Expand the assignment only after both allowed and disallowed identities behave as intended.
Write and test the account pattern
For one domain, a clear regular-expression-style value is:
.*@contoso.comFor two domains, use either of these equivalent forms:
.*@contoso.com|.*@fabrikam.com.*@(contoso.com|fabrikam.com)The escaped period is deliberate: in a regular expression, an unescaped period can match any character. Test the exact value used by your tenant against real UPNs. Include every approved UPN suffix, and check whether users authenticate with an alias rather than their expected sign-in name. Avoid broad expressions such as .*@company.*, which can allow unintended suffixes.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsRank #2
- With 16 GB of memory, runs as many programs as you want without losing the execution
- The 13.5" 2256 x 1504 screen provides a great movie watching experience
- 512 GB SSD is enough to store your essential documents and files, favorite songs, movies and pictures
- 8 Hours battery run time helps you stay unwired and work longer non-stop
Assign, refresh and verify delivery
Check Intune reporting
- Confirm the intended users or devices are in scope and not in an exclusion group.
- Check that the profile reports successfully rather than pending, conflicting or in error.
- Verify the device has checked in recently and that the profile is assigned to the same population you are testing.
Check Edge’s effective policy
- On a targeted Windows device, open Microsoft Edge and visit
edge://policy. - Select Reload policies if the setting is not shown.
- Find the primary-account restriction and confirm the configured pattern.
- Restart Edge if the policy is present but behavior has not changed.
Policy visibility proves that Edge received a value; it does not prove that the expression matches the identities you intended. Test an approved work account, a personal Microsoft account, an unapproved organizational domain and, where applicable, a second approved domain.
What users should experience
An account matching the allowed pattern can become the primary Edge account and participate in the available sync flow. An account that does not match is blocked from becoming that primary account and may produce an error or rejection during account selection or sync enrollment.
What this policy does not do
It does not necessarily remove personal profiles
Edge supports multiple profiles and identities. The restriction applies to the primary-account decision in the relevant account and sync experience; it should not be described as automatic removal of every personal profile.
It does not block personal browsing
Users may still reach personal websites or use other browser features, including InPrivate, unless separate web, endpoint, proxy, DNS, Defender or Conditional Access controls address those activities.
Rank #3
- A PREMIUM PERFORMANCE LAPTOP — Ready for work, school, and creativity. Built for busy days, big projects, and nonstop multitasking. Run video calls, school and work apps, 20+ browser tabs, and AI tools at the same time without slowing down.
- WITH AI BUILT IN — With a dedicated AI chip (Qualcomm Snapdragon X2 Elite), this Copilot+ PC[5] on Windows 11 helps you work smarter and faster. Prompt, create, and automate with ease - ready for even your most demanding tasks.
- A 13.8" TOUCHSCREEN YOU'LL ACTUALLY USE — Sharp colors, real detail, smooth 120Hz scrolling on the PixelSense touchscreen[1] with LCD display[2]. Tap, scroll, or pinch to zoom - whichever feels right for streaming, editing photos, or daily work.
- 20 HOURS OF BATTERY (LEAVE THE CHARGER) — Up to 20 hours of video playback[3] on a single charge. Work from a coffee shop, take it to class/work, or binge an entire season on a long flight — it'll keep up.
- THE PORTS YOU NEED — Two USB-C / USB4[4] ports for fast charging, big file transfers, or hooking up to three 4K monitors when you want a full desktop. Wi-Fi 7 keeps you online and fast wherever you are.
It is not a complete DLP boundary
The setting reduces one route for personal-account synchronization. It cannot by itself guarantee that corporate information never reaches a personal device or service.
Troubleshoot common failures
The work account is rejected
- Compare the actual sign-in name with the configured pattern.
- Add all legitimate UPN suffixes and account aliases that users really use.
- Check for a typing or escaping error in the expression.
- Confirm the profile has refreshed and that no conflicting Edge policy wins.
- Validate that the account is the identity type expected by the policy.
Personal profiles are still visible
This can be expected because primary-account restriction is not a universal profile-removal policy. Use separate profile, sign-in and access controls if the requirement is to prevent any personal profile usage.
Sync appears available despite the restriction
Check whether SyncDisabled is also configured. A global sync prohibition prevents the normal sync flow regardless of which account would otherwise be eligible. Test the policies separately in a pilot profile to distinguish account matching from global sync behavior.
The policy is missing in Edge
- Confirm assignment scope, exclusions, recent device check-in and Intune status.
- Reload
edge://policy, then restart Edge. - Check for profile conflicts and verify the installed Edge version against the individual policy reference.
- Make sure you are testing the managed Windows device, not an unmanaged profile or a mobile device.
Windows versus iOS and Android
The Settings Catalog procedure above is a Windows workflow. Do not copy it to mobile Edge. Microsoft’s Intune mobile guidance uses managed-app configuration and app-protection scenarios. For a managed mobile-app scenario, the documented key for disabling Edge sync is:
Rank #4
- A PREMIUM PERFORMANCE LAPTOP — Ready for work, school, and creativity. Built for busy days, big projects, and nonstop multitasking. Run video calls, school and work apps, 20+ browser tabs, and AI tools at the same time without slowing down.
- WITH AI BUILT IN — With a dedicated AI chip (Qualcomm Snapdragon X2 Elite), this Copilot+ PC[5] on Windows 11 helps you work smarter and faster. Prompt, create, and automate with ease - ready for even your most demanding tasks.
- A 15" TOUCHSCREEN YOU'LL ACTUALLY USE — Sharp colors, real detail, smooth 120Hz scrolling on the PixelSense touchscreen[1] with LCD display[2]. Tap, scroll, or pinch to zoom - whichever feels right for streaming, editing photos, or daily work.
- 19 HOURS OF BATTERY (LEAVE THE CHARGER) — Up to 19 hours of video playback[3] on a single charge. Work from a coffee shop, take it to class/work, or binge an entire season on a long flight — it'll keep up.
- Two USB-C / USB4[4] ports and a microSD card reader for fast charging, big file transfers, or hooking up to three 4K monitors when you want a full desktop. Wi-Fi 7 keeps you online and fast wherever you are.
com.microsoft.intune.mam.managedbrowser.account.syncDisabledSet that key to true when the requirement is to disable mobile Edge sync. It is a different control from the Windows primary-account restriction. See Microsoft’s Edge management guidance for Intune.
Rollback and change management
- In the Settings Catalog profile, set the primary-account setting to Not configured, or remove the assignment or exclude the pilot group.
- Save the change and wait for the affected devices or users to receive the updated policy.
- Reload
edge://policyand restart Edge. - Repeat the approved and disallowed-account tests to confirm the effective state.
Keep the original pattern and assignment notes so a rollback does not leave uncertainty about which identities were intended to be permitted.
Alternative deployment paths
Organizations with traditional Active Directory or hybrid management can deploy Edge policies through Group Policy and Edge ADMX instead of Intune; see the Microsoft Edge policy catalog. Cloud-managed Windows environments generally use Intune Settings Catalog, while mobile Edge requires Intune managed-app configuration. A third-party browser-management product is not necessary merely to implement this Edge-native control.
Frequently Asked Questions
Does this Intune policy disable Microsoft Edge sync?
No. It restricts which account can become Edge’s primary browser account. Use the mandatory SyncDisabled policy when synchronization must be disabled for everyone.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Best Value
- Brilliant Display – Stunning 13.8" PixelSense touchscreen[1], with brilliant LCD display[2], unleashes luminous whites, deeper blacks and colors so richly saturated bringing vivid life into every frame – perfect for work, school, streaming and creative tasks.
- Power that lasts all day – With 20 hours of battery life[3], the new Surface Laptop powers through your entire day, so you can create, work and stream from morning to night without reaching for a charger.​
- Work at the speed of your ideas – Built with the latest Qualcomm Snapdragon X2 Elite (12 Core) processors, Surface Laptop delivers fast, AI‑accelerated performance—making it the most powerful Surface laptop for everything from multitasking to demanding workloads.
- The ports you need – Charge on-the-go, transfer data fast, or create the ultimate desktop set up with two USB-C / USB4[4] ports.
- Built-in AI Companion – Work smarter, create freely, and communicate with confidence—Copilot[5] on Windows 11 is always there to help.​
Will it block every personal Microsoft account or profile?
It rejects accounts that do not match the configured pattern during the primary-account flow. It does not automatically remove every personal profile or block personal browsing.
Where can I confirm the policy reached Edge?
Open edge://policy, select Reload policies, and check the effective primary-account restriction and its pattern.
Can the Windows Settings Catalog method manage Edge on phones?
No. iOS and Android use Intune managed-app configuration. Microsoft documents com.microsoft.intune.mam.managedbrowser.account.syncDisabled for disabling mobile Edge sync.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
