Configure Edge Favorites Using Intune

When enterprise administrators configure Edge favorites using Intune, the objective is to give every managed Windows workstation a locked, read-only folder of internal web portals, Microsoft 365 apps, SharePoint sites, and helpdesk links without overwriting the user’s personal bookmarks. Pushing bookmarks through login scripts or copying Bookmarks files into %LocalAppData% fails as soon as Microsoft Edge profile sync runs or when a user deletes a shortcut.

The native Microsoft Edge Policy CSP solves this through the ManagedFavorites setting in the Intune Settings Catalog. It renders a dedicated corporate folder with a lock icon directly on the Edge favorites bar. End users can open every link inside the managed folder and maintain their own personal favorites alongside it, but they cannot delete, rename, or alter the corporate URLs. If your organization also supports Google Chrome, you can reuse the exact same JSON array in our companion guide to configure Chrome bookmarks using Intune.

Prerequisites to Configure Edge Favorites Using Intune

Before deploying Microsoft Edge managed favorites across your Windows endpoints, verify that your environment meets the following requirements:

• Target Windows 10 or Windows 11 endpoints must be enrolled in Microsoft Intune and assigned an active Microsoft Intune license.
• Managed devices must have active internet connectivity to communicate with the Intune service and receive the latest configuration policies.
• Microsoft Edge must be installed and updated to a current enterprise-supported version across your organization.
• Your administrator account must have the Policy and Profile Manager or Intune Administrator role in Microsoft Entra ID to create and assign Settings Catalog profiles.
• You need a validated JSON structure defining your root folder name, target URLs, and any nested subfolders.

Template Structure for Creating an Edge Favorites File

Before deploying the policy in Intune, review how the Microsoft Edge Configure favorites (ManagedFavorites) policy parses bookmark items. Microsoft Edge expects a structured JSON array built from four specific keys:

Microsoft Edge automatically amends incomplete URLs as if they were submitted directly through the browser address bar (for example, techeuc.com resolves to https://techeuc.com/), though specifying the full https:// scheme is recommended for production SSO and SharePoint portals.

Create an Edge Favorites JSON File

You can prepare your Edge favorites JSON configuration either by customizing the validated template below or by exporting a folder layout directly from the Microsoft Edge browser UI.

Option 1: Production Edge Favorites JSON Template

In this deployment, we configure a root folder named TechEUC Links on the Edge favorites bar containing a nested subfolder named TechEUC with links to Microsoft 365, Outlook, and Microsoft Teams:

[
  {
    "toplevel_name": "TechEUC Links"
  },
  {
    "name": "TechEUC",
    "children": [
      { "name": "Microsoft 365", "url": "https://m365.cloud.microsoft" },
      { "name": "Outlook", "url": "https://outlook.office.com" },
      { "name": "Teams", "url": "https://teams.microsoft.com" }
    ]
  }
]

Option 2: Export Favorites Configuration Directly from Microsoft Edge

If your organization maintains a large tree of departmental links, you can build the folders visually in Edge and export the exact JSON string using the built-in administrator flag:

1. Open Microsoft Edge, navigate to edge://flags/#edge-favorites-admin-export, set Favorites configuration export for administrators to Enabled, and click Restart.
2. Open edge://favorites and create your folders and links in the browser.
3. Click the three-dot menu icon (…) on the Favorites page and select Export favorites configuration.
4. Type your top-level folder name, choose JSON / Windows, and click Copy to clipboard.

Configure Edge Favorites Using Intune Settings Catalog

Follow these steps in the Microsoft Intune admin center to create and deploy the Microsoft Edge managed favorites policy.

Step 1: Create a New Intune Configuration Policy

Sign in to the Microsoft Intune admin center and go to Devices > Manage devices > Configuration. On the Policies tab, click + Create and select + New Policy.

In the Create a profile panel, choose Windows 10 and later as the Platform and select Settings catalog as the Profile type. Click Create.

Step 2: Specify Policy Name and Description

On the Basics tab, enter a clear name and description for the profile:

• Enter Edge - Browser - Managed Favorites in the Name field.
• Enter This policy is to manage Edge Favorites in the Description field.

Click Next to continue.

Step 3: Configure Favorites and Enable Favorites Bar in Settings Picker

On the Configuration settings tab, click + Add settings to launch the Settings picker.

In the Settings picker search bar, type favorites and click Search. Select the Microsoft Edge category under Browse by category. In the list of settings below, select both of the following options:

• Select Configure favorites (and its device-level sub-setting Configure favorites (Device)).
• Select Enable favorites bar so the favorites bar is forced visible on the browser UI without requiring users to press Ctrl + Shift + B.

Close the Settings picker panel. Toggle both Enable favorites bar and Configure favorites to Enabled, paste your JSON structure into the Configure favorites (Device) text box, and click Next.

Step 4: Assign and Create the Intune Policy

Add any required Scope tags and click Next. On the Assignments tab, select your target Microsoft Entra ID device or user security groups. When rolling out browser policies for the first time, assign the profile to a pilot group before expanding to all production endpoints. Click Next.

On the Review + create page, verify the configured settings and JSON payload, then click Create.

Synchronize and Monitor Edge Favorites Intune Policy

To speed up policy delivery on your test Windows 10 or Windows 11 devices, open Settings > Accounts > Access work or school, select your organization account, click Info, and click Sync. If you are standardizing browser settings alongside Windows feature upgrades, see our guide on how to upgrade to Windows 11 26H2 using Intune.

To monitor deployment progress in the Intune portal, navigate to Devices > Windows > Configuration and select your managed favorites policy. On the policy overview blade, inspect the Device and user check-in status summary to confirm your targeted devices report as Succeeded with zero errors or conflicts.

End-User Experience and Verify Edge Policy ManagedFavorites

Sign in to a targeted Windows device and open Microsoft Edge. The favorites bar appears automatically below the address bar with the locked TechEUC Links folder and its nested TechEUC subfolder containing Microsoft 365, Outlook, and Teams.

Favorites deployed via Intune policy are read-only and isolated inside the managed folder. Users cannot delete or edit these corporate entries, and browser extensions cannot modify them. Managed favorites are also excluded from personal Microsoft account cloud sync, ensuring corporate URLs stay strictly on managed endpoints.

To confirm policy application directly inside the browser engine, open a new tab in Microsoft Edge, type edge://policy in the address bar, and press Enter. Under Microsoft Edge Policies, verify that both FavoritesBarEnabled (set to true) and ManagedFavorites (containing your JSON string) show a Status of OK.

PowerShell Script to Validate JSON and Audit Registry Keys

On Windows endpoints, Intune writes device-scoped Microsoft Edge policies to HKLM:\SOFTWARE\Policies\Microsoft\Edge and user-scoped policies to HKCU:\SOFTWARE\Policies\Microsoft\Edge. If you want to inventory these registry keys centrally across all managed workstations, follow our guide on how to collect Windows registry data using Intune Properties Catalog.

You can also run the following PowerShell script, Test-EdgeManagedFavorites.ps1, locally or via Intune Remediations to verify the registry values, test the JSON string with ConvertFrom-Json, and log the results to $env:ProgramData\TechEUC\EdgeFavorites.

#Requires -RunAsAdministrator
<#
.SYNOPSIS
    Audits Microsoft Edge ManagedFavorites and FavoritesBarEnabled registry policies.
.DESCRIPTION
    Checks HKLM:\SOFTWARE\Policies\Microsoft\Edge and HKCU:\SOFTWARE\Policies\Microsoft\Edge
    for the ManagedFavorites JSON payload, validates JSON syntax via ConvertFrom-Json,
    and logs the decoded bookmark count to $env:ProgramData\TechEUC\EdgeFavorites.
#>

[CmdletBinding()]
param()

$LogDirectory = "$env:ProgramData\TechEUC\EdgeFavorites"
$LogFile = "$LogDirectory\Audit_EdgeFavorites.log"

if (-not (Test-Path -Path $LogDirectory)) {
    New-Item -ItemType Directory -Path $LogDirectory -Force | Out-Null
}

function Write-EdgeAuditLog {
    param([string]$Message, [string]$Level = "INFO")
    $Timestamp = (Get-Date).ToString("yyyy-MM-dd HH:mm:ss")
    $Entry = "[$Timestamp] [$Level] $Message"
    Add-Content -Path $LogFile -Value $Entry -Encoding UTF8
    Write-Host $Entry
}

Write-EdgeAuditLog -Message "Starting Microsoft Edge Managed Favorites audit on $env:COMPUTERNAME"

$PolicyPaths = @(
    @{ Scope = "Device (HKLM)"; Path = "HKLM:\SOFTWARE\Policies\Microsoft\Edge" },
    @{ Scope = "User (HKCU)";   Path = "HKCU:\SOFTWARE\Policies\Microsoft\Edge" }
)

$FoundValidPolicy = $false

foreach ($Target in $PolicyPaths) {
    $RegPath = $Target.Path
    $ScopeName = $Target.Scope

    if (-not (Test-Path -Path $RegPath)) {
        Write-EdgeAuditLog -Message "[$ScopeName] Registry key $RegPath does not exist." -Level "WARN"
        continue
    }

    $Props = Get-ItemProperty -Path $RegPath -ErrorAction SilentlyContinue
    $FavJson = $Props.ManagedFavorites
    $BarState = $Props.FavoritesBarEnabled

    if ($null -ne $BarState) {
        Write-EdgeAuditLog -Message "[$ScopeName] FavoritesBarEnabled DWORD value: $BarState"
    } else {
        Write-EdgeAuditLog -Message "[$ScopeName] FavoritesBarEnabled is not configured." -Level "WARN"
    }

    if ([string]::IsNullOrWhiteSpace($FavJson)) {
        Write-EdgeAuditLog -Message "[$ScopeName] ManagedFavorites string value is missing or empty." -Level "WARN"
        continue
    }

    try {
        $Parsed = $FavJson | ConvertFrom-Json -ErrorAction Stop
        $TopLevel = ($Parsed | Where-Object { $_.toplevel_name }).toplevel_name
        $EntryCount = ($Parsed | Where-Object { $_.name }).Count
        Write-EdgeAuditLog -Message "[$ScopeName] Valid JSON verified. Root Folder: '$TopLevel' | Top-level items: $EntryCount"
        $FoundValidPolicy = $true
    } catch {
        Write-EdgeAuditLog -Message "[$ScopeName] Malformed JSON detected in ManagedFavorites: $($_.Exception.Message)" -Level "ERROR"
        exit 2
    }
}

if ($FoundValidPolicy) {
    Write-EdgeAuditLog -Message "Audit succeeded. Microsoft Edge Managed Favorites policy is active."
    exit 0
} else {
    Write-EdgeAuditLog -Message "No active ManagedFavorites policy found in HKLM or HKCU." -Level "WARN"
    exit 1
}

Troubleshooting Edge Managed Favorites Deployment

If your Microsoft Edge favorites policy fails to apply on targeted endpoints, use these three diagnostic methods alongside the matrix below:

1. Inspect Windows Event Viewer for Event ID 814 (String policy applied) under Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider > Admin to verify that the MDM agent received the ManagedFavorites payload.
2. Generate an MDM Diagnostic Report on the client machine by navigating to Settings > Accounts > Access work or school > Info and clicking Create report under Advanced Diagnostic Report.
3. Review client synchronization and script execution logs using our Intune Management Extension logs complete file path guide, or fix internal portal name resolution issues with our DNS_PROBE_FINISHED_NXDOMAIN fix for Windows 11, 10, and Edge.

Frequently Asked Questions

Does configuring Edge favorites using Intune overwrite personal user bookmarks?

No. The ManagedFavorites policy creates an isolated, read-only corporate folder on the favorites bar. Users retain full control over their personal bookmarks outside of the managed folder and can add, edit, or sync their own links normally.

Can I deploy two separate Edge Managed Favorites policies to the same device?

No. Microsoft Edge only reads a single JSON string from the ManagedFavorites registry value. If you assign both a baseline company-wide favorites policy and a department-specific favorites policy to the same scope, Intune flags a policy conflict instead of merging the two lists. Combine all required links into a single JSON array per target group.

Should I use Configure favorites (Device) or Configure favorites (User)?

Use Configure favorites (Device) when targeting Entra ID device groups, shared workstations, kiosks, or Windows Autopilot builds so the links are present immediately for every user who signs in. Use Configure favorites (User) when assigning department-specific links to Microsoft Entra ID user groups.

Do URLs in the ManagedFavorites JSON require the https:// prefix?

Microsoft Edge automatically amends incomplete URLs as if they were typed into the address bar, but including the explicit https:// prefix on every URL is recommended to avoid redirect hops and ensure internal Single Sign-On (SSO) portals load directly over TLS.