Microsoft Edge for Business, deployed with security baselines.

It is not a separate product, which surprises people expecting a download. What you are getting is the work-profile experience built into the browser you already have, included with any commercial Microsoft 365 subscription. The same application, with work and personal profiles dividing automatically the moment somebody signs in with their corporate identity.

Named URLs are rendered using the old Trident engine hosted inside the modern browser, while everything absent from that list renders normally on Chromium. The site list itself lives under central management through Intune or Group Policy rather than on individual machines, and it should shrink over time as legacy applications get migrated rather than sitting untouched for a decade.

They can, and we would generally advise against fighting that battle. We do not push single-browser mandates. What we do is deploy the Microsoft browser for the workloads where the integration genuinely pays off, meaning webmail, SharePoint, Teams and the Office applications, and leave general browsing to individual preference. Chrome enterprise policies can be managed alongside so the second browser is governed rather than ignored.

It runs anything untrusted inside a hardware-isolated container, so a compromised page has nowhere to go. That earns its place in genuinely high-risk settings, financial services and government among them, rather than everywhere. Two constraints worth knowing up front: it needs an Enterprise edition of Windows, and it needs hardware that supports the isolation. We deploy it on the higher service tiers wherever both conditions hold.

Natively, through your existing directory. Single sign-on carries across Microsoft 365, federated third-party services and on-premises applications joined to Active Directory. Access policies evaluate browser sessions the same way they evaluate anything else. Worth noting the Mac and Linux clients support single sign-on too, which is not always true of enterprise browser tooling.

Extensions are governed from Intune on an approve-and-block basis: whatever you have sanctioned is permitted and everything else is refused. In practice the approved list is short, usually a password manager, whichever extensions your business applications require, and Microsoft 365 add-ins. Security tooling gets force-installed rather than offered, since an optional security extension is one nobody installs.

We can, and it is quick compared with most platform takeovers. The work is consistently the same three things: tuning a security baseline somebody left at defaults, clearing out a compatibility site list that accumulated entries nobody can justify, and consolidating policies that multiplied over the years. One to two weeks covers the large majority.

The macOS client matches the Windows one across most enterprise scenarios, covering profile separation, security baselines and access policy enforcement. There is one genuine exception and it matters: compatibility mode for legacy applications is Windows only. Any Mac user who depends on one of those applications needs a different answer, usually a virtual desktop, and that is worth establishing early rather than during rollout.