Knowing how to disable enhanced security configuration edge for users and administrators is essential when Microsoft Edge's stricter browsing mode starts breaking legitimate websites or internal apps.
Many administrators discover that Edge's enhanced security mode — which Microsoft built to mitigate memory corruption exploits — can block JavaScript execution or disable JIT compilation on trusted sites, breaking web apps employees rely on daily. Microsoft documents this feature under "Enhance your security on the web" in Edge's official documentation.
The problem: Edge applies this protection at different scopes, and disabling it incorrectly can either fail silently or strip protection from users who still need it. This article walks you through five practical steps — covering individual browser settings, Group Policy, and registry methods — so you can disable enhanced security configuration edge for users and administrators safely and repeatably.
What Edge's Enhanced Security Configuration Actually Does
Edge's enhanced security setting automatically applies extra protections to less-visited websites. It has two levels: Basic, which disables JavaScript JIT on unvisited sites, and Strict, which also enables additional operating system protections like ACG (Arbitrary Code Guard) and CFG (Control Flow Guard).
Microsoft states that enabling these mitigations "prevents memory corruption vulnerabilities from being exploited" on sites you don't visit often.
The trade-off is compatibility. Websites running modern JavaScript frameworks — especially internal line-of-business apps — can fail to render or behave unpredictably when JIT is disabled. That's precisely why knowing how to disable enhanced security configuration edge for users and administrators matters for enterprise environments, and why this guide covers every supported method.
How to apply this: Open edge://settings/privacy and scroll to "Enhance your security on the web" to see the current state before changing anything.
When You Should (and Shouldn't) Disable It
Microsoft designed the feature with a default of Basic enabled in recent Edge versions, so a fresh install may already apply stricter protections than you expect. Disabling it is reasonable when:
- Internal web apps break under enhanced security mode
- Users report blank pages or broken functionality on trusted sites
- You run a managed environment with endpoint protection (like Microsoft Defender for Endpoint) that already covers exploit mitigation
Keep it enabled for users who visit untrusted sites regularly. Disabling it on kiosk machines or high-risk endpoints removes a meaningful defense layer. Before you disable enhanced security configuration edge for users and administrators across your fleet, confirm that the compatibility issues are reproducible and not caused by other browser policies or extensions.
How to apply this: Document which user groups have legitimate breakage before making fleet-wide changes, so you only disable where needed.
Step 1: Disable Enhanced Security for a Single User in Edge Settings
The fastest method is per-browser, per-profile:
- Open Edge and go to
edge://settings/privacy - Scroll down to Enhance your security on the web
- Set the toggle to Disabled, or choose Balanced to keep baseline protections
This changes the setting only for that Windows account's Edge profile. It's ideal for a quick fix or a single machine — but any user with local admin rights can flip it back, and it won't scale across a fleet. For that reason, administrators typically move to policy-based control next.
The settings toggle is the fastest way to disable enhanced security configuration edge for users and administrators on individual machines without touching infrastructure.
How to apply this: Use the settings toggle on your own machine first to confirm it fixes the site compatibility issue before rolling out policy changes.
Step 2: Disable It for All Users via Group Policy
In managed domains, the reliable way to disable enhanced security configuration edge for users and administrators is the EnhanceSecurityMode policy. First, download and install the Microsoft Edge administrative templates from the official Edge Enterprise landing page.
Then configure:
- Open the Group Policy Management Editor
- Navigate to Computer Configuration → Administrative Templates → Microsoft Edge
- Set "Configure Microsoft Edge enhanced security mode" to Disabled (or to Balanced/Strict if you want to standardize instead)
- Optionally configure EnhanceSecurityModeBypassListDomains to exempt specific trusted domains while keeping the feature on elsewhere
Policy-set values override the settings UI, so users can't re-enable or disable it themselves. This is the method Microsoft recommends for enterprise consistency. Using Group Policy to disable enhanced security configuration edge for users and administrators ensures a consistent experience across every domain-joined workstation.
How to apply this: Test the policy on one OU or a pilot group before linking it at the domain level.
Step 3: Registry Method for Non-Domain Machines
For standalone machines or home environments without Group Policy, the registry achieves the same result. The relevant key is:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge
Create or set a DWORD value named EnhanceSecurityMode:
| Value | Result |
|---|---|
| 0 | Feature disabled |
| 1 | Balanced mode forced |
| 2 | Strict mode forced |
Registry-based policy takes effect after restarting Edge. Keep in mind this writes to HKLM, so you need administrator rights to apply it — which makes it a natural fit for admin-controlled machines but unsuitable for letting standard users opt out.
Administrators who disable enhanced security configuration edge for users and administrators through the registry should document the change so future troubleshooting is straightforward.
How to apply this: Back up the registry key before editing, and use regedit carefully or script the change with Microsoft Intune if you manage devices at scale.
Step 4: Handle Standard Users vs. Administrators Differently
A common scenario: standard users need the setting relaxed on trusted intranet sites, while admin accounts should keep stricter protections. Edge supports this split through the bypass list policy rather than disabling outright. When you need to disable enhanced security configuration edge for users and administrators at different levels, the bypass list gives you granular control.
The comparison below summarizes your options:
| Method | Scope | User can override? | Best for |
|---|---|---|---|
| Settings UI | Single profile | Yes | Quick personal fix |
| GPO EnhanceSecurityMode | Machine/domain | No | Enterprise rollout |
| Registry policy | Single machine | No | Standalone devices |
| BypassListDomains | Trusted domains only | No | Mixed-trust environments |
Using EnhanceSecurityModeBypassListDomains lets you keep protection on for the open web while exempting, say, intranet.company.com. That's usually safer than a blanket disable, and it satisfies both user groups in one policy. For organizations that must disable enhanced security configuration edge for users and administrators selectively, this approach preserves defense on untrusted sites while fixing internal app compatibility.
How to apply this: List your internal domains in the bypass policy before resorting to a full disable.
Step 5: Verify and Troubleshoot the Change
Verification matters because Edge can silently enforce settings from multiple sources. Check two places:
- Visit
edge://policyto confirm the policy is applied and shows no errors - Visit
edge://settings/privacy— if the toggle is grayed out, policy control is active
If the setting reverts, another policy (Intune MDM, a local GPO, or a security baseline like Microsoft's Security Baseline for Edge) may be re-applying it. Also confirm Edge is fully closed — background mode can delay policy refresh; run gpupdate /force and relaunch Edge to be sure.
Successfully attempting to disable enhanced security configuration edge for users and administrators requires verifying that no conflicting policy source is overriding your change.
How to apply this: After any change, test a previously broken site in the affected user's profile, not your admin account.
Frequently Asked Questions About disable enhanced security configuration edge for users and administrators
How do I disable enhanced security in Edge without administrator rights?
You can use the edge://settings/privacy toggle if no policy controls it — that changes only your profile. However, if your organization applied the enhanced security configuration edge policy through Group Policy or Intune, the toggle is locked and you'll need to request an exemption or bypass domain from your IT team.
In most managed environments, only IT staff can disable enhanced security configuration edge for users and administrators through policy changes.
Does disabling enhanced security mode make Edge unsafe?
It removes a layer of exploit mitigation, mainly on rarely visited sites. The risk is manageable if you run endpoint protection like Microsoft Defender for Endpoint and users mostly visit trusted sites. Consider the bypass-list approach instead of a full disable for safer coverage.
The decision to disable enhanced security configuration edge for users and administrators should account for existing endpoint security layers.
Can I disable the feature for some sites but keep it for others?
Yes — use the EnhanceSecurityModeBypassListDomains policy to exempt specific domains. For instance, a hospital might exempt its patient-record portal while keeping enhanced security configuration edge active for general web browsing by staff. This partial approach is often better than trying to disable enhanced security configuration edge for users and administrators everywhere at once.
Why does the setting turn back on after I disable it?
Policy re-application is the usual cause. Edge honors the strictest applicable setting, so if a security baseline or Intune profile enforces it, your manual change will be overwritten. Check edge://policy for conflicts between sources. Attempts to disable enhanced security configuration edge for users and administrators will fail silently if an MDM solution re-applies the original setting.
Is this the same as Internet Explorer's Enhanced Security Configuration?
No. IE's Enhanced Security Configuration (ESC) is a Windows Server feature controlled in Server Manager, while this is an Edge browser setting controlled by Edge policies. The two are independent, though both exist to reduce exploit risk and often confuse administrators managing servers.
The steps to disable enhanced security configuration edge for users and administrators have no effect on IE ESC, which is managed separately.
Conclusion
Getting enhanced security configuration right in Edge is about matching protection to your environment, not just flipping a switch. Key takeaways:
- Use the settings toggle for single machines, and EnhanceSecurityMode policy for fleets
- Prefer a bypass domain list over a blanket disable when only internal apps break
- Always verify with
edge://policyafter changes - Split treatment between standard users and admins using scoped policies
Mastering how to disable enhanced security configuration edge for users and administrators gives you control without sacrificing security where it counts. Your next step: audit edge://policy on one representative machine today, identify any breakage, and pilot a bypass-list policy before changing anything fleet-wide.
With the right approach, you can disable enhanced security configuration edge for users and administrators precisely where needed — and keep it active everywhere else.
