Intune Managed Browser is a web browsing app by Microsoft which lets you safely view and navigate web pages that containing Company information or internal organization web pages. This is the second post of this topic where I’m addressing how to effectively use Managed browser with EMS components and features.
From Part 01 of this post we have discussed topics such as Deploying Managed browser with Intune, restrict cut copy save-as options with Intune app protection policies and enabling SSO to apps through the Managed browser. From this post, I will continue to explain centrally manage configurations such as bookmarks, the home page, whitelisting and blacklisting web pages. Also, let’s see configuring conditional access where corporate apps can access only from Managed browser and use the Azure app proxy.
When you are publishing a corporate web app through Intune Apps, there is a setting to select the Managed Browser is the default to open the link. Which will notify the user to download the managed browser if it’s not already installed. Once installed, the app will be opened through the managed browser and app protection policies applied.
From Part 01, I have discussed how to protect corporate apps through Intune app protection policies, where you can use Managed Browser to restrict Cut, Copy, Save-as, and other options. But what if user access this app from the unprotected browser where not honoring App Protection policies. With the help of Azure Conditional Access, you can block all the unprotected browsers and allow only the Managed Browser to access the corporate apps. Let’s see how we can enable this.
Using Application proxy, you can publish internal web apps to the public internet while addressing azure security features. Application proxy converts the internal URL to a publicly accessible URL and the content routed through the app proxy. However, using the Managed Browser, you can still use the internal URL. When browsing, the Managed Browser identifies the internal URL and redirect it through azure app proxy. For Edge and Chrome, you need to install the Managed Browser Extension and select Company Internal URL Redirection ON.
When you are pushing Managed Browser to use with the corporate apps, it would be easier if you can push configurations such as Homepage, Bookmarks and allow or block certain URLs. these settings can be configured with Intune App Configurations policies.
Configuring Homepage from Intune app configuration policies.
Key - com.microsoft.intune.mam.managedbrowser.homepage
Value – <Web URL>
Configuring Bookmarks from Intune app configuration policies.
As we configured the homepage from Intune configurations policies, we can configure the bookmarks for Edge and Intune Managed browser, when these settings are pushed from Intune, users cannot delete or modify the bookmarks. This configuration is nice to have when you are published corporate web sites from Azure App Proxy so web apps will be automatically available in their managed browsers as bookmarks.
Configuring Allow and Block URL’s using Intune app configuration policies.
Using app configuration policies, you can allow or block URLs where you find relevant. This can be done in the same way we followed when adding a bookmark or homepage. You need to specify the URL allowing Key or URL blocking Key with the values which are the relevant URLs. other than mentioning each URL, you can use the * while card sign also.
Key Allow URL’s - com.microsoft.intune.mam.managedbrowser.AllowListURLs
Key Block URL’s - com.microsoft.intune.mam.managedbrowser.BlockListURLs
Value URL’s you can provide as follows.
With this information, I will finish Part 02 of the post Securing corporate web apps using Intune Managed Browser. If you want to read the Part 01 click (here)
Hope this post is useful
Cheers