MDM - Edge extension via Intune (Windows)

This guide deploys the Scribe browser extension to Microsoft Edge on Intune-managed Windows devices and configures it: silent authentication through your Microsoft Entra identity, a reduced interface for background-capture users, and the other extension settings. It applies on managed devices only; on an unmanaged computer users get normal sign-in.

Prerequisites

• Intune-managed, Entra-joined Windows devices. Edge signs in with the work account automatically on these.
• For silent authentication: single sign-on set up for your Scribe organisation with Entra as the identity provider (see Browser extension - set up single sign-on with Microsoft Entra).
• For silent authentication: users exist in Scribe with emails matching their Entra sign-in names.
• Scribe Edge extension ID: ejommccbnocgekjphflienmbmkallcef

Step 1 - Install the extension

On a test device, do Step 1 then Step 2 and restart Edge in between, so you can check each on its own. For the rollout, deliver Step 2 first: the extension signs in when it is installed, and if its configuration is not there yet it waits for its next scheduled check (CheckAuthIntervalHours) or an Edge restart.

1. Intune admin center → Devices → Windows → Configuration → Create → New policy → Windows 10 and later → Settings catalog.
2. Add settings → Microsoft Edge → Extensions → Control which extensions are installed silently → add the extension ID.
3. Assign to your rollout group. The extension installs within minutes of the next device sync.

Force-installing through the Edge management service in the Microsoft 365 admin center works as well; the configuration below is honoured either way.

Step 2 - Deliver the configuration

Edge reads the extension's configuration from this registry key:

Values are plain registry values: booleans as DWORD 1/0, text as strings. Deliver them with an Intune script. Two options, depending on your Windows licensing:

• Remediation (recommended): Intune → Devices → Scripts and remediations → Remediations. A detection script checks the values, a remediation script writes them, and it runs on a schedule, so changed values are put back. Requires Windows 10/11 Enterprise E3 or E5, Microsoft 365 F3/E3/E5, the education equivalents, or Windows 365 / Azure Virtual Desktop.
• Platform script: any licence. Intune → Devices → Scripts and remediations → Platform scripts, run in system context. Runs once per device; later changes to the values are not re-applied.

Example. Set Domain to your SSO domain, adjust the other values and add any you need from the table below (MinerVisibility, for example) as further Set-ItemProperty lines:

Minimal mode. For users who only do background capture, add MinerVisibility as a string value minimal to the policy key: the extension reduces to a small status view, with no manual capture options and no regular popup or side panel. It works like the desktop app's minimal visibility mode.

All values the policy key accepts:

For a remediation, pair it with this detection script, which reports non-compliant when any value is missing or different (keep the values identical to the script above):

Detection and remediation scripts, ready to upload (remove the .txt suffix after download):

• Detect-EdgeExtensionPolicy.ps1.txt 
• Remediate-EdgeExtensionPolicy.ps1.txt 

Verify on one device

1. The extension appears in edge://extensions.
2. The configuration arrived: the registry key above exists with your values. (edge://policy does not reliably show the extension's section, so check the registry.)
3. Open Scribe in Edge: signed in with no interaction.
4. If you set MinerVisibility to minimal: click the extension's toolbar icon - it shows the small status view instead of the regular extension.
5. After a configuration change, restart Edge with edge://restart - closing its windows does not stop it.