Disable browsers built-in passwords manager using Microsoft Intune

🔒 How to Disable Browser Password Managers via Microsoft Intune (Edge, Chrome, Firefox)

For IT Admins & Security Teams Why? Built-in password managers in browsers (Edge, Chrome, Firefox) pose security risks—they store credentials in plaintext, lack enterprise-grade encryption, and are vulnerable to malware like RedLine Stealer. Here’s how to disable them centrally using Microsoft Intune (with GPO/MDM fallback for Firefox).

1️⃣ Microsoft Edge (Chromium)

Method: Intune Administrative Templates

• Policy Path: Computer Configuration > Administrative Templates > Microsoft Edge > Password Manager
• Settings:
  • Enable "Disable saving passwords to the password manager"
  • Enable "Disable the display of password reveal button"
• Intune UI:
  1. Navigate to Devices > Configuration profiles > Create profile.
  2. Select Windows 10 and later > Templates > Administrative Templates.
  3. Search for "Password Manager" and configure the policies above.
  4. Assign to user groups/devices.

Verification:

• Open Edge → edge://settings/passwords → "Offer to save passwords" should be grayed out.

 2️⃣ Google Chrome

Method: Intune OMA-URI (Custom Settings) Chrome doesn’t natively support Intune Administrative Templates, so we use OMA-URI to push registry keys.

• Policy Path: Software\Policies\Google\Chrome
• OMA-URI:
  ./Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/Chrome/Policy/ChromeAdmx
  

• Registry Keys to Deploy:
  [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome]
  "PasswordManagerEnabled"=dword:00000000
  "PasswordManagerAllowShowPasswords"=dword:00000000
  

• Intune UI:
  1. Go to Devices > Configuration profiles > Create profile.
  2. Select Windows 10 and later > Templates > Custom.
  3. Add the OMA-URI above with Data type: String and paste the registry content.
  4. Assign to user groups/devices.

Verification:

• Open Chrome → chrome://settings/passwords → "Offer to save passwords" should be disabled.

 3️⃣ Mozilla Firefox

Method: Intune + GPO (Firefox ADMX) or MDM Firefox lacks native Intune support, so we use Group Policy or MDM (via Firefox ADMX templates).

• Option A: Group Policy (For Hybrid AD Joined Devices)

  1. Download the Firefox ADMX templates from Mozilla’s GitHub.
  2. Import into Group Policy (gpedit.msc or Central Store).
  3. Navigate to: Computer Configuration > Administrative Templates > Mozilla > Firefox > Password Manager
  4. Enable "Disable saving passwords".

• Option B: MDM (For Azure AD Joined Devices) Use Intune’s OMA-URI to push Firefox policies:

  • OMA-URI:
    ./Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~PasswordManager/DisablePasswordManager
    

  • Value:
    <enabled/><data id="DisablePasswordManager" value="true"/>
    

Verification:

• Open Firefox → about:config → Search for signon.rememberSignons → Should be false.

 

🔐 Security Bonus: Enforce Enterprise Password Managers

While disabling built-in managers, mandate an enterprise solution like:

• Keepass or Bitwarden Teams (with Intune app deployment).
• Windows Hello for Business (for passwordless authentication).