Secure Your Edge Environment: Block or Allow Native Messaging Hosts with Intune

With Microsoft Intune, you can control whether users are allowed to install and run native messaging hosts at the user level—without needing admin rights. This policy plays a key role in balancing security and flexibility, especially when browser extensions require native system communication.

What Are Native Messaging Hosts?

Native messaging hosts are applications that allow browser extensions to communicate with the local operating system. They are commonly used to:

• Access local files or apps

• Facilitate advanced workflows

• Connect with third-party services

Microsoft Edge supports two types:

• System-level hosts (require admin install, apply to all users)

• User-level hosts (installed by users, don’t require admin rights)

What Does This Policy Do?

The policy in focus is: “Allow User-Level Native Messaging Hosts Without Admin Permissions”

It controls whether Microsoft Edge can use user-installed native messaging hosts:

• ✅ Enabled – Users can install and use native messaging hosts without admin permissions. Great for flexibility and productivity.

• ❌ Disabled – Only system-level hosts are allowed. Stronger control, ideal for high-security environments.

• ⚙️ Not Configured – Microsoft Edge allows both system and user-level native messaging hosts (default behavior).

Why It Matters

Properly managing this policy helps you:

• Prevent unauthorized or risky extensions from interacting with the local system

• Preserve control in regulated or security-conscious environments

• Give trusted users the flexibility they need, without sacrificing oversight

What Happens if You Disable It?

When this policy is disabled, Microsoft Edge will only use native messaging hosts installed at the system level. Any extension requiring a user-level host simply won’t work unless installed by an administrator.

This is useful for:

• Preventing lateral movement through malicious extensions

• Enforcing a strict application control strategy

• Maintaining clean, predictable configurations across all users

Next: How to Configure This Policy via Intune

In the next part of this series, I’ll walk you through how to:

• ✔️ Deploy this policy using the Settings Catalog

• 🔍 Monitor deployment status and client-side enforcement

Whether you're looking to lock things down or open them up—this is a policy every Intune admin should be aware of.

Secure Your Edge Environment: Block or Allow Native Messaging Hosts with Intune

🛠️ How to Deploy the Policy Using Microsoft Intune

To deploy the "Allow User-Level Native Messaging Hosts Without Admin Permissions" policy using Microsoft Intune, follow these steps:

🔐 Sign in to the Microsoft Intune Admin Center.

1. In the left-hand menu, select Devices.

2. Under By platform, click on Windows.

3. Choose Configuration from the available options.

4. Click + Create or + New Policy to begin setting up your new configuration.

5. Set Platform to Windows 10 and later

6. Choose Profile type as Settings catalog

7. Click Create to proceed to the configuration stage.

Basic Information of the Policy – User-Level Native Messaging Hosts

Once you begin creating the configuration profile in Intune, the first step is to complete the Basics section. This includes:

• 🏷️ Defining a clear and descriptive policy name

• 📝 Optionally adding a description for context

• 💻 Reviewing the platform (defaults to Windows 10 and later, so no changes needed)

Choosing a meaningful name and providing a concise description helps ensure that you and your team can easily identify the purpose of the policy—especially in environments with multiple profiles being managed simultaneously.

Here’s an example:

• Policy Name: Allow User-Level Native Messaging Hosts

• Description: This policy controls whether Microsoft Edge allows user-level native messaging hosts to function without requiring administrative permissions. Enabling this setting allows users to install and use hosts individually, offering flexibility in environments that support secure browser extension use.

Configuration Settings – Allow User-Level Native Messaging Hosts

Now it’s time to define the specific setting that controls the behavior of native messaging hosts in Microsoft Edge.

1. 🧩 Click Add Settings to open the Settings Picker

2. 🔍 In the search bar, type Native Messaging

3. ✅ Expand the Microsoft Edge\Native Messaging category

4. 📄 Select Allow User-Level Native Messaging Hosts Without Admin Permissions (User)

5. ❎ Close the Settings Picker window

Once selected, the policy will appear on the Configuration Settings page.

At this stage, you can configure the policy behavior by choosing the desired value from the dropdown menu:

• ✅ Enabled – Allows users to install and use user-level native messaging hosts without requiring admin rights

• ❌ Disabled – Only system-level native messaging hosts will be allowed

• ⚙️ Not configured (default) – Microsoft Edge will allow both system-level and user-level hosts

Choose the setting that best aligns with your organization's security policies and flexibility needs.

Add Scope Tags to a Policy

Now you are on the next step called Scope Tags. A scope tag is used to assign policies to specific groups within an organization. In this step, you can select a scope tag for the policy. However, I suggest skipping this section because it is not needed for this policy. So, I clicked Next to continue.

Assigning the Policy

The next step is the Assignments section, where you define which user or device groups will receive the policy.

Since our goal is to target a specific group, this step is essential for proper deployment.

• Under Include groups, click Add groups.

• A window will appear showing available Azure AD groups.

• Use the search bar to quickly locate the group you want to assign the policy to.

• Select the desired group and confirm your choice.

Once the group is selected, click Next to proceed to the final step.

Review + Create – Finalizing the Policy

After completing the Assignments step, you'll reach the final stage: Review + Create.

This tab provides a full summary of all the information you've entered, including:

• Basic details (name, description, platform)

• Configuration settings you've defined

• Targeted assignment groups

Carefully review each section to ensure everything is correct and aligned with your deployment goals.

Once everything looks good, click Create to finalize and deploy the policy.

Your configuration will now be applied based on the assignment scope you defined.

📊 Monitoring Status – Verifying Policy Deployment

After creating and assigning the "Allow User-Level Native Messaging Hosts" policy, it’s essential to monitor whether it has been successfully applied to the target devices.

You can wait for the next automatic sync cycle (which may take up to 8 hours), or you can trigger a manual sync using the Company Portal app or via the Intune Admin Center to speed up the process.

Once the device has synced, follow these steps to verify the deployment status:

1. 🖥️ Go to Devices > Configuration profiles in the Microsoft Intune Admin Center

2. 🔍 Use the search bar to locate your policy by name — in this case: 👉 Allow User-Level Native Messaging Hosts

3. 🧾 Click the policy name to open its details

4. 📈 In the overview, you’ll see:

Monitoring ensures that your configuration is working as intended and allows you to troubleshoot quickly if something goes wrong.

Client-Side Verification via Event Viewer

After syncing the device, you can verify whether the "Allow User-Level Native Messaging Hosts Without Admin Permissions" policy was successfully applied by checking the Event Viewer on the client machine.

Follow these steps:

1. Open Event Viewer

2. Navigate to: Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostic-Provider > Admin

3. In the right-hand pane, click Filter Current Log

4. Search for Event ID 813 or 814, which typically contain information about policy deployment

Look for entries that reference:

• Policy Name: AllowUserLevelNativeMessagingHosts

• Policy Area: MicrosoftEdge

• Int (Integer Value): 0x1 (enabled) or 0x0 (disabled)

• Enrollment ID, Scope, and User Context may vary per deployment

💡 Pro Tip ⚠️ Values such as Enrollment ID, Scope, and User Context can differ depending on how the device was enrolled and how the policy was deployed. Always double-check that the Policy Name and Integer Value match the configuration applied in Intune.

Troubleshooting Checklist

• ✅ Ensure the device is included in the correct Azure AD group targeted by the policy

• 🔄 Confirm the device has recently synced with Intune

• ⚔️ Look for conflicts with other configuration profiles that may override this setting

• 🔧 Trigger a manual sync via the Company Portal app or the Intune Admin Center

• 📚 For deeper diagnostics, review the Microsoft Learn CSP documentation or enable advanced MDM logging on the client device

📚 More Information

To deepen your understanding of how to configure and manage the “Allow User-Level Native Messaging Hosts Without Admin Permissions” policy using Microsoft Intune, refer to the following Microsoft Learn resources:

• Policy CSP – MicrosoftEdge Learn more about the MicrosoftEdge CSP, including the AllowUserLevelNativeMessagingHosts setting used to control native messaging permissions. 🔗 https://learn.microsoft.com/en-us/deployedge/microsoft-edge-browser-policies/nativemessaginguserlevelhosts

• Configure Microsoft Edge policy settings with Intune Step-by-step guidance to configure and deploy Microsoft Edge policies through Intune using the Settings Catalog. 🔗 https://learn.microsoft.com/en-us/deployedge/configure-edge-with-intune

• Microsoft Edge security baseline settings in Intune Review the default security baseline settings for Microsoft Edge, including the default status of native messaging host permissions. 🔗 https://learn.microsoft.com/en-us/intune/intune-service/protect/security-baseline-v2-edge-settings

Thank you!

🖥️ Ricardo Barbosa

📘 MCT Microsoft Certified Trainer | ☁️ Cloud Architect

🌐 Technology Director - https://altelix.com