Microsoft Edge: Tab organization enhancements

🚨 The Signal: Microsoft Edge now suggests tab groupings and names using AI. This feature, enabled by default, could expose sensitive tab titles to Microsoft services, impacting data privacy and compliance for Australian government and critical infrastructure.

The Impact

All users are affected, with a potential risk of sensitive information exposure through browser telemetry.

  • End users: Browser tabs may be sent to Microsoft for analysis, risking sensitive data exposure.
  • Security teams: New data flow requires assessment for compliance with data handling policies.
  • Admins: Must configure browser policies to prevent unintended data sharing.
  • Compliance officers: Need to review data processing agreements for AI-driven browser features.

The Action

  1. Review Microsoft Edge privacy settings for 'Search and connected experiences' to understand data sharing.
  2. Implement or update Group Policy/Intune policy 'TabServicesEnabled' to '0' (Disabled) for all managed devices.
  3. Communicate to end-users about the new feature and the organisation's stance on its use.
  4. Assess data privacy impact for any sensitive information that might appear in tab titles.

Domain: M365-Apps · Impact: high · Workload: M365 Apps · Essential Eight: User Application Hardening · ISM: ISM-1412, ISM-1485, ISM-1486, ISM-1542, ISM-1585, ISM-1667, ISM-1668, ISM-1669, ISM-1670, ISM-1823, ISM-1824, ISM-1859, ISM-1860