Microsoft 365 is in place, Edge is used every day and passwords are quickly saved. Business planning benefits from a more precise distinction: synchronising personal browser data, centrally deploying credentials and managing shared company access with roles are different tasks.
A website sign-in is not a work profile
A browser can contain both a personal and a company profile. The account signed in to the browser helps determine where its data is synchronised. This is separate from the account on the website currently open. Opening a company portal in a personal browser profile does not automatically bring all saved passwords under business management.
A deliberately configured work profile provides a traceable assignment. Check specifically whether it is signed in with the right company identity, managed and enabled for synchronisation. Microsoft explains these layers in its Edge identity and profile documentation (external link).
Personal sync connects the same person’s devices
Edge can synchronise favourites, settings and passwords, among other data, across signed-in devices. Permitted and active data types depend on account type, service prerequisites, licence and policies. Saying “We have Microsoft 365” is insufficient: check the precise capabilities of the plan and tenant in use.
Personal sync makes switching between your own work devices easier. It does not describe automatic role-based sharing with other employees. For a shared supplier account, also establish how the authorised group gets access and how changes or departures are handled. Technical reference: Microsoft: enterprise sync in Edge (external link).
Edge can also deploy credentials administratively
A blanket statement that Edge cannot provide any shared credentials would be incomplete. Microsoft documents a separate feature, Secure Password Deployment in the Edge management service. IT can use it to assign credentials to specific users and make them available for filling in a website sign-in. This feature is distinct from personal password synchronisation.
The current documentation lists Microsoft 365 Business Premium, E3 and E5, with configuration through Cloud Policies. Microsoft describes use in a work profile on managed Windows devices. Verify supported platforms, group assignments and the tenant’s available features before rollout; this does not imply support for every device or plan.
This deployment can suit a specific, limited use case. Additional requirements for entries, attachments, multiple applications, sharing processes, cover arrangements and exit remain a separate assessment. Sources: Microsoft: Secure Password Deployment (external link).
Hiding password display does not guarantee universal secrecy
For administratively deployed credentials, display, editing and export in the browser interface can be restricted. This should not become a promise that an authorised user can technically never obtain the secret under any circumstances. Microsoft itself identifies this limitation in its article on central password deployment (external link).
Offboarding therefore also depends on the target account’s state. Revoking a browser assignment, ending a session and changing the supplier password where required are separate steps. Where a portal supports individual users, include that option, its roles and its blocking procedures in the plan.
Each browser policy addresses a specific task
Managed Edge profiles can be controlled through the intended administration routes and policies, such as Group Policy, Intune or the Edge management service. Check the manufacturer’s specific description to establish which policy applies to which platform and profile type. A configured switch does not fully prove the state of existing data.
An important example is PasswordManagerEnabled: disabling new password saving still allows previously saved passwords to be used, according to Microsoft. Similarly, excluding a data type from sync does not prove that every older local copy has been removed. Existing data, the desired rule and the actual result therefore belong together in the pilot.
Microsoft: control password saving (external link) · Microsoft: limit sync data types (external link).
| Task | Typical management scope | Check beforehand |
|---|---|---|
| Personal browser passwords | Save, autofill and suitably sync within one person’s profile. | Correct profile, permitted account and existing data. |
| Administrative Edge deployment | Assign credentials through the intended management service. | Licence, groups, devices and actual deployment. |
| Shared business vault | Required shared entries, roles and handovers within the product’s scope. | Specific sharing permissions, recovery and exit. |
| Identity and MFA | Protect sign-in to the company account and connected services. | Additional permissions and sessions in the target portal. |
Entra ID and MFA protect the identity layer
A well-protected company identity underpins the work profile and connected services. MFA and suitable sign-in policies can protect this access. They do not automatically give an external supplier portal individual accounts, suitable roles or a tested recovery path.
Document identity sign-in, credential storage and permissions in the actual portal separately. This distinction also helps with device replacement, cover arrangements and deciding who can resolve an incident. A suitable team vault can complement the setup where required shared features exceed the chosen browser route.
Example: Microsoft 365 and a shared purchasing portal
A hypothetical business uses Microsoft 365 for collaboration. A supplier’s purchasing portal provides only one shared account. For accounting and its designated substitute, first record who owns the access operationally, who may use it and where recovery messages go.
Then test suitable options: administrative Edge deployment on the intended devices or an appropriate business vault with the necessary roles and handovers. Include a replacement device and a departing test user. One person’s private sync account must not silently become the company’s only recovery route.
Start with existing tools and add what is needed
DAXS helps review profiles and licences, define how personal and shared access should be handled, and run a manageable pilot. The outcome may be a suitably managed existing browser feature or additional password management. The deciding factors are the actual workflow and clear operational ownership.
Discuss browser and password management · Plan workplaces and identities · Compare cloud-hosted and self-hosted password managers · Organise shared company access and offboarding
Frequently asked questions
Is personal Edge sync sufficient to share access with an accounting group?
Synchronising one person’s devices is not this kind of group sharing. Administrative deployment and a team vault require separate assessment.
Can Edge centrally deploy shared credentials?
Microsoft documents Secure Password Deployment under specific prerequisites. Check platform, licence, management route and required feature scope in detail.
Does disabling password saving delete existing passwords?
The cited Edge policy prevents new saving but does not automatically remove existing passwords. Any intended cleanup needs its own verified procedure.
