Lock Microsoft Edge to the kiosk's address

Lock Microsoft Edge on a kiosk PC so it opens only the kiosk's own address. Set these policies once, as the PC's administrator, before you create the kiosk with Assigned Access, so it is locked down from its first sign-in.

The kiosk already blocks every link, new window and long-press menu that would take a customer out of it. These Edge settings close the gaps a web page can't reach.

The three policies

For URLAllowlist, enter the host only: no https:// and no path. A branded kiosk's is like yourbrand-kiosk.mypreorder.com.

Set them in the registry

1. Sign in to Windows with the administrator account.
2. Open the Start menu, type regedit, and choose Run as administrator.
3. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft. If it has no Edge key, create one: right-click Microsoft, choose New → Key, and name it Edge.
4. Under Edge, create a key named URLBlocklist. In it, create a String Value named 1, with the value *.
5. Under Edge, create a key named URLAllowlist. In it, create a String Value named 1, with the kiosk's host as the value.
6. In Edge itself, create a DWORD (32-bit) Value named QuickSearchShowMiniMenu, with the value 0.

To use Group Policy instead, install Edge's administrative templates and set the same three policies. Each policy's Microsoft page, linked above, gives its Group Policy name.

Check them

1. Still as the administrator, open Edge and go to edge://policy.
2. Select Reload policies. All three are listed, with no errors.
3. Open the kiosk's address: it loads. Try any other website: Edge blocks it.

These policies apply to every account on the PC, the administrator's included. To browse elsewhere on this PC, remove URLBlocklist for a while, then put it back.

Only page loads are blocked

The kiosk's own calls to mypreorder, to your EFTPOS terminal's service and for menu photos aren't page loads, so these policies don't touch them. The allow-list needs only the kiosk's address.

If the kiosk moves to a new address

Allow both addresses before the move:

1. Under URLAllowlist, add a second String Value named 2 with the new host. Keep the old one at 1.
2. Change the address in the kiosk set-up (Assigned Access), and sign the kiosk in once on the new address.
3. Once it runs on the new address, you can remove the old host.

If the old address ever redirects to the new one while the allow-list names only the old host, Edge blocks the page it is sent to, and the kiosk is stuck.

To change any of this on a kiosk that's already running, press Ctrl + Alt + Delete on a keyboard, sign out of the kiosk account, and sign in as the administrator.

If something is not right