diff --git a/microsoft-edge/toc.yml b/microsoft-edge/toc.yml index e391b10cc7..5c40edd95d 100644 --- a/microsoft-edge/toc.yml +++ b/microsoft-edge/toc.yml @@ -2357,7 +2357,7 @@ href: ./webview2/concepts/distribution.md - name: Enterprise management of WebView2 Runtimes - href: ./webview2/concepts/enterprise.md + href: ./webview2/concepts/enterprise.md # todo: move to Admin docs repo per AB#63688884 displayName: Manage WebView2 applications # old title - name: Distribute an app as a single executable file diff --git a/microsoft-edge/webview2/concepts/enterprise.md b/microsoft-edge/webview2/concepts/enterprise.md index 4f33d5e009..d0ddc60c09 100644 --- a/microsoft-edge/webview2/concepts/enterprise.md +++ b/microsoft-edge/webview2/concepts/enterprise.md @@ -1,31 +1,41 @@ --- title: Enterprise management of WebView2 Runtimes -description: How IT admins can manage WebView2 applications and the WebView2 Runtime. +description: How IT Administrators can manage WebView2 applications and the WebView2 Runtime. author: MSEdgeTeam ms.author: msedgedevrel ms.topic: article ms.service: microsoft-edge ms.subservice: webview -ms.date: 11/12/2021 +ms.date: 08/21/2026 --- # Enterprise management of WebView2 Runtimes + -This article discusses how IT admins can manage WebView2 applications and the WebView2 Runtime. A developer can integrate the WebView2 component into their app, and then deploy the self-updating Evergreen WebView2 Runtime (along with the app) onto user devices, to power the latest WebView2 features of the app and get the latest security improvements. +IT Admins can use group policy objects (GPO) to configure policy settings for WebView2, to manage WebView2 applications and the WebView2 Runtime. The following policies are relevant to WebView2. -Feedback from IT admins and developers is welcome, through the [WebView2Feedback](https://github.com/MicrosoftEdge/WebViewFeedback) repo. +Many policies are about updating the WebView2 Runtime. A developer can integrate the WebView2 component into their app, and then deploy the self-updating Evergreen WebView2 Runtime (along with the app) onto user devices, to power the latest WebView2 features of the app and get the latest security improvements. +Feedback from IT Admins and developers is welcome, through the [WebView2Feedback](https://github.com/MicrosoftEdge/WebViewFeedback) repo. - -## Group policies for WebView2 - -IT admins can use group policy objects (GPO) to configure policy settings for WebView2. The following policies are relevant to WebView2. +**Detailed contents:** +* [Update policies](#update-policies) + * [Suppressing WebView2 Runtime updates](#suppressing-webview2-runtime-updates) + * [Evergreen Runtime is recommended, rather than a fixed version](#evergreen-runtime-is-recommended-rather-than-a-fixed-version) + * [Rapid Response to Chromium vulnerabilities](#rapid-response-to-chromium-vulnerabilities) + * [Microsoft Edge Lifecycle Policy](#microsoft-edge-lifecycle-policy) +* [WebView2-specific policies](#webview2-specific-policies) + * [Downgrading the WebView Runtime to an earlier version](#downgrading-the-webview-runtime-to-an-earlier-version) +* [Browser policies](#browser-policies) +* [Windows Server Update Services (WSUS)](#windows-server-update-services-wsus) + * [WebView2 deployment and update using Configuration Manager](#webview2-deployment-and-update-using-configuration-manager) +* [See also](#see-also) - -#### Update policies + +## Update policies -[Microsoft Edge - Update policies](/deployedge/microsoft-edge-update-policies) are available for IT admins to manage the installing and updating aspects of the WebView2 Runtime. The Microsoft Edge browser and WebView2 Runtime are updated using the same update mechanism. The policy applies to both Microsoft Edge and the WebView2 Runtime, unless the policy is channel-specific, such as [Update](/deployedge/microsoft-edge-update-policies#update) and [Update (WebView)](/deployedge/microsoft-edge-update-policies#update-webview). +[Microsoft Edge - Update policies](/deployedge/microsoft-edge-update-policies) are available for IT Admins to manage the installing and updating aspects of the WebView2 Runtime. The Microsoft Edge browser and WebView2 Runtime are updated using the same update mechanism. The policy applies to both Microsoft Edge and the WebView2 Runtime, unless the policy is channel-specific, such as [Update](/deployedge/microsoft-edge-update-policies#update) and [Update (WebView)](/deployedge/microsoft-edge-update-policies#update-webview). To configure update policies for Microsoft Edge (and the WebView2 Runtime), see [Configure Microsoft Edge policy settings on Windows devices](/deployedge/configure-microsoft-edge), in the Microsoft Edge Enterprise documentation. @@ -33,7 +43,7 @@ To configure update policies for Microsoft Edge (and the WebView2 Runtime), see #### Suppressing WebView2 Runtime updates -An IT admin can suppress updating of the WebView2 Runtime, if auto-updating needs to be suppressed for a short time. After the time period, updating of the WebView2 Runtime resumes. The [UpdatesSuppressed](/deployedge/microsoft-edge-update-policies#updatessuppressed) policy allows an IT admin to set the time during each day at which to suppress auto-update for both Microsoft Edge and the WebView2 Runtime. This enables an IT admin to configure preferences and proxies once for both the browser and the WebView2 Runtime, to control their network bandwidth and traffic, or for other purposes. +An IT Admin can suppress updating of the WebView2 Runtime, if auto-updating needs to be suppressed for a short time. After the time period, updating of the WebView2 Runtime resumes. The [UpdatesSuppressed](/deployedge/microsoft-edge-update-policies#updatessuppressed) policy allows an IT Admin to set the time during each day at which to suppress auto-update for both Microsoft Edge and the WebView2 Runtime. This enables an IT Admin to configure preferences and proxies once for both the browser and the WebView2 Runtime, to control their network bandwidth and traffic, or for other purposes. However, users should not stop updating their WebView2 Runtime; users should not remain on an older version of the WebView2 Runtime. Using older versions of the WebView2 Runtime isn't recommended. Security updates and servicing updates are only available on the latest Stable channel release (Edge Stable) and the latest Beta channel release (Edge Beta). If you use older releases of the Microsoft WebView2 Runtime, you won't receive the latest quality and security updates. @@ -74,24 +84,32 @@ See: * [Microsoft Edge Lifecycle Policy](/deployedge/microsoft-edge-support-lifecycle), in the Microsoft Edge Enterprise documentation. + +## WebView2-specific policies + +[Microsoft Edge WebView2 - Policies](/deployedge/microsoft-edge-webview-policies) are available to IT Admins, to manage WebView2 directly. Generally, we recommend that WebView2 app developers implement their own group policies to manage the use of WebView2, because it's easier for IT Admins to manage the app instead of managing WebView2 directly. + + -#### Browser policies +#### Downgrading the WebView Runtime to an earlier version -[Microsoft Edge - Policies](/deployedge/microsoft-edge-policies) doesn't apply to WebView2 applications. This is by design, because apps and browsers have different use cases, and IT admins might not be aware of what applications use WebView2. +The Enterprise Downgrade feature is controlled via the `DowngradeVersion` policy. Enterprise Downgrade is a temporary, IT Admin-controlled capability that allows a specific WebView2 app to revert to using an earlier version of the WebView2 Runtime. This policy is useful if there's a critical regression in the WebView2 app when using the latest version of the WebView2 Runtime. -Applying browser policies on WebView2 would have unintended consequences. For example, IT admins can block JavaScript in the browser, and that would break WebView2 apps that use JavaScript. To prevent that, browser policies are separate from WebView2 policies. +See [Downgrade the WebView2 Runtime to an earlier version](/deployedge/webview2-downgrade-runtime). - -#### WebView2-specific policies + +## Browser policies + +[Microsoft Edge - Policies](/deployedge/microsoft-edge-policies) doesn't apply to WebView2 applications. This is by design, because apps and browsers have different use cases, and IT Admins might not be aware of what applications use WebView2. -[Microsoft Edge WebView2 - Policies](/deployedge/microsoft-edge-webview-policies) are available to for you to manage WebView2 directly. However, we recommend that WebView2 app developers implement their own group policies to manage the use of WebView2, because it's easier for administrators to manage the app instead of managing WebView2 directly. +Applying browser policies on WebView2 would have unintended consequences. For example, IT Admins can block JavaScript in the browser, and that would break WebView2 apps that use JavaScript. To prevent that, browser policies are separate from WebView2 policies. ## Windows Server Update Services (WSUS) -Windows Server Update Services (WSUS) enables IT admins to deploy the latest Microsoft product updates. You can use WSUS to fully manage the distribution of updates of WebView2 that are released through Microsoft Update to computers on your network. +Windows Server Update Services (WSUS) enables IT Admins to deploy the latest Microsoft product updates. You can use WSUS to fully manage the distribution of updates of WebView2 that are released through Microsoft Update to computers on your network. See [Windows Server Update Services (WSUS) overview](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus). @@ -112,6 +130,7 @@ See [Update Microsoft Edge](/intune/configmgr/apps/deploy-use/deploy-edge#update * [Distribute your app and the WebView2 Runtime](./distribution.md) - Evergreen vs. fixed version of the WebView2 Runtime. +* [Downgrade the WebView2 Runtime to an earlier version](../how-to/enterprise-downgrade.md) Microsoft Edge Enterprise documentation: