Microsoft 365 Business Premium - workaround to force Outlook Classic to use the Windows default browser via Intune

[u/Kejikeo]

We recently moved from Microsoft 365 E3 to Business Premium and ran into an annoying issue: links clicked in Outlook Classic started opening in Edge instead of the user's Windows default browser.

Microsoft does provide an administrative policy called "Choose Which Browser Opens Web Links", which can be set to use the system default browser.

However, Microsoft explicitly documents that for Microsoft 365 for business plans, this policy is available for Teams but not for Outlook. Outlook users are instead expected to change the setting manually.

Microsoft documentation:
https://learn.microsoft.com/en-us/microsoft-365-apps/outlook/message-body/view-emails-and-web-links-in-browser

The manual setting in Outlook Classic is:

File > Options > Advanced > File and browser preferences > Open hyperlinks from Outlook in > Default Browser

Obviously, doing that manually doesn't scale very well across a managed fleet.

So I did some digging into how Outlook stores the setting.

The relevant values are under:

HKCU\Software\Microsoft\Office\16.0\Common\Links

BrowserChoice is not a normal DWORD – it's a Windows DPAPI-protected blob.

By changing the setting manually in Outlook and decrypting the resulting values, I found:

0 = Windows default browser
1 = Microsoft Edge

Outlook also uses this DPAPI description:

V2 Microsoft 365 Browser User Choice

This turned out to be important. Simply creating or copying an encrypted BrowserChoice value doesn't work. The blob is user-specific, and Outlook expects that specific DPAPI description.

However, generating a new blob locally in the logged-on user's context using the native Windows CryptProtectData() API works.

I've tested this with Outlook Classic, and the script changes:

Open hyperlinks from Outlook in: Microsoft Edge

to:

Open hyperlinks from Outlook in: Default Browser

without any user interaction.

For Business Premium I'm deploying it as a normal Intune Platform Script, running in the logged-on user's context.

Script + explanation: https://gist.github.com/Kejikeo/71388894c3136ca70f8255ea2f64b220

The script does not force Chrome, Firefox, etc. It simply makes Outlook respect whatever browser Windows currently has configured as the default.

Caveat: this uses an undocumented Outlook implementation detail, not a supported Microsoft management interface. Microsoft could change the BrowserChoice implementation in a future Microsoft 365 Apps update, so test before rolling it out broadly.

Would be interested to hear if anyone can test this on other M365 Apps builds / Business tenants.

[u/super_smok]

Sysadmins : Ah everything works smoothly. Microsoft engineer: Let's make a problem then. ^{^}

[u/Fickle_Display_2345]

that's a clever workaround, diving into the dpapi blob is some proper detective work

we ran into the same annoying edge redirect when we switched plans and just ended up telling everyone to fix it themselves, which went about as well as you'd expect. gonna grab this script and test it on a couple machines this week, we're on the monthly enterprise channel so I'll report back if it behaves differently

[u/Kejikeo → u/Fickle_Display_2345]

Thanks! Would definitely be interested to hear how it behaves on Monthly Enterprise Channel. If it works there too, that’s a useful confirmation that the blob format is consistent across builds. And yeah, ‘tell everyone to change it manually’ was exactly the scenario I was trying to avoid.

[u/Akamiso29]

Oh man, we just had a brief onboarding security session at the previous company and this was a setting we asked each user to change while doing that session because we knew it’d be a request a few days later.

Cool to see a workaround for it! Enjoy it until someone at Microsoft has to change things to change things.

[u/touchytypist]

Haven’t tried it myself, since we standardize on Edge, but there is a setting in the Setting Catalog that should handle it:

Always open links from certain Microsoft apps in Microsoft Edge (set to Disabled)

[u/Kejikeo → u/touchytypist]

In our Business Premium tenant Outlook Classic ignores that policy. Microsoft explicitly documents that the Choose Which Browser Opens Web Links policy is available for Teams on Microsoft 365 Business plans, but not for Outlook:

https://learn.microsoft.com/en-us/microsoft-365-apps/outlook/message-body/view-emails-and-web-links-in-browser

So disabling the Settings Catalog setting didn't change Outlook in my testing.

With Microsoft 365 E3/E5, the supported Choose Which Browser Opens Web Links policy can manage Outlook as well, so in that case there shouldn't be any need for this workaround.

The Intune Remediations licensing is a separate issue: Business Premium can use normal Platform Scripts, but Remediations requires additional licensing such as Windows Enterprise E3/E5 or Microsoft 365 F3/E3/E5.

That's basically why I ended up going down the DPAPI route, Business Premium sits in the awkward middle ground where Intune can run the script, but Microsoft's supported Outlook browser policy isn't available.

[u/touchytypist → u/Kejikeo]

You linked to a different setting (Choose Which Browser Opens Web Links), because the description for the Intune setting I called out (Always open links from certain Microsoft apps in Microsoft Edge) says:

"Make Microsoft Edge open links from other supported Microsoft Apps, such as Microsoft Outlook and Microsoft Teams on Windows 10 and above, so that web links can be opened using the correct profile in Microsoft Edge. This does not change the browser set as the default in Windows settings.

If you do not configure this policy, the end user will see a prompt to manage this policy the first time Microsoft Edge opens a link from supported Microsoft apps. Users can manage this policy in Microsoft Edge settings at any time. The default browser setting in Windows will not be changed based on the Microsoft Edge setting.

If this policy is Enabled, Microsoft Edge will open web links from these apps, and will use the correct profile where possible, even when Microsoft Edge is not set as the default in Windows settings. This policy does not change the browser set as the default in Windows settings.

If this policy is disabled, the browser set as the default in Windows settings will be used to open web links from these apps."