Browser Built In AI Features: Governing Gemini in Chrome and Copilot in Edge

The browsers already on every managed desktop now ship generative AI features that read page content, send prompts to a cloud model and, increasingly, act on web pages for the user, and most of them are on unless an administrator decides otherwise. This guide covers the built-in AI features of Google Chrome and Microsoft Edge in managed estates: which policies control them, what the defaults are for enterprise-managed browsers, how to scope page-context access and agentic browsing to the sites you trust, and how to roll a policy baseline out without breaking work. It is written for endpoint, browser and identity administrators, and for the security and privacy teams who must sign off on AI use. Browsers are listed alphabetically by vendor (Google Chrome, then Microsoft Edge), and the order is not a ranking. New AI-first browsers are covered in the Agentic Browsers Security Guide; this page stays with the AI features inside the Chrome and Edge builds you already manage.

Key takeaways

• Set the umbrella policy first. Chrome's GenAiDefaultSettings sets the default for every covered generative AI feature (0 allow and improve models, 1 allow without improving models, 2 do not allow), and per-feature policies then override it where you need an exception.
• Know which data terms apply. Google states that Gemini in Chrome, Google Lens and AI Mode are subject to their own terms rather than the enterprise data guarantees that cover Chrome-built features such as Help me write, so decide on them separately.
• Page context is the real data flow. In Edge, EdgeEntraCopilotPageContext decides whether Copilot in the side pane can read page content, browsing history and video transcripts for Entra ID profiles, and its unconfigured default differs between EU and non-EU regions.
• Agentic browsing needs its own control. Gemini acting on web pages (GeminiActOnWebSettings) and Copilot browser use (CopilotBrowserUseAllowList and CopilotBrowserUseBlockList) are separate policies from the chat features: scope them to low-risk sites before anyone pilots them.
• Policy only binds managed identities. Several Edge Copilot policies do not apply to profiles signed in with a personal Microsoft account, and Gemini in Chrome needs a signed-in Chrome profile, so profile and sign-in control is part of AI governance.

What is built in, and why it differs from shadow AI

Unsanctioned AI usually means a user pasting data into a consumer chatbot tab. Built-in browser AI is different in three ways: the feature is shipped and updated by the browser vendor, it can read the page the user is on without a copy and paste, and it is governed by the same policy channel as the rest of the browser. That last point is the opportunity. You do not need a new agent or proxy to make the first decisions; you need a written position per feature and a policy baseline in Google Admin console, Group Policy, Intune or your macOS profile tool.

The features fall into four groups, and each group carries a different risk:

• Writing and productivity helpers: Chrome's Help me write (HelpMeWriteSettings) and Tab Compare (TabCompareSettings). Google's Help me write admin page lists the data sent, including site information (page content used as context) and user-submitted content (prompts, inputs, outputs and feedback).
• Developer helpers: Chrome DevTools AI features (DevToolsGenAiSettings), which send error messages, stack traces, code snippets and network requests to a Google-hosted model. The Chromium policy definition states that response bodies and authentication and cookie headers are not included, but code snippets from internal applications still leave the device.
• Assistants with page context: Gemini in Chrome (GeminiSettings) and Copilot in the Edge side pane (governed by EdgeEntraCopilotPageContext and Microsoft365CopilotChatIconEnabled). These read the current tab and, in Edge's case, browsing history and video transcripts when allowed.
• Agentic actions: Gemini taking action on web pages (GeminiActOnWebSettings, with URL allow and block lists) and Copilot browser use in Edge (CopilotBrowserUseAllowList and CopilotBrowserUseBlockList). These move from reading to doing: clicking, filling and navigating as the signed-in user.

For the wider data loss picture, including prompts typed into web chatbots, see the Generative AI Data Loss Prevention Guide. For discovering AI tools that bypass the browser channel, see the Shadow AI Discovery Guide.

Google Chrome: the generative AI policy set

Chrome groups its AI controls under a single default policy with per-feature overrides. GenAiDefaultSettings is a cloud-only policy (set in Google Admin console) supported from Chrome 130. The Chromium policy definition gives three values: 0 allows the feature and allows Google to use relevant data to improve its models, which may include human review; 1 allows the feature without using the user's content to improve models; 2 does not allow the feature. The definition states that 1 is the default for enterprise users managed by Google Admin console and for Education accounts managed by Google Workspace, and Google's generative AI features page lists third-party managed browsers and consumers as defaulting to "allow and improve AI models". That difference matters: a Chrome estate managed only through Group Policy or a third-party MDM does not inherit the no-training default that a cloud-managed estate gets.

Some features only support allow or do not allow. For those, GenAiDefaultSettings values 0 and 1 enable the feature and 2 disables it. The table lists the policies an administrator is most likely to set, with values as stated in the Chromium policy definitions.

Three details change the decision. First, Google's Gemini in Chrome admin page says access needs both the Gemini app service setting in Admin console (Generative AI, Gemini integrations) and GeminiSettings to be enabled, so the two must be set consistently. Second, auto browse (Gemini acting on the web) is off by default for managed users and can be enabled through GeminiActOnWebSettings for listed Workspace editions, with GeminiActOnWebAllowedForURLs and GeminiActOnWebBlockedForURLs to scope it. Third, the Lens Overlay policy (LensOverlaySettings) is marked for deprecation from Chrome 147 in favour of SearchContentSharingSettings, so check the current policy list before you script it. AI History Search was removed in Chrome 157 and its policy, HistorySearchSettings, is deprecated.

Data terms: Google's generative AI features page states that, with "allow without improving AI models", customer data is not used to improve Google models, though it may still be sent to Google for the feature to work, and is not used for ads. The same page states that Lens, Gemini Enterprise, Gemini in Chrome and AI Mode are not covered by those enterprise data guarantees and are subject to their own terms. Google's Gemini in Chrome page states that for qualifying Workspace editions existing Workspace protections apply, prompts and responses are not used to train models outside the domain without permission, and the feature is not available in Incognito mode.

Microsoft Edge: the Copilot and generative AI policy set

Edge separates the visible entry point, the page-context data flow and agentic browser use into different policies. All of the desktop policies below are configured under Administrative Templates/Microsoft Edge in MSEdge.admx, written to SOFTWARE\Policies\Microsoft\Edge, and are available as macOS preference keys.

Microsoft's documentation makes several points worth building into the baseline:

• Toolbar control: as of Edge 141, Microsoft365CopilotChatIconEnabled is the only policy that controls Copilot's display in the toolbar. HubsSidebarEnabled controls the Sidebar launcher and is not the Copilot control, so older baselines that relied on hiding the Sidebar need review.
• Page context and DLP: disabling EdgeEntraCopilotPageContext also disables M365LinksAutoOpenCopilotEnabled. Microsoft states that Copilot cannot read page content on pages protected by data loss prevention policies, even when the policy is enabled, which makes your Purview or equivalent DLP labelling part of the control.
• Older policy names: CopilotCDPPageContext and the BrowsingWithCopilot allow and block lists are listed as obsolete in the Edge policy reference. Remove them from baselines and replace them with the current names rather than carrying both.
• Block list syntax: the Copilot browser use lists follow URLBlocklist syntax. A hostname such as contoso.com matches its subdomains, a leading dot matches only that host, and Microsoft states that wildcard forms such as *.contoso.com do not match. A configured but empty allow list allows no URLs.

Where identity fits

Browser AI policy binds to profiles, not people, which makes profile control an identity problem:

• Managed sign-in: EdgeEntraCopilotPageContext, Microsoft365CopilotChatIconEnabled and the Copilot browser use lists do not apply to Edge profiles signed in with a personal Microsoft account. Gemini in Chrome needs a signed-in Chrome profile. If users can add personal profiles on managed devices, they can reach AI features outside your policy and your data terms. Restrict profile sign-in to corporate accounts with the browser's sign-in and profile policies, and treat the Entra ID or Google Workspace account as the boundary.
• Agentic actions use the user's sessions: when Gemini or Copilot acts on a page, it does so with the cookies and tokens in that profile. Keep agentic browsing off for identity provider admin consoles, privileged access tools and finance systems. The Browser Storage Security Guide explains what those sessions hold.
• Admin roles: the Google Admin console role that edits Chrome policy and the Intune role that edits Edge configuration profiles can switch AI features on for the whole estate. Put those roles under privileged access review.

Choosing a position for each feature

A single "AI on" or "AI off" decision is rarely right. Most organisations land on one of four positions per feature, chosen against data classification and the terms that apply.

Small organisations with one browser and one productivity suite should align the browser with the suite: if Microsoft 365 Copilot Chat is the approved assistant, allow it in Edge under Entra ID profiles and block the equivalent in other browsers, and the reverse for Gemini and Google Workspace. Large estates usually need per-group policy: block by default, then allow by organisational unit or Entra ID group for approved users, and keep developer groups separate because DevTools AI sends code. Where an organisation runs both browsers, write one position per feature class and implement it in both, so users cannot move to the other browser to bypass a decision. The AI Usage Control and Shadow AI buyer's guide covers tools that add prompt inspection on top of native policy.

Rolling out a browser AI baseline

1. Inventory current state. Export the effective policy from a sample of devices (chrome://policy and edge://policy show applied values and their source) and from Google Admin console and Intune. Note any feature currently relying on the default and which management channel each device uses, because cloud-managed and third-party-managed Chrome have different defaults.
2. Write the position per feature. Agree with privacy, legal and the data owners which of the four positions applies to each feature, and record the data terms you accepted.
3. Set the umbrella first. In Chrome, set GenAiDefaultSettings to 1 (or 2 for a block-first posture), then set per-feature exceptions. In Edge, set EdgeEntraCopilotPageContext and Microsoft365CopilotChatIconEnabled explicitly rather than relying on regional defaults, and set an empty or restrictive Copilot browser use allow list until a pilot is approved.
4. Pilot ring. Apply the baseline to IT and a business pilot group for two weeks. Check chrome://policy and edge://policy for errors, confirm features appear or disappear as expected, and confirm sensitive internal pages do not offer page summarisation.
5. Agentic pilot separately. Enable Gemini acting on the web or Copilot browser use only for a named group, only on allow-listed public or low-risk sites, and only after you have tested how the block lists match your own domains.
6. Broad deployment. Move by organisational unit or device group. Both browsers support dynamic policy refresh for these policies, so changes apply without a reinstall.
7. Rollback. Keep the previous configuration profile or Admin console state recorded. Rolling back is a policy change: revert the profile, confirm with chrome://policy or edge://policy, and note that GenAILocalFoundationalModelSettings set to 1 in Edge deletes a downloaded model, which users will download again if you revert.

Detection and measurement

Native policy decides what is possible. Monitoring tells you whether the policy is applied and whether users find another route.

• Policy compliance: report on devices where the AI policies are missing or show a non-managed source. Chrome Enterprise reporting and Intune configuration profile status both show per-device state.
• Profile drift: alert on personal profiles signed in on managed devices, since several controls do not apply to them.
• Egress to AI services: secure web gateway or DNS logs for AI service domains show use from unmanaged browsers and from personal profiles.
• Agentic actions: for any agentic pilot, review which sites were used and compare them against the allow list.

Common failure patterns

• Relying on the cloud default in a GPO-managed estate. The no-model-improvement default applies to Chrome managed through Google Admin console. A Chrome estate managed only through Group Policy or a third-party MDM defaults to allowing model improvement unless you set the policies.
• Hiding the icon and calling it done. Hiding Copilot from the toolbar or hiding the Edge Sidebar does not by itself decide page-context access. Set EdgeEntraCopilotPageContext explicitly.
• Trusting regional defaults. EdgeEntraCopilotPageContext behaves differently unconfigured in EU and non-EU regions, so a multinational gets two behaviours from one empty policy.
• Ignoring release notes. New AI features arrive with browser releases and old policies are deprecated (LensOverlaySettings, HistorySearchSettings, the BrowsingWithCopilot lists). Baselines go stale within a few months unless someone reviews each stable release.
• Wildcards that never match. Copying *.contoso.com into the Copilot browser use lists matches nothing according to Microsoft's syntax notes, so the block silently fails.
• Personal profiles on managed devices. Users sign in with a personal account and reach the consumer version of the same feature, outside both the policy and the enterprise data terms.

Framework mapping

For the browser controls behind CIS Control 9, see the CIS Control 9 Email and Web Browser Protections Guide, and for the rest of the hardening baseline see the Browser Security Hardening Guide.

Practitioner checklist

• Record which channel manages each browser (Google Admin console, Group Policy, Intune, third-party MDM), because defaults differ.
• Set GenAiDefaultSettings in Google Admin console, then set per-feature exceptions for Gemini, Help me write, DevTools and AI Mode.
• Keep the Admin console Gemini app setting and GeminiSettings consistent.
• Set EdgeEntraCopilotPageContext and Microsoft365CopilotChatIconEnabled explicitly in every region.
• Keep Gemini acting on the web and Copilot browser use off or allow-listed to low-risk sites; never include identity, privileged access or finance consoles.
• Decide on the local foundational model download in both browsers.
• Restrict browser sign-in to corporate accounts so AI policies and enterprise terms apply.
• Remove obsolete policy names from baselines and review AI policy changes with every stable release.
• Report on policy compliance and personal profiles monthly.

Standards and references

• Google: Gemini in Chrome (Chrome Enterprise and Education Help)
• Google: Generative AI features in Chrome, data and policy defaults
• Chromium: Generative AI policy definitions
• Microsoft Learn: EdgeEntraCopilotPageContext policy
• Microsoft Learn: Microsoft365CopilotChatIconEnabled policy
• Microsoft Learn: CopilotBrowserUseBlockList policy
• Microsoft Learn: GenAILocalFoundationalModelSettings policy
• NIST: SP 800-53 Rev 5, Security and Privacy Controls

Related NHI Mgmt Group resources: Agentic Browsers Security Guide · Generative AI Data Loss Prevention Guide · Enterprise Browser and Browser Security Guide · AI Browser Extensions Security Guide