Proxy override rules

Supported versions

• Windows: ≥ 145
• macOS: ≥ 145
• Android: Not supported
• iOS: Not supported

Description

This policy enables rule-based proxy selection that determines which proxy Microsoft Edge uses based on the destination URL and any other conditions you define.

When this policy is configured, it takes precedence over proxy settings configured by the ProxySettings policy, the Edge.proxy extension API, and any manual user settings.

If this policy is disabled or not configured, existing proxy policies and user-defined settings continue to apply.

When Edge selects a proxy, it evaluates entries in the ProxyOverrideRules policy in order. A rule is considered a match when all the following conditions are met:

• At least one URL pattern in DestinationMatchers is matched.
• No URL pattern in ExcludeDestinationMatchers is matched.
• If Conditions is specified and non-empty, all conditions are satisfied.

For a matching rule, the value specified in ProxyList is used as the proxy. If no rule matches, proxy selection falls back to the settings defined by the ProxySettings policy.

The URL patterns supported by DestinationMatchers and ExcludeDestinationMatchers are documented atProxy Support in Microsoft Edge.Entries in ProxyList correspond to PAC-style proxy strings, such as:

• DIRECT
• PROXY host:port
• HTTPS host:port
• SOCKS4 host:port
• SOCKS5 host:port

Alternatively, URL-form proxy specifiers can be used, for example:

• http://host :port
• https://host :port
• socks4://host:port
• socks5://host:port

The first reachable proxy in the list is used. Invalid entries are ignored.

The Conditions field specifies conditions that must all be met for an override rule to be applied when selecting a proxy. If this field is not set, the rule is applied when at least one host in DestinationMatchers matches.

The DnsProbe condition checks whether the specified DNS Host can be resolved to an IP address. The host must include a hostname (for example, example.com) and can optionally include a scheme or port (for example,https://example.com, example.com:123, orhttps://example.com:123). When a secure scheme (for example, https) is specified, the DNS lookup may also request the HTTPS record (see RFC 9460).

If Result is set to resolved, the condition is met when resolution succeeds. If set to not_found, the condition is met only when resolution fails.

Supported features

• Can be mandatory: Yes
• Can be recommended: No
• Dynamic Policy Refresh: Yes
• Per Profile: Yes
• Applies to a profile that is signed in with a Microsoft account: Yes
• Can only be configured through cloud policy in the Edge management service: Yes

Data type

• Dictionary

Windows information and settings

Group Policy (ADMX) info

• GP unique name: ProxyOverrideRules
• GP name: Proxy override rules
• GP path (Mandatory): Administrative Templates/Microsoft Edge/Proxy server
• GP path (Recommended): N/A
• GP ADMX file name: MSEdge.admx

Example value

[{"Conditions": [{"DnsProbe": {"Host": "corp.ads", "Result": "resolved"}}], "DestinationMatchers": ["https://some.app.com", "https://other.app.org"], "ProxyList": ["HTTPS proxy.app:443", "DIRECT"]}, {"DestinationMatchers": ["https://Contoso.com"], "ExcludeDestinationMatchers": ["https://mail.Contoso.com"], "ProxyList": ["HTTPS proxy.app:443", "DIRECT"]}]

Registry settings

• Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
• Path (Recommended): N/A
• Value name: ProxyOverrideRules
• Value type: REG_SZ

Example registry value

[{"Conditions": [{"DnsProbe": {"Host": "corp.ads", "Result": "resolved"}}], "DestinationMatchers": ["https://some.app.com", "https://other.app.org"], "ProxyList": ["HTTPS proxy.app:443", "DIRECT"]}, {"DestinationMatchers": ["https://Contoso.com"], "ExcludeDestinationMatchers": ["https://mail.Contoso.com"], "ProxyList": ["HTTPS proxy.app:443", "DIRECT"]}]

Expanded example registry value

[  {    "Conditions": [      {        "DnsProbe": {          "Host": "corp.ads",          "Result": "resolved"        }      }    ],    "DestinationMatchers": [      "https://some.app.com",      "https://other.app.org"    ],    "ProxyList": [      "HTTPS proxy.app:443",      "DIRECT"    ]  },  {    "DestinationMatchers": [      "https://Contoso.com"    ],    "ExcludeDestinationMatchers": [      "https://mail.Contoso.com"    ],    "ProxyList": [      "HTTPS proxy.app:443",      "DIRECT"    ]  }]

Mac information and settings

• Preference Key name: ProxyOverrideRules
• Example value:

<key>ProxyOverrideRules</key><array>  <dict>    <key>Conditions</key>    <array>      <dict>        <key>DnsProbe</key>        <dict>          <key>Host</key>          <string>corp.ads</string>          <key>Result</key>          <string>resolved</string>        </dict>      </dict>    </array>    <key>DestinationMatchers</key>    <array>      <string>https://some.app.com</string>      <string>https://other.app.org</string>    </array>    <key>ProxyList</key>    <array>      <string>HTTPS proxy.app:443</string>      <string>DIRECT</string>    </array>  </dict>  <dict>    <key>DestinationMatchers</key>    <array>      <string>https://Contoso.com</string>    </array>    <key>ExcludeDestinationMatchers</key>    <array>      <string>https://mail.Contoso.com</string>    </array>    <key>ProxyList</key>    <array>      <string>HTTPS proxy.app:443</string>      <string>DIRECT</string>    </array>  </dict></array>

See also

• Microsoft Edge - Policies