images/fedora-intune/files/edge-himmelblau-policy.json

@@ -0,0 +1,5 @@
+{
+  "ExtensionInstallForcelist": [
+    "jlnfnnolkbjieggibinobhkjdfbpcohn;https://clients2.google.com/service/update2/crx"
+  ]
+}

images/fedora-intune/files/edge-linux_entra_sso.json

@@ -0,0 +1,9 @@
+{
+    "name": "linux_entra_sso",
+    "description": "Entra ID SSO via Microsoft Identity Broker",
+    "path": "/usr/bin/linux-entra-sso",
+    "type": "stdio",
+    "allowed_origins": [
+        "chrome-extension://jlnfnnolkbjieggibinobhkjdfbpcohn/"
+    ]
+}

images/fedora-intune/microsoft-edge.yaml

@@ -1,7 +1,15 @@
 # Microsoft Edge, from the microsoft-edge repo (repos/microsoft.repo).
 # Conditional Access to Microsoft 365 web apps on Linux requires Edge.
+#
+# Entra SSO in Edge: himmelblau-sso only registers its native messaging host
+# and force-installs the Linux Entra SSO extension for Chrome, Chromium and
+# Firefox. Edge reads /etc/opt/edge, so add the same two files there.
 
 repo-packages:
   - repo: microsoft-edge
     packages:
       - microsoft-edge-stable
+
+add-files:
+  - ["edge-linux_entra_sso.json", "/etc/opt/edge/native-messaging-hosts/linux_entra_sso.json"]
+  - ["edge-himmelblau-policy.json", "/etc/opt/edge/policies/managed/himmelblau.json"]