Block local html files on managed devices

This guide explains how to prevent users from opening local files using the file:// protocol on managed devices. Blocking the file:// protocol closes a common bypass path for URL-based filtering and ensures that users can access only approved web content through monitored browsers and managed network paths.

Before you begin

• You must have administrator access to Google Admin Console, Microsoft Intune admin center, or Jamf.

• You must have administrator access to your school’s managed devices.

Chromebook

Follow these steps to block local files in Chromebook via Google Workspace.

1. Sign in with your Administrator account in the Google Admin console.

2. Go to Devices > Chrome > Settings > Users & browsers.

3. Select the relevant school or organization.

4. Under URL Blocking, find the URL blocklist setting.

5. Add file://*.

6. Save the setting.

Windows

Use Microsoft Intune to create a new policy that adds that same rule to block file://.

Configure Microsoft Edge via Intune

1. In Intune, go to Devices > Manage devices > Configuration and create a new policy.

2. Choose the platform (Windows or macOS).

3. Set the Profile type to Settings catalog and select Create.

4. In the Configuration settings, select Add settings.

5. Search for URLBlocklist.

6. Filter the results to Microsoft Edge and select Block access to a list of URLs (Device).

7. Add file://*

Configure Microsoft Edge using Group Policy

1. Go to Computer configuration > Administrative Templates > Microsoft Edge.

2. Find URLBlocklist

3. Add file://*

Chrome for Windows

Intune includes ADMX import for Chrome by default. However, you can still upload the templates if they’re not available in the Intune admin center. Skip to 2: Configure Chrome if the templates are already in Intune.

1: Upload the templates

1. Download and unzip the free Chrome Enterprise bundle from Google. You’ll need the google.admx and chrome.admx files.

2. In Intune, go to Devices > Configuration > Import ADMX> Import and upload google.admx, followed by chrome.admx.

2: Configure Chrome

1. In Intune, create a new policy in Devices > Manage devices > Configuration.

2. Ensure Windows 10 and later is selected for your Platform.

3. For Profile type, go to Templates > Imported Administrative templates (Preview).

4. In Configuration settings, locate the imported Chrome categories and find Block access to a list of URLs.

5. Add file://* as a blocked pattern, then continue through Scope tags and Assignments as normal.

Chrome for macOS

Deploy a configuration profile containing the com.google.Chrome payload, and set URLBlocklist to ["file://*"].

1. In Jamf, go to Configuration Profiles > New and configure your General payload settings.

2. Go to Application & Custom Settings > Upload > Add and fill in the Preference Domain field.

3. Upload your plist file.

4. Set your Scope and save your settings.

Android

Chrome for Android uses the URLBlocklist managed configuration key, mirroring the desktop browser's behavior.

Intune

1. In the Intune admin center, go to Apps > App configuration policies > Add.

2. Target the Chrome application and define the URLBlocklist configuration key as a String with the value ["file://*"].

Google Workspace

1. Sign in to the Google Admin console and go to Devices > Mobile & endpoints > Settings > Android.

2. Under Managed configurations for Chrome, locate the restriction field and define the restriction key as URLBlocklist.

3. Ensure Value type is set to String.

4. Set Configuration value to [“file://*”]

5. Save your configuration.

Summary