The list of domains media autoplay allows must be allowlisted if used.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-251694 | EDGE-00-000064 | SV-251694r960963_rule | CCI-000381 | low |
| Description | ||||
| Define a list of sites, based on URL patterns, that are allowed to autoplay media. If this policy is not configured, the global default value from the AutoplayAllowed policy (if set) or the user's personal configuration is used for all sites. EDGE-00-000024 disables the AutoplayAllowed policy. | ||||
| STIG | Date | |||
| Microsoft Edge Security Technical Implementation Guide | 2025-05-15 | |||
Related Frameworks
3 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
CM-7
1.00
- DISA · 2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1711 mapping
3.4.6
1.00
- DISA · 2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000381
1.00
- DISA · 2 · disa_xccdf · related
Details
Check Text (C-251694r960963_chk)
If this machine is on SIPRNet, this is Not Applicable.
This requirement for "AutoplayAllowlist" is not required; this is optional.
The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Allow media autoplay on specific sites" may be set to "allow" for allowlisted domains.
Use the Windows Registry Editor to navigate to the following key:
HKLM\SOFTWARE\Policies\Microsoft\Edge
AutoplayAllowlist may be set as follows:
HKLM\SOFTWARE\Policies\Microsoft\Edge\AutoplayAllowlist\1 = mydomain.com
HKLM\SOFTWARE\Policies\Microsoft\Edge\AutoplayAllowlist\2 = myagency.mil
If configured, the list of domains for which autoplay is allowed may be allowlisted.
Fix Text (F-55085r808527_fix)
The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/Allow media autoplay on specific sites" may be set to "allow" for allowlisted domains.