How to Completely Disable ‘Password Monitor’ via Group Policy in Microsoft Edge

Microsoft Edge includes a built-in feature known as “Password Monitor.” When a user saves passwords in the browser, Password Monitor routinely hashes those credentials and cross-references them against a cloud-based repository of known compromised passwords (maintained by Microsoft) to alert the user if their credentials have been exposed in a data breach. While beneficial for consumers, this feature can present serious compliance and privacy concerns in enterprise environments. Transmitting hashes of corporate credentials—especially those used for sensitive internal portals, financial applications, or legacy intranet sites—outside the organizational boundary to a public cloud telemetry endpoint violates strict Data Loss Prevention (DLP) and zero-trust policies.

This guide explains how to completely disable ‘Password Monitor’ via Group Policy in Microsoft Edge, ensuring that local credential hashes are never uploaded or cross-referenced with external servers.

Disable Password Monitor via Group Policy

To enforce a strict block that disables the feature globally across the browser, we must deploy an administrative template. Note that this requires Windows 11 Pro, Enterprise, or Education editions.

1. Log into Windows 11 with an Administrator account.
2. Press the Windows Key + R to open the Run dialogue box.
3. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.
4. In the left-hand navigation pane, strictly follow this exact path:

   Computer Configuration > Administrative Templates > Microsoft Edge > Password manager and protection

5. In the right-hand pane, locate the policy named Enable Password Monitor (or “Configure Password Monitor”).
6. Double-click the policy to open its configuration window.
7. Select the radio button next to Disabled. (By disabling this policy, we explicitly instruct Edge to terminate the background worker responsible for hashing and transmitting credential data for breach analysis).
8. Click Apply, then click OK.

Verify the Configuration Lockdown

Group Policy changes require the browser to read the registry upon its next launch. Close all active instances of Microsoft Edge. If you wish to force the policy update immediately across the OS, open Command Prompt as Administrator and run gpupdate /force.

To verify the restriction is active, open Microsoft Edge and navigate to Settings > Profiles > Passwords. Under the password management settings, the option for “Show alerts when passwords are found in an online leak” (the user-facing toggle for Password Monitor) will be disabled, greyed out, or completely removed from the UI. A briefcase icon will indicate that “This setting is managed by your organization.” The browser is now cryptographically bound to keep all saved credentials strictly local, preventing unauthorized cloud telemetry aggregation.