How to Configure DNS over HTTPS (User Context) with Microsoft Intune

This article explains how to use Microsoft Intune to configure DNS over HTTPS (DoH) with user context in Windows browsers by deploying the provided Win32 app, Install-SecureEdgeBrowserDoHTask.intunewin. The script updates device browser DNS settings and applies the SecureEdge DNS over HTTPS template at the user level.

The following files are required:

Step 1. Retrieve the Template “DNS over HTTPS URL (User Context)”

Go to https://se.barracudanetworks.com and log in with your existing Barracuda Cloud Control account.
The chosen Tenant/Workspace is displayed in the top menu bar.
From the drop-down menu, select the workspace your location should be assigned to.
In the left menu, click the Infrastructure icon and select DNS Locations.
The DNS Locations page opens.
On the DNS Locations page, click the icon of three vertical dots next to your selected DoH location.
To view DNS setup, click View DNS Setup.
The Location DNS Setup page opens. Click the clipboard icon to copy the DoH (User Context). You need this value in Step 2.

For more information, see How to Add a DNS Location in SecureEdge.

Step 2. Create the Windows app (Win32)

In the Microsoft Intune admin center, go to Apps > Windows.
In the Windows apps tab, click + Create.
The Select app type window opens. Select Windows app (Win 32) from the drop-down menu and click Select.
The Add App window opens. Click Select app package file.
Upload the “Install-SecureEdgeBrowserDoHTask.intunewin” file and click Ok.
On the App information tab, specify the values for the following:
- Name – Enter a name e.g., SecureEdge Browser DoH.
- Description – Enter a brief description, such as SecureEdge Browser DoH.
  Under Preview, enter SecureEdge Browser DoH.
- Publisher – Enter your organization e.g., Barracuda Networks.
On the Program tab, specify the values for the following:
- Install command – Enter install command e.g., powershell.exe -NoProfile -ExecutionPolicy Bypass -File Install-SecureEdgeBrowserDoHTask.ps1 -Template <"https://dns.example.com/dns/xxx/user/<user_email>/dns-query">
  Note: In the Install command, enter the “DNS over HTTPS URL (User Context)” template retrieved in Step 1 after the -Template parameter.
- Uninstall command – Enter uninstall command e.g., powershell.exe -NoProfile -ExecutionPolicy Bypass -File Uninstall-SecureEdgeBrowserDoHTask.ps1
- Uninstall behavior – Ensure that System is selected.
- Device restart behavior – Select No specific action from the drop-down menu.
Click Next.
On the Program tab, specify the values for the following:
- Check operating system architecture – Select Yes and check the box Install on x64 system.
- Minimum operating system – Select minimum operating system. E.g., Windows 11 21H2.
Click Next.
On the Detection rules tab, specify values for the following:
- Rules format – Select Use a custom detection script.
- Script file – Upload the “Detect-Win32-SecureEdgeBrowserDoHTask.ps1".
- Run script as 32-bit Select – Select No.
- Enforce signature check – Select No.
Click Next.
On the Dependencies and Supersedence tab, skip them and click Next.
On the Assignments tab, assign the script to the required device group.
Click +Add group, add the group and click Select. Click Next.
On the Review + create tab, review the configuration, and click Create.
You can see application “SecureEdge Browser DoH” created successfully.

Step 3. Verify on the Device

Verify while signed in as the target user of the DoH script deployment, not as an administrator.

To sync the device:

Go to Settings > Accounts > Access work or school > Info, and select Sync. Then sign in as the target user to apply the task at logon.

To verify browser policy:

Go to system Registry Editor, HKEY_CURRENT_USER > Software > Policies.
At the top menu, select View and click Refresh.
Open the Browser:
- Chrome
  - Open the Chrome browser and enter chrome://policy. Click Reload policies.
  - Open Settings and search for "dns". Ensure it is not user-configurable. Try accessing a known blocked site to verify the policy is applied.
- Edge
  - Open the Edge browser and enter edge://policy. Click Reload policies.
  - Open the browser Settings page and search for “dns”. Ensure it is not user-configurable as shown below.
  - To verify that the policy has been applied, try accessing a known blocked website. You will see the warning “Your connection isn’t private.” Select Advanced to continue; access to the website will remain blocked.

Logs

To confirm DNS requests use SecureEdge, review the logs as follows:
Logs are stored in the following directory: C:\ProgramData\Barracuda\SecureEdge Browser DoH