Journalist 
Yes, you add a site to IE mode in Edge by configuring the Enterprise Mode Site List and enabling IE mode for your Edge deployment. In this comprehensive guide, you’ll learn how Edge IE mode works, how to add legacy sites to the IE mode list, and how to run these sites securely behind a VPN. This is especially useful for teams that still rely on older internal apps, intranets, or line-of-business tools that haven’t been modernized yet. I’ll walk you through practical, real-world steps, plus troubleshooting tips, best practices for VPN integration, and a quick list of tools and resources to keep your deployment smooth.
If you’re configuring IE mode for secure remote work, a reliable VPN is essential. NordVPN can help safeguard remote access to internal apps and intranets when used in combination with Edge IE mode. For a limited time, you can take advantage of NordVPN 77% OFF + 3 Months Free.
In this article, you’ll get:
- A plain-English explanation of Edge IE mode and why it matters for legacy apps
- Step-by-step instructions to add sites to the Enterprise Mode Site List XML and publish it via policy
- How to configure Edge to load the site list, plus tips for VPN integration and remote access
- Real-world tips for reliability, performance, and security
- A solid FAQ with practical answers to common concerns
Before we dive in, here are some useful resources you may want to bookmark these are plain-text URLs, not clickable:
- Microsoft Edge IE mode documentation – docs.microsoft.com/en-us/microsoft-edge/
- Enterprise Mode Site List documentation – docs.microsoft.com/en-us/enterprise-mobility-security/ie-mode
- Windows Group Policy reference – learn.microsoft.com/en-us/windows-server/group-policy/
- Microsoft Edge policy list for enterprises – learn.microsoft.com/en-us/microsoft-edge/policy
- VPN best practices for remote workers – blogs or whitepapers from major vendors
- Enterprise VPN deployment guides – vendor-specific docs for NordVPN Teams or other enterprise VPNs
What is Edge IE mode and why it matters for VPN-enabled environments
Edge IE mode is a compatibility feature built into the Edge browser that lets you run certain legacy IE11-based sites inside Edge. Instead of launching the full Internet Explorer app, Edge renders those sites using the IE rendering engine while preserving Edge’s modern security surface, updates, and user experience. This is especially useful in organizations that still rely on internal apps, intranets, or website-based tools that were designed for IE11.
Key concept: you don’t flip a switch on a single site in the browser. Instead, you publish an Enterprise Mode Site List a centralized XML file that tells Edge which sites should load in IE mode. The client devices then fetch this list usually via policy and automatically render those sites in IE mode when visited. If you’re using a VPN, you’ll want to make sure those internal sites are reachable through the VPN tunnel and that DNS resolution works correctly for those addresses from remote endpoints.
Body
How IE mode works in Edge: core concepts you need to know
- IE mode is not a separate browser. it’s a rendering mode inside Edge that allows IE11-compatible sites to display and behave correctly.
- The Enterprise Mode Site List is the brain of the operation. It’s a centrally managed XML file that maps URLs to IE mode, as well as other compatibility settings.
- Deployment is IT-led. Most organizations use Group Policy for Windows, Microsoft Intune, or another MDM to point Edge clients to the site list URL.
- VPN integration matters because many IE mode sites are internal. Remote users must connect to the corporate VPN before attempting to load those internal sites to avoid DNS and access issues.
Prerequisites: what you need before you start
- Microsoft Edge installed on Windows 10/11 devices enterprise or managed devices recommended
- An IT policy mechanism: Group Policy GPO or Microsoft Intune MDM to push the Enterprise Mode Site List URL
- A hosted Enterprise Mode Site List XML accessible by endpoints internal URL, intranet path, or cloud-hosted
- Permission to publish and manage the site list IT/admin role
- A VPN solution for remote users e.g., NordVPN for Business, ExpressVPN for Teams, Cisco AnyConnect, etc.
- DNS that resolves internal hosts from remote locations, ideally with split-tunnel or full-tunnel VPN depending on your security posture
Step-by-step: how to add a site to IE mode
- Decide which sites belong in IE mode
- Identify legacy apps and intranet portals that require IE11 rendering
- Confirm with product owners or IT that the site should be opened in IE mode
- Create or update the Enterprise Mode Site List XML
- Use a simple XML schema the real schema is defined by Microsoft. this is a practical example
- Example snippet:
- Save the file with a clear name, e.g., enterprise-site-list.xml
- Host the site list so endpoints can reach it
- Put the XML on a web server in your intranet, or in a cloud service with proper access control
- Ensure the URL is reachable by all endpoints, including VPN-connected users
- Set proper permissions so only IT can update the file
- Configure Edge to load the site list
Option A: Group Policy Windows
- Open Group Policy Management Console GPMC
- Navigate to Computer Configuration -> Administrative Templates -> Microsoft Edge -> Configure the Enterprise Mode Site List
- Enable and specify the URL to your enterprise-site-list.xml
Option B: Microsoft Intune / MDM - Create a device configuration profile for Edge policies
- Set the policy for EnterpriseModeSiteList to the URL of your site list
Option C: Manual override for testing - In Edge, open edge://settings/?search=IE mode
- This is typically for testing. production should rely on policy-based deployment
- Verify that Edge loads IE mode for the target sites
- On a test device, connect to VPN if your site resides behind VPN
- Visit the legacy URL and confirm Edge renders it in IE mode
- Check the Edge context menu for “Open in Internet Explorer mode” for a manual fallback if supported by your policy
- Manage updates to the site list
- Plan a process for updating URLs, removing deprecated apps, and versioning the list
- Re-publish and propagate the updated site list via GPO/Intune as soon as changes are made
- Monitor endpoints to confirm the updated list is being applied
How to handle VPN integration with IE mode sites
- VPN is the primary access control for internal sites. Ensure all endpoints, whether on- or off-network, have a VPN configuration that routes traffic to internal resources.
- Decide on tunneling mode:
- Full-tunnel VPN routes all traffic through the corporate network, simplifying DNS and access but potentially adding latency.
- Split-tunnel VPN routes only the internal traffic through VPN, preserving local internet access for non-corporate sites—this is common but requires careful DNS configuration to prevent leaks.
- DNS awareness:
- Edge IE mode relies on proper DNS resolution for internal domains. When users are on VPN, ensure DNS servers provided by VPN resolve internal names correctly.
- Consider adding internal DNS suffix search lists to keep lookups predictable.
- Security posture:
- Keep the VPN client up to date and enforce multi-factor authentication for VPN access.
- Monitor for IE mode-related vulnerabilities, and ensure Windows and Edge receive timely security updates.
- Limit the scope of IE mode to only trusted internal sites. avoid broad exposure to untrusted sites through IE mode.
VPN considerations for IE mode deployments: best practices
- Use a VPN that supports per-app or per-site controls where possible, to limit exposure if a legacy site has vulnerabilities.
- Prefer an always-on VPN for enterprise devices to minimize downtime if a user returns to the office or intermittently disconnects.
- Implement firewall rules that restrict access to internal apps to VPN-connected devices only.
- Enforce endpoint security policies antivirus, EDR, etc. to protect the Edge process and the IE mode render path.
- Regularly audit the Enterprise Mode Site List to remove stale entries and verify that all listed sites still require IE mode.
Security and compliance: what to watch for with IE mode
- IE mode runs IE11 rendering, which has a different security surface than Edge. Limiting the sites to those absolutely necessary helps reduce risk.
- Keep the Enterprise Mode Site List tightly controlled and versioned. publish changes through proper change management.
- If a legacy site uses outdated crypto or weak TLS, mitigate by applying server-side fixes where possible, and consider compensating controls like network segmentation and strict access controls.
- Document the usage policy for IE mode, including which users can access which sites and under what conditions e.g., VPN connected, device compliant.
Troubleshooting common IE mode issues
- Issue: Site not loading in IE mode
- Check that the site URL is present in the Enterprise Mode Site List and that the list is reachable by the endpoint.
- Verify Edge policy is correctly pointing to the site list URL and that policy has been applied on the device.
- Ensure the end-user is connected to the VPN if the site is internal.
- Issue: Edge ignores the site list
- Confirm policy applies to the right user or device group.
- Check for policy conflicts with other Edge settings that might override the site list.
- Review event logs or MDM/GPO reporting to confirm policy fetch status.
- Issue: IE mode rendering issues on specific sites
- Some modern sites may degrade gracefully in Edge, but the legacy app may rely on specific IE11 behaviors. Validate with the site owners and adjust the site’s compatibility mode if needed.
- Test on a local intranet browser in a lab environment to isolate whether the issue is site-specific or policy-related.
- Issue: VPN drop or DNS resolution failures
- Confirm VPN is active and split-tunnel or full-tunnel settings are applied as intended.
- Check DNS server configuration on the VPN and ensure internal domains are resolvable when connected.
Best VPNs for Edge IE mode deployments enterprise-friendly
- NordVPN for Business recommended for remote access to internal apps with a strong security track record
- ExpressVPN for Teams well-known for reliability and cross-platform support
- Cisco AnyConnect Secure Mobility enterprise-grade, widely deployed
- Palo Alto GlobalProtect robust policy enforcement and security controls
- Proton VPN for Business privacy-focused with strong security features
- Perimeter 81 or OpenVPN Access Server easy-to-manage remote access with VPN integration
Note: In this guide, you’ll frequently see NordVPN’s business-focused offering mentioned as a practical option for secure remote access when employees need to reach internal IE-mode websites. If you’re evaluating VPNs, consider how easy it is to deploy at scale, how it handles DNS, and whether it supports split-tunneling with consistent policy enforcement.
Testing and validation: quick checklists to ensure everything works
- Confirm that the IE mode site list is loaded on a test device via policy
- Connect to VPN and verify that the legacy site loads in IE mode
- Validate that non-IE-mode sites render correctly in Edge
- Verify that users with split-tunnel VPN can still access internal sites without leaking traffic
- Run periodic security scans on endpoints to detect any vulnerabilities in the legacy rendering path
Real-world tips and pitfalls to avoid
- Start small: add a single critical legacy site to the Enterprise Mode Site List and validate the flow end-to-end before expanding.
- Keep a changelog for site list updates to help IT staff track changes and rollbacks.
- Test on a mix of Windows versions in your environment to catch any policy differences between Windows 10 and Windows 11 devices.
- Document fallback procedures: what happens if the site can’t load in IE mode? Is there a manual IE path or a direct URL that bypasses IE mode?
- Ensure training for helpdesk staff so they can quickly diagnose issues related to IE mode and VPN connectivity.
Frequently Asked Questions
What is Edge IE mode?
Edge IE mode is a compatibility feature in Microsoft Edge that renders certain legacy IE11-based websites inside the Edge browser, using the IE11 rendering engine while preserving modern Edge security and features.
How do I add a site to IE mode in Edge?
You do this by creating and hosting an Enterprise Mode Site List XML and then configuring Edge to load that site list via Group Policy or Intune. The sites listed with IE mode enabled will render in IE mode when visited. Edge vpn extension for chrome: the complete guide to using Chrome-style VPN extensions in Edge and Chrome
Do I need admin rights to configure IE mode?
Yes. Configuring the Enterprise Mode Site List, hosting the XML, and applying Edge policies typically requires IT administrator privileges.
Can I use IE mode without a VPN?
If the legacy site is internal and not exposed to the public internet, you’ll typically need a VPN to reach it securely. IE mode itself is about rendering the site. VPN ensures you can access the internal network where the site resides.
How do I create the Enterprise Mode Site List?
Create an XML file that lists the sites and their compatibility mode IE11 or similar. Host this file at a URL endpoints can reach, then configure Edge to load it via policy.
How does VPN interact with IE mode?
VPN provides secure remote access to the internal network hosting the legacy sites that require IE mode. DNS and routing must be configured so that VPN-connected endpoints can resolve and reach those sites.
What if a site doesn’t render correctly in IE mode?
First, verify it’s correctly listed in the site list and the enterprise policy is applied. Then check the site’s compatibility needs. Some sites may require tweaks in server-side settings or a different compatibility level. F5 edge client ssl vpn setup, configuration, and best practices for secure enterprise remote access in 2025
How do I update the Enterprise Mode Site List?
Edit the XML, publish the new version on your hosting location, and push the updated URL via GPO/Intune. Ensure endpoints fetch the latest policy and restart Edge if necessary.
Can I disable IE mode for a site?
Yes. Remove the site from the Enterprise Mode Site List or adjust its compatibility mode so Edge stops forcing IE mode for that URL.
Is IE mode secure for modern corporate use?
IE mode provides safer compatibility by isolating legacy rendering within Edge, but it does involve IE11’s legacy engine. Limit exposure to only necessary sites, enforce strict policy, and keep endpoints patched to minimize risk.
How do I test IE mode deployment end-to-end?
Set up a test device, connect via VPN, apply the policy pointing to the site list, open a legacy URL, and verify that it renders in IE mode. Check policy fetch status, DNS resolution, and Edge’s IE mode badge to confirm the rendering mode is active.
What are the best practices for maintaining IE mode at scale?
- Centralize management via GPO/Intune and version control for the site list.
- Limit the scope to necessary internal apps and intranets.
- Regularly review and remove outdated entries.
- Use VPN with strong security controls and monitor access patterns to internal resources.
- Keep Edge and Windows patched to minimize vulnerabilities in the rendering path.
- Document your process thoroughly so helpdesk can respond quickly to site-specific issues.
End of article note
If you found this guide helpful for Edge add site to ie mode in Edge and VPN deployment, consider sharing it with your IT team or colleagues who manage a mix of legacy apps and modern browsers. For more tutorials like this, stay tuned to our VPNs category, where we break down enterprise-ready setups, security considerations, and practical steps you can actually implement in a busy IT environment. Best vpn for microsoft edge reddit