Managed mode

With managed mode, IT decides which websites open in DynBrowser. Every other web address opens in the computer's default browser, under the security rules that already apply there. Users cannot change or switch off managed mode.

DynBrowser stays what it is — a D365 workplace with tabs, the extra features in the D365 screens and DynBrowser's own pages — while other websites, such as mail, open in the browser IT already manages.

What happens

Always allowed, even without a list:

• DynBrowser's own pages, such as the start page;
• the Microsoft sign-in (login.microsoftonline.com and the Microsoft addresses that go with it);
• your own D365 environments, as set in the Microsoft sign-in in the customer portal (see Signing in to D365).

Managed mode also applies to DynBrowser inside ProductieManager.

The three modes

Two ways to start:

• If you already know what may open in DynBrowser, for example only D365, set it to On straight away. Microsoft sign-in and your own D365 environments are always allowed. Do put on the list what D365 itself embeds and you want to keep seeing in DynBrowser, such as Power BI or SharePoint.
• If you first want to see which websites people use in DynBrowser, start with Log only (see Log only first).

The list of websites

Each line is one website:

• Port and path do not count: a website is on the list as a whole or not at all. If you paste a full web address, the portal keeps only the server name.
• Entries that are too broad, such as * or *.com, are refused.
• An empty list is allowed: then only what is always allowed opens in DynBrowser.
• A website that D365 itself embeds, such as Power BI or SharePoint, must also be on the list if you want to see it in DynBrowser. The Log only mode shows which ones they are.

Setting it in the customer portal

1. In the customer portal, open Company settings → DynBrowser settings.
2. Under Managed mode, choose the mode: Off, Log only or On.
3. Fill in the list under Websites that open in DynBrowser.
4. Click Publish….

A published version reaches every workstation where DynBrowser is running within a few minutes, and otherwise at the next start. DynBrowser does not need to restart. Every version is kept in the version history.

The setting from the portal only reaches workstations where someone from your organisation has signed in. If managed mode must also apply before anyone has signed in, set it through Intune.

If you set the mode to Off, the list is kept. That way you can prepare it in advance.

Setting it through Intune or group policy

To manage it per computer, set two values under HKLM\SOFTWARE\Policies\DynSolutionZ\DynBrowser. This is the same place as the one for the company code.

For example with a platform script in Intune (run as system, 64-bit):

$k = 'HKLM:\SOFTWARE\Policies\DynSolutionZ\DynBrowser'
New-Item -Path $k -Force | Out-Null
Set-ItemProperty -Path $k -Name ManagedBrowsing -Value 1 -Type DWord
Set-ItemProperty -Path $k -Name AllowedHosts -Type MultiString -Value @(
    'intranet.yourcompany.com',
    '*.yourcompany.com'
)

• A change takes effect within a few minutes, without restarting DynBrowser.
• Users cannot write to this registry key, so they cannot change the setting.
• Intune wins. If ManagedBrowsing is set on a computer, even to 0, that setting applies on that computer instead of the one from the portal. That way IT always has the last word per workstation.

Log only first

Set managed mode to Log only for a week first, on a few workstations or for everyone. DynBrowser then holds nothing back yet, but writes in its log which websites it would send to the default browser:

[ManagedBrowsing] would open in the default browser: example.com (top)
[ManagedBrowsing] would refuse frame: app.powerbi.com (frame)

• There is one line per website each time DynBrowser starts. The log contains only the name of the website, never the full address.
• (top) and (popup) are addresses the user opens; (frame) is an embedded part of another website.
• At start-up and after every change, DynBrowser writes which setting applies, for example [ManagedBrowsing] policy (portal): Audit, 4 allowed host rule(s). portal or workstation tells you where the setting comes from.

The log is in logs\<computer name>\<date>.log in the installation folder (see Troubleshooting). If DynBrowser runs from a shared folder, the logs of all workstations are in one place and you can pull out the websites in one go:

Get-ChildItem '\\server\share\DynBrowser\logs' -Recurse -Filter *.log |
  Select-String '\[ManagedBrowsing\] would' |
  ForEach-Object { ($_.Line -split 'would ')[1] } |
  Group-Object | Sort-Object Count -Descending | Format-Table Count, Name -AutoSize

Go through the list and add what belongs in DynBrowser, such as an intranet or the Power BI reports in D365. Leave out what belongs in the default browser. Then set the mode to On.

What the user sees

• When an address opens in the default browser, the user sees the notice "… does not open in DynBrowser but in your default browser. Your IT department has set it up this way." once per website.
• If the user types an address that is not allowed in a new tab, it opens in the default browser and the tab stays on the start page.
• A link in D365 to an external website keeps working: it opens in the default browser.