#edge-sdsm-plus, on Windows, macOS and Linux. The Microsoft 365 Roadmap suggests it is aimed at IT admins more than home users. And the roadmap listing was already marked for July 2026, which this early flag does not match.
What the Canary flag does (and doesn't)
According to Windows Report, the flag's description says the feature "layers additional attack-surface reductions on top of Enhanced Security Mode." The same description says enforcement isn't implemented yet. Turning the flag on only selects and records the profile's Plus defaults. It doesn't change how websites behave.
In practice, this is scaffolding. Flipping the flag today won't make your browser any safer. Windows Report also says there is no separate Plus toggle in Edge settings, and that Microsoft hasn't detailed the extra protections.
I couldn't independently confirm the flag or its platform availability in Microsoft documentation. Treat those details as Windows Report's finding.
What the Microsoft 365 Roadmap says
The flag doesn't say what the extra protections are, but a Microsoft 365 Roadmap entry does. It is item 566871, mirrored by roadmap trackers. It describes Enhanced Security Mode Plus as adding optional, admin-configurable protections on top of Enhanced Security Mode to further reduce browser attack surface. Admins can configure preset or custom modes that restrict selected network protocols and compression behavior, hardware-access web APIs, WebGL, and external protocol launches when Enhanced Security Mode is enabled.
The roadmap listing is dated and marked as follows:
- Published July 1, 2026, with status "In development" and a General Availability release target.
- The stated GA date is July CY2026.
German outlet DrWindows read the entry as suggesting the Plus mode is reachable only through policy. In its words, home users would probably have to go into the Windows registry. The "Plus" mode seems to be accessible only via policies, with no matching switches in the interface. That is the outlet's inference from the roadmap text, not a Microsoft statement.
Two caveats apply. The roadmap lists a July 2026 target, yet it's now October and Windows Report describes the Canary flag as non-enforcing. Roadmap dates often slip, but I found no Microsoft statement explaining the gap. I also haven't verified how the roadmap's admin-configurable modes relate to the #edge-sdsm-plus flag. They're probably the same work, but that's my inference.
A refresher on today's Enhanced Security Mode
Plus builds on a feature that already exists, so it helps to know what's there now.
Microsoft says Enhanced Security Mode mitigates memory-related vulnerabilities by disabling just-in-time (JIT) JavaScript compilation and enabling additional operating system protections for the browser. Microsoft's documentation lists Hardware-enforced Stack Protection, Arbitrary Code Guard and Control Flow Guard among those protections. The goal is defense in depth. It makes it harder for a malicious site to use an unpatched bug to write to executable memory.
Modes
- Off is the default.
- Balanced (Microsoft's recommended option) applies the added protections to unfamiliar sites and bypasses them for commonly visited ones.
- Strict applies them to all sites by default. Microsoft warns it isn't appropriate for most end users because it may require configuration to complete normal tasks.
Turning it on
- In Edge, go to Settings and more > Settings > Privacy, search, and services.
- Under Security, enable "Enhance your security on the web".
- Choose Balanced or Strict.
- To manage exceptions, select "Manage enhanced security for sites", then Add a site, enter the full URL and select Add. You can also edit or remove entries there.
You can check a site from the Site Trust flyout (the lock icon). If you turn off "Use enhanced security for this site", Edge adds that site to the exception list.
What admins can do today
Existing Enhanced Security Mode has Group Policy support. The EnhanceSecurityMode policy supports StandardMode, BalancedMode and StrictMode. It applies to Windows and macOS from Edge 98 and isn't supported on Android or iOS. BasicMode is deprecated: Edge 113 treats it as Balanced, and it doesn't work in Edge 116.
Microsoft says setting DefaultJavaScriptJitSetting to BlockJavaScriptJit has the same effect as choosing Strict in the settings page.
These controls belong to today's feature. No source I reviewed shows that they configure Plus.
Compatibility trade-offs to expect
Existing Enhanced Security Mode has known costs, and any additional restrictions will likely add to them. This is my inference from the roadmap description, not a documented fact.
- Microsoft warns that the WebAssembly interpreter in this mode may not give the expected performance. It suggests developers advise users to add site exceptions.
- WebAssembly is supported on x64 Windows, x64 macOS, x64 Linux and ARM64. The policy page says WASM sites aren't supported on 32-bit systems when the policy is enabled.
- The roadmap description lists WebGL, hardware-access web APIs and external protocol launches. Restricting those could affect web apps that use graphics, USB or Bluetooth-style device access, or deep links into desktop apps.
What it means for you
- Home users: Nothing to do. The Canary flag doesn't enforce anything. Balanced mode is already the practical option if you want extra hardening now.
- IT admins: Watch the Edge policy documentation and the roadmap entry for the Plus policy names and supported versions. Plan a pilot group before any broad rollout, because restrictions on WebGL and protocol launches are the kind that generate help-desk tickets.
- Developers: Test your sites under Strict mode now. Plus is aimed at tighter environments, so your app may run there.
Microsoft hasn't published the final name, policy names, supported versions or a confirmed ship date for Plus. Until it does, the Canary flag is a sign of direction rather than something you can use.