Microsoft Edge Proxy Settings: System, Flags and Policy

Microsoft Edge has no proxy form of its own. On Windows and macOS it follows the operating system's proxy configuration by default, and edge://settings/system links out to it. Two narrower controls can replace that default, so find the one that owns the route first:

1. The ProxySettings policy. When an administrator enables it, Microsoft documents that Edge ignores proxy-related command-line options and users cannot change the proxy.
2. Command-line switches such as --proxy-server on the shortcut or script that starts one Edge process.
3. The system proxy in Windows Settings or macOS Network settings, shared with other applications.

An extension allowed to manage proxy settings can also take over the route. Whichever control owns it, Databay needs host gw.databay.co and port 8888, entered as an HTTP proxy; secure sites travel through a CONNECT tunnel, so TLS still runs end to end. Credentials never go into proxy fields: when the gateway replies 407 Proxy Authentication Required, Edge shows its own sign-in prompt.

The gateway also accepts SOCKS5, but Chromium's proxy documentation states that no SOCKSv5 authentication methods are supported, so a credentialed SOCKS5 route cannot be completed from Edge; the HTTP versus SOCKS5 comparison covers other clients. Use this setup only for destinations you own or are permitted to test, and follow each destination's terms.

Translate the Databay values into each documented control and treat the last column as its acceptance check.

Chromium will not use credentials embedded in proxy settings. A user:password@ prefix in a switch, PAC file or policy value does not authenticate Edge and only copies the secret into shortcuts and process listings. The same applies to the password option in the macOS Proxies pane.

The system route covers everyday browsing, but other applications that read the setting also use the gateway, and Databay traffic is billed per GB, so prefer a separate profile when only one task needs the proxy.

Windows 10 and 11, following Microsoft's Use a proxy server in Windows article:

1. From edge://settings/system, use the link that opens your computer's proxy settings, or open the Settings app and select Network & internet > Proxy.
2. Under Manual proxy setup, next to Use a proxy server, select Set up.
3. Turn on Use a proxy server, then enter gw.databay.co in Proxy IP address and 8888 in Port.
4. List internal hosts in the exception list, separated by semicolons, keep Don't use the proxy server for local (intranet) addresses selected unless your organization says otherwise, and select Save.

If Automatically detect settings or Use setup script is also on, an automatic configuration can decide the route instead and, if that script fails, Chromium can fall back to a direct connection. For a clean test, leave only the manual proxy on.

macOS, following Apple's proxy settings guide: open System Settings > Network, click the active network service, click Details, then click Proxies. Turn on Web proxy (HTTP) and Secure web proxy (HTTPS) with gw.databay.co and port 8888; the HTTPS entry still reaches secure sites through CONNECT. Leave SOCKS proxy off and separate excluded hosts with commas. Proxy settings belong to one network service, so moving from Wi-Fi to Ethernet needs the same entries again.

Switches confine the proxy to one browser process, which suits a test or automation profile. Chromium's network settings documentation defines --proxy-server for all URLs and --proxy-bypass-list for semicolon-separated hosts that skip it, effective only alongside --proxy-server. Add --user-data-dir so the profile keeps its own cookies and history.

# Windows PowerShell: separate proxied profile
$profileDir = Join-Path $env:LOCALAPPDATA 'EdgeProxyProfiles\databay-us'
$edgeArgs = @(
  ('--user-data-dir="{0}"' -f $profileDir),
  '--proxy-server=http://gw.databay.co:8888',
  '--proxy-bypass-list=*.corp.example;<local>',
  'https://databay.com/what-is-my-ip'
)
Start-Process msedge -ArgumentList $edgeArgs

# macOS Terminal: separate proxied profile
open -na "Microsoft Edge" --args \
  --user-data-dir="$HOME/Library/Application Support/EdgeProxyProfiles/databay-us" \
  --proxy-server="http://gw.databay.co:8888" \
  --proxy-bypass-list="*.corp.example;<local>" \
  https://databay.com/what-is-my-ip

Switches apply when a browser process starts. If an Edge process using the same user data directory is already running, the launch is handed to it and the switch has no effect; on Windows, startup boost and background mode can keep that process alive after the last window closes. A separate --user-data-dir avoids this, unless the UserDataDir policy overrides it or an enabled ProxySettings policy makes Edge ignore the switches. For a reusable Windows shortcut, copy an Edge shortcut and append the switches after the closing quote of its Target value.

Confirm the result at edge://version, which shows the profile path and command line. Implicit rules already keep localhost, loopback and link-local addresses off the proxy, and <local> matches host names without a dot. When a test framework launches Edge, configure the proxy there instead, as the Playwright, Puppeteer and Selenium guides describe.

The first request through the gateway in a browser session triggers the sign-in prompt. Check that it names the proxy, gw.databay.co:8888, rather than the site, then paste the complete dashboard username, such as USER-zone-residential-countryCode-us, and the password. Copy the username exactly as issued instead of assembling routing segments for another pool.

On a plain country route each new connection may select an available exit while a reused one may keep its exit, so one page can load through several exits, and a different IP is never promised. For continuity, use the session form, such as USER-zone-residential-countryCode-us-sessionId-abc123. You can request sticky windows up to 1440 minutes on Premium Residential and Residential Flex where available, or up to 120 minutes on Datacenter and Mobile. The IP can change before the window ends. Premium Residential accepts one country, state, city, ZIP, coordinate or ASN selector at a time, while Residential Flex, Datacenter and Mobile accept country or continent. All pools are shared.

Edge can reuse an accepted credential for the rest of the browser session, so relaunch the profile after changing the username. If the prompt keeps returning, check AuthSchemes at edge://policy: a narrowed list of HTTP authentication schemes can stop Edge answering the challenge. Keep the password in a secret store or password manager, do not let a synced personal profile save it, and never screenshot it or place it in a shortcut, PAC file, policy value, ticket or log.

A proxy auto-config (PAC) script sends only the hosts you choose to the gateway. Use it through Windows Use setup script, macOS Automatic proxy configuration, --proxy-pac-url, or ProxySettings in pac_script mode, and host it at an internal HTTPS address you control. It carries no credentials, so the sign-in prompt still applies.

function FindProxyForURL(url, host) {
  if (isPlainHostName(host) || dnsDomainIs(host, ".corp.example")) {
    return "DIRECT";
  }
  if (host == "databay.com" || dnsDomainIs(host, ".qa-target.example")) {
    return "PROXY gw.databay.co:8888";
  }
  return "DIRECT";
}

Including the verification host lets you observe the exit first. Chromium's proxy documentation adds rules worth designing for:

• Match hosts, not paths. For https:// URLs the script sees only scheme, host and port.
• Serve it directly. The fetch must return HTTP 200 within 30 seconds and is never sent through a proxy.
• Expect silent fallback. A script that cannot be fetched or evaluated falls back to DIRECT unless the PAC is mandatory, which policy exposes as ProxyPacMandatory.
• Skip a DIRECT tail. With PROXY gw.databay.co:8888; DIRECT, a connection-level failure continues directly and Chromium marks the proxy bad for five minutes.

For managed fleets, Microsoft's ProxySettings policy is a dictionary with ProxyMode, ProxyPacUrl, ProxyPacMandatory, ProxyServer and ProxyBypassList. It overrides the standalone proxy policies, and Microsoft marks ProxyMode, ProxyServer and ProxyBypassList as deprecated.

{
  "ProxyMode": "fixed_servers",
  "ProxyServer": "gw.databay.co:8888",
  "ProxyBypassList": "*.corp.example,*.lab.example"
}

In fixed_servers mode Edge reads ProxyServer and ProxyBypassList; pac_script reads ProxyPacUrl, ProxyPacMandatory and ProxyBypassList; system, direct and auto_detect ignore the other fields. Deploy it through Group Policy under Administrative Templates/Microsoft Edge/Proxy server, device management, or the ProxySettings REG_SZ value under SOFTWARE\Policies\Microsoft\Edge; on macOS, use the ProxySettings preference key. The policy has no credential field, so users still answer the prompt. Confirm it at edge://policy on a pilot device first.

1. In the proxied window, open Databay's What Is My IP page, or load https://databay.com/what-is-my-ip/json or https://api.ipify.org?format=json.
2. Record the observed IP, country estimate, Edge version, route method, username variant (never the password) and UTC time.
3. Compare with a direct control profile launched with --no-proxy-server and its own --user-data-dir; an enforced ProxySettings policy still wins over that switch.
4. Open the authorized destination only after the observed exit matches the request.

An observed address is point-in-time evidence for that route, not proof of anonymity. Databay carries no UDP, so browser features that send UDP directly, such as some WebRTC connections, sit outside the proxy setting. The proxy anonymity levels guide explains what a destination can still observe.

Classify the first layer that failed before changing anything. The proxy hop covers TCP to gw.databay.co:8888, 407 authentication and the CONNECT tunnel; the destination hop covers TLS and the site's HTTP status.

To separate Edge from the gateway, run the known-good command from the cURL proxy guide on the same machine; if cURL succeeds, inspect Edge's route selection or sign-in. For deeper evidence, record a log at edge://net-export with private information stripped, and share it only privately.