Direct answer
Use the organization's approved browser and device profiles, understand what data and sessions persist or synchronize, and verify that a second authorized user cannot access the first user's work session.
Identify the sharing model
Determine whether the machine has separate Windows accounts, a shared account or a managed kiosk. Record who owns the browser profile, what work data is retained and what the organization's policy permits. A browser profile is not a substitute for separate operating-system access controls.
Review browser policy and extensions
Inspect managed browser settings and extension permissions for the intended work profile. Microsoft documents enterprise extension controls and their website and device permissions. Check whether personal extensions or account synchronization are permitted for the device role.
Reference: Microsoft: Manage Edge extensions.
Test a user handoff
With dedicated test identities and harmless data, sign out or lock according to the approved process, then verify that a second user cannot reach the first user's protected application. Record whether cookies, downloads or cached files remain and involve the owner before removing shared data.
Verify a user changeover
Using two dedicated test users, sign in to a harmless work application as the first user, follow the organization's sign-out process and hand the device to the second. Check whether protected application access, downloads or account selection remain visible. Do not use real employee data to perform the test.
Assessment limits
Browser behavior depends on Windows accounts, application sessions, management policy and synchronization. A successful handoff test does not prove all local or cloud data has been removed.
Frequently asked questions
Does closing a browser always revoke application sessions?
No. Session persistence and revocation depend on the application and browser configuration.
Do separate browser profiles replace separate Windows accounts?
No. Assess the operating-system access boundary and the organization's shared-device policy.
Should all downloads be deleted automatically?
Follow the organization's retention and user-data policy; verify what is removed before changing a shared device.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.