diff --git a/.github/workflows/AutoLabelAssign.yml b/.github/workflows/AutoLabelAssign.yml new file mode 100644 index 00000000000..bd1887dd446 --- /dev/null +++ b/.github/workflows/AutoLabelAssign.yml @@ -0,0 +1,35 @@ +name: Assign and label PR + +permissions: + pull-requests: write + contents: read + actions: read + +on: + workflow_run: + workflows: [Background tasks] + types: + - completed + +jobs: + download-payload: + name: Download and extract payload artifact + uses: MicrosoftDocs/microsoft-365-docs/.github/workflows/Shared-ExtractPayload.yml@workflows-prod + with: + WorkflowId: ${{ github.event.workflow_run.id }} + OrgRepo: ${{ github.repository }} + secrets: + AccessToken: ${{ secrets.GITHUB_TOKEN }} + + label-assign: + name: Run assign and label + needs: [download-payload] + uses: MicrosoftDocs/microsoft-365-docs/.github/workflows/Shared-AutoLabelAssign.yml@workflows-prod + with: + PayloadJson: ${{ needs.download-payload.outputs.WorkflowPayload }} + AutoAssignUsers: 0 + AutoLabel: 0 + ExcludedUserList: '["user1", "user2"]' + ExcludedBranchList: '["branch1", "branch2"]' + secrets: + AccessToken: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/AutoLabelMsftContributor.yml b/.github/workflows/AutoLabelMsftContributor.yml new file mode 100644 index 00000000000..7058a420cf0 --- /dev/null +++ b/.github/workflows/AutoLabelMsftContributor.yml @@ -0,0 +1,34 @@ +name: Auto label Microsoft contributors + +permissions: + pull-requests: write + contents: read + actions: read + +on: + workflow_run: + workflows: [Background tasks] + types: + - completed + +jobs: + download-payload: + if: github.repository_visibility == 'public' + name: Download and extract payload artifact + uses: MicrosoftDocs/microsoft-365-docs/.github/workflows/Shared-ExtractPayload.yml@workflows-prod + with: + WorkflowId: ${{ github.event.workflow_run.id }} + OrgRepo: ${{ github.repository }} + secrets: + AccessToken: ${{ secrets.GITHUB_TOKEN }} + + label-msft: + name: Label Microsoft contributors + if: github.repository_visibility == 'public' + needs: [download-payload] + uses: MicrosoftDocs/microsoft-365-docs/.github/workflows/Shared-AutoLabelMsftContributor.yml@workflows-prod + with: + PayloadJson: ${{ needs.download-payload.outputs.WorkflowPayload }} + secrets: + AccessToken: ${{ secrets.GITHUB_TOKEN }} + TeamReadAccessToken: ${{ secrets.ORG_READTEAMS_TOKEN }} diff --git a/.github/workflows/BackgroundTasks.yml b/.github/workflows/BackgroundTasks.yml new file mode 100644 index 00000000000..c0389bb252f --- /dev/null +++ b/.github/workflows/BackgroundTasks.yml @@ -0,0 +1,26 @@ +name: Background tasks + +permissions: + pull-requests: write + contents: read + +on: + pull_request_target: + +jobs: + upload: + runs-on: ubuntu-latest + + steps: + - name: Save payload data + env: + PayloadJson: ${{ toJSON(github) }} + AccessToken: ${{ github.token }} + run: | + mkdir -p ./pr + echo $PayloadJson > ./pr/PayloadJson.json + sed -i -e "s/$AccessToken/XYZ/g" ./pr/PayloadJson.json + - uses: actions/upload-artifact@v4 + with: + name: PayloadJson + path: pr/ diff --git a/.github/workflows/LiveMergeCheck.yml b/.github/workflows/LiveMergeCheck.yml new file mode 100644 index 00000000000..56b79b48139 --- /dev/null +++ b/.github/workflows/LiveMergeCheck.yml @@ -0,0 +1,19 @@ +name: PR can merge into branch + +permissions: + pull-requests: write + statuses: write + contents: read + +on: + pull_request_target: + types: [opened, reopened, synchronize, edited] + +jobs: + + live-merge: + uses: MicrosoftDocs/microsoft-365-docs/.github/workflows/Shared-LiveMergeCheck.yml@workflows-prod + with: + PayloadJson: ${{ toJSON(github) }} + secrets: + AccessToken: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/PrFileCount.yml b/.github/workflows/PrFileCount.yml new file mode 100644 index 00000000000..95fcf5e1ede --- /dev/null +++ b/.github/workflows/PrFileCount.yml @@ -0,0 +1,19 @@ +name: PR file count less than limit + +permissions: + pull-requests: write + statuses: write + contents: read + +on: + pull_request_target: + types: [opened, reopened, synchronize, labeled, unlabeled, edited] + +jobs: + + file-count: + uses: MicrosoftDocs/microsoft-365-docs/.github/workflows/Shared-PrFileCount.yml@workflows-prod + with: + PayloadJson: ${{ toJSON(github) }} + secrets: + AccessToken: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/ProtectedFiles.yml b/.github/workflows/ProtectedFiles.yml new file mode 100644 index 00000000000..769cd0aa146 --- /dev/null +++ b/.github/workflows/ProtectedFiles.yml @@ -0,0 +1,17 @@ +name: PR has no protected files + +permissions: + pull-requests: write + statuses: write + contents: read + +on: [pull_request_target] + +jobs: + + protected-files: + uses: MicrosoftDocs/microsoft-365-docs/.github/workflows/Shared-ProtectedFiles.yml@workflows-prod + with: + PayloadJson: ${{ toJSON(github) }} + secrets: + AccessToken: ${{ secrets.GITHUB_TOKEN }} diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 9a0facd629a..5ceee9a62a5 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -1,5 +1,30 @@ { "redirections": [ + { + "source_path": "memdocs/intune/remote-actions/organizational-messages-reporting.md", + "redirect_url": "/microsoft-365/admin/misc/organizational-messages-microsoft-365", + "redirect_document_id": false + }, + { + "source_path": "memdocs/intune/remote-actions/organizational-messages-prerequisites.md", + "redirect_url": "/microsoft-365/admin/misc/organizational-messages-microsoft-365", + "redirect_document_id": false + }, + { + "source_path": "memdocs/intune/remote-actions/organizational-messages-overview.md", + "redirect_url": "/microsoft-365/admin/misc/organizational-messages-microsoft-365", + "redirect_document_id": false + }, + { + "source_path": "memdocs/intune/remote-actions/organizational-messages-create.md", + "redirect_url": "/microsoft-365/admin/misc/organizational-messages-microsoft-365", + "redirect_document_id": false + }, + { + "source_path": "memdocs/intune/remote-actions/organizational-messages-cancel.md", + "redirect_url": "/microsoft-365/admin/misc/organizational-messages-microsoft-365", + "redirect_document_id": false + }, { "source_path": "memdocs/intune/user-help/you-need-to-enable-uac-windows.md", "redirect_url": "/mem/intune/user-help/update-device-settings-windows", @@ -2689,6 +2714,11 @@ "source_path": "autopilot/autopilot-faq.yml", "redirect_url": "/autopilot/faq", "redirect_document_id": false + }, + { + "source_path": "memdocs/intune/protect/endpoint-security-firewall-rule-tool.md", + "redirect_url": "/mem/intune/protect/endpoint-security-firewall-policy", + "redirect_document_id": false } ] } \ No newline at end of file diff --git a/autopilot/add-devices.md b/autopilot/add-devices.md index 6179845d4ec..6f5fbdb68cd 100644 --- a/autopilot/add-devices.md +++ b/autopilot/add-devices.md @@ -2,7 +2,7 @@ title: Manually register devices with Windows Autopilot description: Learn how to manually add devices to Windows Autopilot. ms.service: windows-client -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.localizationpriority: medium author: frankroj ms.author: frankroj diff --git a/autopilot/automatic-registration.md b/autopilot/automatic-registration.md index bc6ccee44d6..90027c2463d 100644 --- a/autopilot/automatic-registration.md +++ b/autopilot/automatic-registration.md @@ -2,7 +2,7 @@ title: Automatic registration of existing devices description: Automatically add devices to Windows Autopilot. ms.service: windows-client -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.localizationpriority: medium author: frankroj ms.author: frankroj diff --git a/autopilot/autopilot-device-guidelines.md b/autopilot/autopilot-device-guidelines.md index 59caae3011a..92d06b40cdc 100644 --- a/autopilot/autopilot-device-guidelines.md +++ b/autopilot/autopilot-device-guidelines.md @@ -2,7 +2,7 @@ title: Windows Autopilot device guidelines description: Learn all about hardware, firmware, and software best practices for Windows Autopilot deployment. ms.service: windows-client -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.localizationpriority: medium author: frankroj ms.author: frankroj diff --git a/autopilot/autopilot-motherboard-replacement.md b/autopilot/autopilot-motherboard-replacement.md index d7b28e613aa..8995779f4f9 100644 --- a/autopilot/autopilot-motherboard-replacement.md +++ b/autopilot/autopilot-motherboard-replacement.md @@ -2,7 +2,7 @@ title: Windows Autopilot motherboard replacement description: Understand how Windows Autopilot deployments function when the motherboard is replaced on a device. ms.service: windows-client -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.localizationpriority: medium author: frankroj ms.author: frankroj diff --git a/autopilot/autopilot-support.md b/autopilot/autopilot-support.md index b0bc21ab726..2c5d85558eb 100644 --- a/autopilot/autopilot-support.md +++ b/autopilot/autopilot-support.md @@ -2,7 +2,7 @@ title: Windows Autopilot support description: Find out who to contact for help with Windows Autopilot installation. ms.service: windows-client -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.localizationpriority: medium author: frankroj ms.author: frankroj diff --git a/autopilot/bitlocker.md b/autopilot/bitlocker.md index 6f8bdb639ca..4fd13bd310f 100644 --- a/autopilot/bitlocker.md +++ b/autopilot/bitlocker.md @@ -2,7 +2,7 @@ title: Setting the BitLocker encryption algorithm for Autopilot devices description: Microsoft Intune provides a comprehensive set of configuration options to manage BitLocker on Windows devices. ms.service: windows-client -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.localizationpriority: medium author: frankroj ms.author: frankroj diff --git a/autopilot/deployment-process.md b/autopilot/deployment-process.md index c842b7e8923..989c9c373a0 100644 --- a/autopilot/deployment-process.md +++ b/autopilot/deployment-process.md @@ -2,7 +2,7 @@ title: Windows deployment process posters description: View and download Windows deployment process flows for Microsoft Configuration Manager and Windows Autopilot. ms.service: windows-client -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.localizationpriority: medium author: frankroj ms.author: frankroj diff --git a/autopilot/device-preparation/compare.md b/autopilot/device-preparation/compare.md index 732636949d3..0286395fab6 100644 --- a/autopilot/device-preparation/compare.md +++ b/autopilot/device-preparation/compare.md @@ -2,7 +2,7 @@ title: Compare Windows Autopilot device preparation and Windows Autopilot description: Compare Windows Autopilot device preparation and Windows Autopilot features and when to use each. ms.service: windows-client -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.localizationpriority: medium author: frankroj ms.author: frankroj diff --git a/autopilot/device-preparation/faq.yml b/autopilot/device-preparation/faq.yml index 6f3b2642602..2fa2b7d4887 100644 --- a/autopilot/device-preparation/faq.yml +++ b/autopilot/device-preparation/faq.yml @@ -3,7 +3,7 @@ metadata: title: Windows Autopilot device preparation FAQ description: This article provides OEMs, partners, administrators, and users with answers to some frequently asked questions about deploying Windows with Windows Autopilot device preparation. ms.service: windows-client - ms.subservice: itpro-deploy + ms.subservice: autopilot ms.localizationpriority: medium author: frankroj ms.author: frankroj diff --git a/autopilot/device-preparation/known-issues.md b/autopilot/device-preparation/known-issues.md index 5ae520d9b34..d34731b0cce 100644 --- a/autopilot/device-preparation/known-issues.md +++ b/autopilot/device-preparation/known-issues.md @@ -2,13 +2,13 @@ title: Windows Autopilot device preparation known issues description: Information regarding known issues that might occur during a Windows Autopilot device preparation deployment. # RSS subscription is based on this description so don't change. If the description needs to change, update RSS URL in the Tip in the article. ms.service: windows-client -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.localizationpriority: medium author: frankroj ms.author: frankroj ms.reviewer: jubaptis manager: aaroncz -ms.date: 07/23/2024 +ms.date: 08/07/2024 ms.collection: - M365-modern-desktop - highpri @@ -152,3 +152,7 @@ The initial release of Windows Autopilot device preparation has the following kn - Managed Installer policy during the out-of-box experience (OOBE) isn't supported due to the possibility of incorrect reporting. - Custom compliance isn't supported during Windows Autopilot device preparation deployments. - The device health script isn't supported during Windows Autopilot device preparation deployments. + +## Related content + +- [Windows Autopilot device preparation troubleshooting FAQ](troubleshooting-faq.yml). diff --git a/autopilot/device-preparation/overview.md b/autopilot/device-preparation/overview.md index 99a86d08846..387220a75ff 100644 --- a/autopilot/device-preparation/overview.md +++ b/autopilot/device-preparation/overview.md @@ -2,7 +2,7 @@ title: Overview of Windows Autopilot device preparation description: Windows Autopilot device preparation is used to set up and configure new devices, getting them ready for productive use. ms.service: windows-client -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.localizationpriority: medium author: frankroj ms.author: frankroj diff --git a/autopilot/device-preparation/reporting-monitoring.md b/autopilot/device-preparation/reporting-monitoring.md index 8d51f0fb497..0fbe68d4005 100644 --- a/autopilot/device-preparation/reporting-monitoring.md +++ b/autopilot/device-preparation/reporting-monitoring.md @@ -2,7 +2,7 @@ title: Windows Autopilot device preparation reporting and monitoring description: Reporting and monitoring in Windows Autopilot device preparation. ms.service: windows-client -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.localizationpriority: medium author: frankroj ms.author: frankroj diff --git a/autopilot/device-preparation/requirements.md b/autopilot/device-preparation/requirements.md index 50493515c25..6cd80fcfd60 100644 --- a/autopilot/device-preparation/requirements.md +++ b/autopilot/device-preparation/requirements.md @@ -2,13 +2,13 @@ title: Windows Autopilot device preparation requirements description: Software, Networking, Licensing, Configuration, and RBAC requirements for Windows Autopilot device preparation. # RSS subscription is based on this description so don't change. If the description needs to change, update RSS URL in the Tip in the article. ms.service: windows-client -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.localizationpriority: medium author: frankroj ms.author: frankroj ms.reviewer: jubaptis manager: aaroncz -ms.date: 06/28/2024 +ms.date: 09/05/2024 ms.collection: - M365-modern-desktop - highpri @@ -64,11 +64,11 @@ Windows Autopilot device preparation depends on specific features available in W The following editions are supported: -- Windows 11 Pro -- Windows 11 Pro Education -- Windows 11 Pro for Workstations -- Windows 11 Enterprise -- Windows 11 Education +- Windows 11 Pro. +- Windows 11 Pro Education. +- Windows 11 Pro for Workstations. +- Windows 11 Enterprise. +- Windows 11 Education. ## [:::image type="icon" source="../images/icons/wifi-ethernet-18.svg"::: **Networking**](#tab/networking) diff --git a/autopilot/device-preparation/troubleshooting-faq.yml b/autopilot/device-preparation/troubleshooting-faq.yml index f45d9f7f6aa..44f3f4e87ce 100644 --- a/autopilot/device-preparation/troubleshooting-faq.yml +++ b/autopilot/device-preparation/troubleshooting-faq.yml @@ -3,13 +3,13 @@ metadata: title: Windows Autopilot device preparation troubleshooting FAQ description: Troubleshooting of common Windows Autopilot device preparation issues ms.service: windows-client - ms.subservice: itpro-deploy + ms.subservice: autopilot ms.localizationpriority: medium author: frankroj ms.author: frankroj ms.reviewer: jubaptis manager: aaroncz - ms.date: 07/29/2024 + ms.date: 08/07/2024 ms.collection: - M365-modern-desktop - highpri @@ -99,3 +99,7 @@ sections: If multiple Windows Autopilot device preparation policies are deployed to a user, the policy with the highest priority gets priority. Policy priorities are displayed at the **Home** > **Enroll devices | Windows enrollment** > **Device preparation policies** screen. The policy with the highest priority is higher in the list and has the smallest number under the **Priority** column. To change a policy's priority, move it in the list by dragging the policy within the list. +additionalContent: | + ## Related content + + - [Windows Autopilot device preparation - known issues](known-issues.md). diff --git a/autopilot/device-preparation/tutorial/scenarios.md b/autopilot/device-preparation/tutorial/scenarios.md index 908572b7f23..d499cb2d86f 100644 --- a/autopilot/device-preparation/tutorial/scenarios.md +++ b/autopilot/device-preparation/tutorial/scenarios.md @@ -13,7 +13,7 @@ ms.collection: - tier1 - highpri - essentials-get-started -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 --- diff --git a/autopilot/device-preparation/tutorial/user-driven/entra-join-allow-users-to-join.md b/autopilot/device-preparation/tutorial/user-driven/entra-join-allow-users-to-join.md index ea4a0a609e4..05b23e1c343 100644 --- a/autopilot/device-preparation/tutorial/user-driven/entra-join-allow-users-to-join.md +++ b/autopilot/device-preparation/tutorial/user-driven/entra-join-allow-users-to-join.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 --- diff --git a/autopilot/device-preparation/tutorial/user-driven/entra-join-assign-apps-scripts.md b/autopilot/device-preparation/tutorial/user-driven/entra-join-assign-apps-scripts.md index f5d14eebaee..311d3de1724 100644 --- a/autopilot/device-preparation/tutorial/user-driven/entra-join-assign-apps-scripts.md +++ b/autopilot/device-preparation/tutorial/user-driven/entra-join-assign-apps-scripts.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 --- diff --git a/autopilot/device-preparation/tutorial/user-driven/entra-join-automatic-enrollment.md b/autopilot/device-preparation/tutorial/user-driven/entra-join-automatic-enrollment.md index f29a39485ff..25c5aaa1004 100644 --- a/autopilot/device-preparation/tutorial/user-driven/entra-join-automatic-enrollment.md +++ b/autopilot/device-preparation/tutorial/user-driven/entra-join-automatic-enrollment.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 --- diff --git a/autopilot/device-preparation/tutorial/user-driven/entra-join-autopilot-policy.md b/autopilot/device-preparation/tutorial/user-driven/entra-join-autopilot-policy.md index 4ee1a059037..8f6d1e4393f 100644 --- a/autopilot/device-preparation/tutorial/user-driven/entra-join-autopilot-policy.md +++ b/autopilot/device-preparation/tutorial/user-driven/entra-join-autopilot-policy.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 --- diff --git a/autopilot/device-preparation/tutorial/user-driven/entra-join-corporate-identifier.md b/autopilot/device-preparation/tutorial/user-driven/entra-join-corporate-identifier.md index 542056ae5f3..de805257695 100644 --- a/autopilot/device-preparation/tutorial/user-driven/entra-join-corporate-identifier.md +++ b/autopilot/device-preparation/tutorial/user-driven/entra-join-corporate-identifier.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 --- diff --git a/autopilot/device-preparation/tutorial/user-driven/entra-join-device-group.md b/autopilot/device-preparation/tutorial/user-driven/entra-join-device-group.md index 46472776a2d..11a8c61fa98 100644 --- a/autopilot/device-preparation/tutorial/user-driven/entra-join-device-group.md +++ b/autopilot/device-preparation/tutorial/user-driven/entra-join-device-group.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 --- diff --git a/autopilot/device-preparation/tutorial/user-driven/entra-join-user-group.md b/autopilot/device-preparation/tutorial/user-driven/entra-join-user-group.md index 02af86b522a..8471217c2d7 100644 --- a/autopilot/device-preparation/tutorial/user-driven/entra-join-user-group.md +++ b/autopilot/device-preparation/tutorial/user-driven/entra-join-user-group.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 --- diff --git a/autopilot/device-preparation/tutorial/user-driven/entra-join-workflow.md b/autopilot/device-preparation/tutorial/user-driven/entra-join-workflow.md index b479118df64..101329db4d6 100644 --- a/autopilot/device-preparation/tutorial/user-driven/entra-join-workflow.md +++ b/autopilot/device-preparation/tutorial/user-driven/entra-join-workflow.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 --- diff --git a/autopilot/device-preparation/whats-new.md b/autopilot/device-preparation/whats-new.md index e45983e3794..ba8714bec7d 100644 --- a/autopilot/device-preparation/whats-new.md +++ b/autopilot/device-preparation/whats-new.md @@ -2,13 +2,13 @@ title: What's new in Windows Autopilot device preparation description: News and resources about the latest updates of Windows Autopilot device preparation. # RSS subscription is based on this description so don't change. If the description needs to change, update RSS URL in the Tip in the article. ms.service: windows-client -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.localizationpriority: medium author: frankroj ms.author: frankroj manager: aaroncz ms.reviewer: jubaptis -ms.date: 06/26/2024 +ms.date: 08/21/2024 ms.collection: - M365-modern-desktop - tier2 @@ -31,6 +31,18 @@ appliesto: > > For more information on using RSS for notifications, see [How to use the docs](/mem/use-docs#notifications) in the Intune documentation. + + +## Windows Autopilot device preparation deployment status report available in the Monitor tab under Enrollment + +Date added: *August 21, 2024* + +In addition to the [Devices | Monitor](reporting-monitoring.md#accessing-reports-and-near-real-time-monitoring) page, admins can now easily access the **Windows Autopilot device preparation deployment status** report from the **Monitor** tab in the **Devices | Enrollment** page. The report can be found using the following steps: + +1. Sign into the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). +1. Navigate to **Home** > **Devices** > **Device onboarding | Enrollment**. +1. Select the **Monitor** tab in the **Devices | Enrollment** page. + ## Corporate identifiers can now be used with Windows Autopilot device preparation Date added: *July 8, 2024* diff --git a/autopilot/dfci-management.md b/autopilot/dfci-management.md index 3029fb06767..7df516a9369 100644 --- a/autopilot/dfci-management.md +++ b/autopilot/dfci-management.md @@ -1,7 +1,7 @@ --- title: DFCI Management description: With Windows Autopilot Deployment and Intune, Unified Extensible Firmware Interface (UEFI) settings can be managed after the device is enrolled. UEFI settings can be managed by using the Device Firmware Configuration Interface (DFCI). -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.localizationpriority: medium author: frankroj diff --git a/autopilot/docfx.json b/autopilot/docfx.json index a847b28af49..f6c5e430001 100644 --- a/autopilot/docfx.json +++ b/autopilot/docfx.json @@ -94,7 +94,9 @@ "shdyas", "claydetels19", "beccarobins", - "American-Dipper" + "American-Dipper", + "padmagit77", + "aditisrivastava07" ] }, "fileMetadata": {}, diff --git a/autopilot/enrollment-autopilot.md b/autopilot/enrollment-autopilot.md index b8cbbb7bbbf..fb809bf38ad 100644 --- a/autopilot/enrollment-autopilot.md +++ b/autopilot/enrollment-autopilot.md @@ -9,7 +9,7 @@ ms.date: 06/28/2024 ms.topic: how-to ms.localizationpriority: high ms.service: windows-client -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.suite: ems search.appverid: MET150 ms.collection: diff --git a/autopilot/enrollment-status.md b/autopilot/enrollment-status.md index 611c5252a37..15012e20f0b 100644 --- a/autopilot/enrollment-status.md +++ b/autopilot/enrollment-status.md @@ -1,7 +1,7 @@ --- title: Windows Autopilot Enrollment Status Page description: Gives an overview of the Enrollment Status Page capabilities, configuration. -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.localizationpriority: medium author: frankroj diff --git a/autopilot/existing-devices.md b/autopilot/existing-devices.md index 3cc9aaae6e1..681d63e2d80 100644 --- a/autopilot/existing-devices.md +++ b/autopilot/existing-devices.md @@ -2,7 +2,7 @@ title: Windows Autopilot for existing devices description: Modern desktop deployment with Windows Autopilot enables easily deploying the latest version of Windows to existing devices. ms.service: windows-client -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.localizationpriority: medium author: frankroj ms.author: frankroj diff --git a/autopilot/faq.yml b/autopilot/faq.yml index b5506775517..d7b36e5e8dd 100644 --- a/autopilot/faq.yml +++ b/autopilot/faq.yml @@ -3,7 +3,7 @@ metadata: title: Windows Autopilot FAQ description: This article provides OEMs, partners, administrators, and end users with answers to some frequently asked questions about deploying Windows with Autopilot. ms.service: windows-client - ms.subservice: itpro-deploy + ms.subservice: autopilot ms.localizationpriority: medium author: frankroj ms.author: frankroj diff --git a/autopilot/images/aad-lic1.png b/autopilot/images/aad-lic1.png deleted file mode 100644 index 569d601066d..00000000000 Binary files a/autopilot/images/aad-lic1.png and /dev/null differ diff --git a/autopilot/images/all-groups.png b/autopilot/images/all-groups.png deleted file mode 100644 index 6ae904ed620..00000000000 Binary files a/autopilot/images/all-groups.png and /dev/null differ diff --git a/autopilot/images/allow-white-glove-oobe.png b/autopilot/images/allow-white-glove-oobe.png deleted file mode 100644 index fe22aa3afd8..00000000000 Binary files a/autopilot/images/allow-white-glove-oobe.png and /dev/null differ diff --git a/autopilot/images/ap-devices.png b/autopilot/images/ap-devices.png deleted file mode 100644 index 97737fbcf87..00000000000 Binary files a/autopilot/images/ap-devices.png and /dev/null differ diff --git a/autopilot/images/ap-ts-1.png b/autopilot/images/ap-ts-1.png deleted file mode 100644 index 5f4c33fd51f..00000000000 Binary files a/autopilot/images/ap-ts-1.png and /dev/null differ diff --git a/autopilot/images/ap-ts.png b/autopilot/images/ap-ts.png deleted file mode 100644 index 7c343176d01..00000000000 Binary files a/autopilot/images/ap-ts.png and /dev/null differ diff --git a/autopilot/images/app01.png b/autopilot/images/app01.png deleted file mode 100644 index f551c5ca68a..00000000000 Binary files a/autopilot/images/app01.png and /dev/null differ diff --git a/autopilot/images/app02.png b/autopilot/images/app02.png deleted file mode 100644 index e5036043cc7..00000000000 Binary files a/autopilot/images/app02.png and /dev/null differ diff --git a/autopilot/images/app03.png b/autopilot/images/app03.png deleted file mode 100644 index 63ef76b3f8a..00000000000 Binary files a/autopilot/images/app03.png and /dev/null differ diff --git a/autopilot/images/app04.png b/autopilot/images/app04.png deleted file mode 100644 index bd307c4a464..00000000000 Binary files a/autopilot/images/app04.png and /dev/null differ diff --git a/autopilot/images/app05.png b/autopilot/images/app05.png deleted file mode 100644 index 83861dcd51d..00000000000 Binary files a/autopilot/images/app05.png and /dev/null differ diff --git a/autopilot/images/app06.png b/autopilot/images/app06.png deleted file mode 100644 index 9563e0514c7..00000000000 Binary files a/autopilot/images/app06.png and /dev/null differ diff --git a/autopilot/images/app07.png b/autopilot/images/app07.png deleted file mode 100644 index 59025e69fa7..00000000000 Binary files a/autopilot/images/app07.png and /dev/null differ diff --git a/autopilot/images/app08.png b/autopilot/images/app08.png deleted file mode 100644 index cea5edfc57a..00000000000 Binary files a/autopilot/images/app08.png and /dev/null differ diff --git a/autopilot/images/app09.png b/autopilot/images/app09.png deleted file mode 100644 index 250c85dd8ac..00000000000 Binary files a/autopilot/images/app09.png and /dev/null differ diff --git a/autopilot/images/app10.png b/autopilot/images/app10.png deleted file mode 100644 index 8d5af2ece12..00000000000 Binary files a/autopilot/images/app10.png and /dev/null differ diff --git a/autopilot/images/app11.png b/autopilot/images/app11.png deleted file mode 100644 index 9ca5bc10eb3..00000000000 Binary files a/autopilot/images/app11.png and /dev/null differ diff --git a/autopilot/images/app12.png b/autopilot/images/app12.png deleted file mode 100644 index 3f82bf78a96..00000000000 Binary files a/autopilot/images/app12.png and /dev/null differ diff --git a/autopilot/images/app13.png b/autopilot/images/app13.png deleted file mode 100644 index 2b499f4ec20..00000000000 Binary files a/autopilot/images/app13.png and /dev/null differ diff --git a/autopilot/images/app14.png b/autopilot/images/app14.png deleted file mode 100644 index e809db61347..00000000000 Binary files a/autopilot/images/app14.png and /dev/null differ diff --git a/autopilot/images/app15.png b/autopilot/images/app15.png deleted file mode 100644 index b85a96bf9eb..00000000000 Binary files a/autopilot/images/app15.png and /dev/null differ diff --git a/autopilot/images/app16.png b/autopilot/images/app16.png deleted file mode 100644 index f22f74a091d..00000000000 Binary files a/autopilot/images/app16.png and /dev/null differ diff --git a/autopilot/images/app17.png b/autopilot/images/app17.png deleted file mode 100644 index 5adfc9218f6..00000000000 Binary files a/autopilot/images/app17.png and /dev/null differ diff --git a/autopilot/images/app18.png b/autopilot/images/app18.png deleted file mode 100644 index 24c4b9f3316..00000000000 Binary files a/autopilot/images/app18.png and /dev/null differ diff --git a/autopilot/images/app19.png b/autopilot/images/app19.png deleted file mode 100644 index 281ba9fb404..00000000000 Binary files a/autopilot/images/app19.png and /dev/null differ diff --git a/autopilot/images/app20.png b/autopilot/images/app20.png deleted file mode 100644 index a5a066b45e7..00000000000 Binary files a/autopilot/images/app20.png and /dev/null differ diff --git a/autopilot/images/app21.png b/autopilot/images/app21.png deleted file mode 100644 index d2e23f2db43..00000000000 Binary files a/autopilot/images/app21.png and /dev/null differ diff --git a/autopilot/images/app22.png b/autopilot/images/app22.png deleted file mode 100644 index 4541a692045..00000000000 Binary files a/autopilot/images/app22.png and /dev/null differ diff --git a/autopilot/images/app23.png b/autopilot/images/app23.png deleted file mode 100644 index 19b951c653f..00000000000 Binary files a/autopilot/images/app23.png and /dev/null differ diff --git a/autopilot/images/app24.png b/autopilot/images/app24.png deleted file mode 100644 index aa77e4083f8..00000000000 Binary files a/autopilot/images/app24.png and /dev/null differ diff --git a/autopilot/images/app25.png b/autopilot/images/app25.png deleted file mode 100644 index 544d1ae37a5..00000000000 Binary files a/autopilot/images/app25.png and /dev/null differ diff --git a/autopilot/images/app26.png b/autopilot/images/app26.png deleted file mode 100644 index e210faa31ba..00000000000 Binary files a/autopilot/images/app26.png and /dev/null differ diff --git a/autopilot/images/autopilot-aad-configure.jpg b/autopilot/images/autopilot-aad-configure.jpg deleted file mode 100644 index 3a16c0f219c..00000000000 Binary files a/autopilot/images/autopilot-aad-configure.jpg and /dev/null differ diff --git a/autopilot/images/autopilot-aad-mdm.jpg b/autopilot/images/autopilot-aad-mdm.jpg deleted file mode 100644 index 3a8f1578cbf..00000000000 Binary files a/autopilot/images/autopilot-aad-mdm.jpg and /dev/null differ diff --git a/autopilot/images/autopilot-aad-mdm.png b/autopilot/images/autopilot-aad-mdm.png deleted file mode 100644 index 1533f68c7c3..00000000000 Binary files a/autopilot/images/autopilot-aad-mdm.png and /dev/null differ diff --git a/autopilot/images/autopilot-devices-add.jpg b/autopilot/images/autopilot-devices-add.jpg deleted file mode 100644 index 137b6ca431f..00000000000 Binary files a/autopilot/images/autopilot-devices-add.jpg and /dev/null differ diff --git a/autopilot/images/autopilot-intune-profile-add.jpg b/autopilot/images/autopilot-intune-profile-add.jpg deleted file mode 100644 index bc4bed89201..00000000000 Binary files a/autopilot/images/autopilot-intune-profile-add.jpg and /dev/null differ diff --git a/autopilot/images/autopilot-intune-profile-assign.jpg b/autopilot/images/autopilot-intune-profile-assign.jpg deleted file mode 100644 index 76043821137..00000000000 Binary files a/autopilot/images/autopilot-intune-profile-assign.jpg and /dev/null differ diff --git a/autopilot/images/autopilot-intune-profile-configure.jpg b/autopilot/images/autopilot-intune-profile-configure.jpg deleted file mode 100644 index c3c5307ce45..00000000000 Binary files a/autopilot/images/autopilot-intune-profile-configure.jpg and /dev/null differ diff --git a/autopilot/images/autopilot-intune-sync.jpg b/autopilot/images/autopilot-intune-sync.jpg deleted file mode 100644 index a2717c68bee..00000000000 Binary files a/autopilot/images/autopilot-intune-sync.jpg and /dev/null differ diff --git a/autopilot/images/autopilot-oobe.jpg b/autopilot/images/autopilot-oobe.jpg deleted file mode 100644 index bb2d641155b..00000000000 Binary files a/autopilot/images/autopilot-oobe.jpg and /dev/null differ diff --git a/autopilot/images/autopilot-reset-customlogin.png b/autopilot/images/autopilot-reset-customlogin.png deleted file mode 100644 index d86cb578950..00000000000 Binary files a/autopilot/images/autopilot-reset-customlogin.png and /dev/null differ diff --git a/autopilot/images/autopilot-reset-lockscreen.png b/autopilot/images/autopilot-reset-lockscreen.png deleted file mode 100644 index f6fa6d34676..00000000000 Binary files a/autopilot/images/autopilot-reset-lockscreen.png and /dev/null differ diff --git a/autopilot/images/autopilot-reset-progress.jpg b/autopilot/images/autopilot-reset-progress.jpg deleted file mode 100644 index dbf0e3b3ae0..00000000000 Binary files a/autopilot/images/autopilot-reset-progress.jpg and /dev/null differ diff --git a/autopilot/images/autopilot-reset-prompt.jpg b/autopilot/images/autopilot-reset-prompt.jpg deleted file mode 100644 index 9ed75a9db99..00000000000 Binary files a/autopilot/images/autopilot-reset-prompt.jpg and /dev/null differ diff --git a/autopilot/images/bitlocker-encryption.png b/autopilot/images/bitlocker-encryption.png deleted file mode 100644 index 96e2d94fb39..00000000000 Binary files a/autopilot/images/bitlocker-encryption.png and /dev/null differ diff --git a/autopilot/images/branding.png b/autopilot/images/branding.png deleted file mode 100644 index 46dd37bc4a9..00000000000 Binary files a/autopilot/images/branding.png and /dev/null differ diff --git a/autopilot/images/choice.png b/autopilot/images/choice.png deleted file mode 100644 index 881744eec5d..00000000000 Binary files a/autopilot/images/choice.png and /dev/null differ diff --git a/autopilot/images/connector-fail.png b/autopilot/images/connector-fail.png deleted file mode 100644 index 2d8abb57853..00000000000 Binary files a/autopilot/images/connector-fail.png and /dev/null differ diff --git a/autopilot/images/csp3.png b/autopilot/images/csp3.png deleted file mode 100644 index 8b0647e4b40..00000000000 Binary files a/autopilot/images/csp3.png and /dev/null differ diff --git a/autopilot/images/delete-device1.png b/autopilot/images/delete-device1.png deleted file mode 100644 index e73f929fbd9..00000000000 Binary files a/autopilot/images/delete-device1.png and /dev/null differ diff --git a/autopilot/images/delete-device2.png b/autopilot/images/delete-device2.png deleted file mode 100644 index ed764ac1ede..00000000000 Binary files a/autopilot/images/delete-device2.png and /dev/null differ diff --git a/autopilot/images/delete-device3.png b/autopilot/images/delete-device3.png deleted file mode 100644 index a2daa1c39aa..00000000000 Binary files a/autopilot/images/delete-device3.png and /dev/null differ diff --git a/autopilot/images/delete-device4.png b/autopilot/images/delete-device4.png deleted file mode 100644 index c0119fbc39e..00000000000 Binary files a/autopilot/images/delete-device4.png and /dev/null differ diff --git a/autopilot/images/delete-device5.png b/autopilot/images/delete-device5.png deleted file mode 100644 index 33b539d33c0..00000000000 Binary files a/autopilot/images/delete-device5.png and /dev/null differ diff --git a/autopilot/images/delete-device6.png b/autopilot/images/delete-device6.png deleted file mode 100644 index 23cbcb7c441..00000000000 Binary files a/autopilot/images/delete-device6.png and /dev/null differ diff --git a/autopilot/images/delete-device7.png b/autopilot/images/delete-device7.png deleted file mode 100644 index dcdeee52051..00000000000 Binary files a/autopilot/images/delete-device7.png and /dev/null differ diff --git a/autopilot/images/deployment-profiles.png b/autopilot/images/deployment-profiles.png deleted file mode 100644 index 7888da55d1e..00000000000 Binary files a/autopilot/images/deployment-profiles.png and /dev/null differ diff --git a/autopilot/images/deployment-profiles2.png b/autopilot/images/deployment-profiles2.png deleted file mode 100644 index 6ff9fbb89e9..00000000000 Binary files a/autopilot/images/deployment-profiles2.png and /dev/null differ diff --git a/autopilot/images/device-import.png b/autopilot/images/device-import.png deleted file mode 100644 index 3be4cff9968..00000000000 Binary files a/autopilot/images/device-import.png and /dev/null differ diff --git a/autopilot/images/device2.png b/autopilot/images/device2.png deleted file mode 100644 index 6f7d1a5df0c..00000000000 Binary files a/autopilot/images/device2.png and /dev/null differ diff --git a/autopilot/images/device3.png b/autopilot/images/device3.png deleted file mode 100644 index adf9c7a875a..00000000000 Binary files a/autopilot/images/device3.png and /dev/null differ diff --git a/autopilot/images/enabled-device.png b/autopilot/images/enabled-device.png deleted file mode 100644 index 96dc9353094..00000000000 Binary files a/autopilot/images/enabled-device.png and /dev/null differ diff --git a/autopilot/images/esp-config.png b/autopilot/images/esp-config.png deleted file mode 100644 index 61e11d6e613..00000000000 Binary files a/autopilot/images/esp-config.png and /dev/null differ diff --git a/autopilot/images/esp-settings.png b/autopilot/images/esp-settings.png deleted file mode 100644 index df0fe655e96..00000000000 Binary files a/autopilot/images/esp-settings.png and /dev/null differ diff --git a/autopilot/images/hwid-csv.png b/autopilot/images/hwid-csv.png deleted file mode 100644 index ac177e0b5ac..00000000000 Binary files a/autopilot/images/hwid-csv.png and /dev/null differ diff --git a/autopilot/images/hwid.png b/autopilot/images/hwid.png deleted file mode 100644 index fcc73fa0b07..00000000000 Binary files a/autopilot/images/hwid.png and /dev/null differ diff --git a/autopilot/images/hyper-v-feature.png b/autopilot/images/hyper-v-feature.png deleted file mode 100644 index d7293d808e9..00000000000 Binary files a/autopilot/images/hyper-v-feature.png and /dev/null differ diff --git a/autopilot/images/icons/ethernet-18.svg b/autopilot/images/icons/ethernet-18.svg deleted file mode 100644 index 8224d2e857f..00000000000 --- a/autopilot/images/icons/ethernet-18.svg +++ /dev/null @@ -1,3 +0,0 @@ - - - \ No newline at end of file diff --git a/autopilot/images/import-vm.png b/autopilot/images/import-vm.png deleted file mode 100644 index 5fb97cda5d1..00000000000 Binary files a/autopilot/images/import-vm.png and /dev/null differ diff --git a/autopilot/images/include-group.png b/autopilot/images/include-group.png deleted file mode 100644 index fb7bca7efad..00000000000 Binary files a/autopilot/images/include-group.png and /dev/null differ diff --git a/autopilot/images/include-group2.png b/autopilot/images/include-group2.png deleted file mode 100644 index 585d006bac4..00000000000 Binary files a/autopilot/images/include-group2.png and /dev/null differ diff --git a/autopilot/images/intune-devices.png b/autopilot/images/intune-devices.png deleted file mode 100644 index bc29c765119..00000000000 Binary files a/autopilot/images/intune-devices.png and /dev/null differ diff --git a/autopilot/images/landing.png b/autopilot/images/landing.png deleted file mode 100644 index 13dea20b075..00000000000 Binary files a/autopilot/images/landing.png and /dev/null differ diff --git a/autopilot/images/mdm-config.png b/autopilot/images/mdm-config.png deleted file mode 100644 index 9a794e74dce..00000000000 Binary files a/autopilot/images/mdm-config.png and /dev/null differ diff --git a/autopilot/images/mdm-intune.png b/autopilot/images/mdm-intune.png deleted file mode 100644 index db9b144fad3..00000000000 Binary files a/autopilot/images/mdm-intune.png and /dev/null differ diff --git a/autopilot/images/mdm-intune2.png b/autopilot/images/mdm-intune2.png deleted file mode 100644 index d464863f379..00000000000 Binary files a/autopilot/images/mdm-intune2.png and /dev/null differ diff --git a/autopilot/images/msfb-assign1.png b/autopilot/images/msfb-assign1.png deleted file mode 100644 index c1e8e27e210..00000000000 Binary files a/autopilot/images/msfb-assign1.png and /dev/null differ diff --git a/autopilot/images/msfb-assign2.png b/autopilot/images/msfb-assign2.png deleted file mode 100644 index fd3be16853e..00000000000 Binary files a/autopilot/images/msfb-assign2.png and /dev/null differ diff --git a/autopilot/images/msfb-create1.png b/autopilot/images/msfb-create1.png deleted file mode 100644 index f76aa829916..00000000000 Binary files a/autopilot/images/msfb-create1.png and /dev/null differ diff --git a/autopilot/images/msfb-create2.png b/autopilot/images/msfb-create2.png deleted file mode 100644 index ec6c260fcdc..00000000000 Binary files a/autopilot/images/msfb-create2.png and /dev/null differ diff --git a/autopilot/images/msfb-create3.png b/autopilot/images/msfb-create3.png deleted file mode 100644 index a6241fb5ea6..00000000000 Binary files a/autopilot/images/msfb-create3.png and /dev/null differ diff --git a/autopilot/images/msfb-device.png b/autopilot/images/msfb-device.png deleted file mode 100644 index d338056013a..00000000000 Binary files a/autopilot/images/msfb-device.png and /dev/null differ diff --git a/autopilot/images/msfb-manage.png b/autopilot/images/msfb-manage.png deleted file mode 100644 index 9bf684d8443..00000000000 Binary files a/autopilot/images/msfb-manage.png and /dev/null differ diff --git a/autopilot/images/msfb-manage2.png b/autopilot/images/msfb-manage2.png deleted file mode 100644 index 406aaf59486..00000000000 Binary files a/autopilot/images/msfb-manage2.png and /dev/null differ diff --git a/autopilot/images/msfb-manage3.png b/autopilot/images/msfb-manage3.png deleted file mode 100644 index bf5fb1ccf9a..00000000000 Binary files a/autopilot/images/msfb-manage3.png and /dev/null differ diff --git a/autopilot/images/msfb.png b/autopilot/images/msfb.png deleted file mode 100644 index af937c2c5f0..00000000000 Binary files a/autopilot/images/msfb.png and /dev/null differ diff --git a/autopilot/images/new-group.png b/autopilot/images/new-group.png deleted file mode 100644 index c18c1865f6f..00000000000 Binary files a/autopilot/images/new-group.png and /dev/null differ diff --git a/autopilot/images/pc-01a.png b/autopilot/images/pc-01a.png deleted file mode 100644 index a3d0f4cdeae..00000000000 Binary files a/autopilot/images/pc-01a.png and /dev/null differ diff --git a/autopilot/images/pc-01b.png b/autopilot/images/pc-01b.png deleted file mode 100644 index 07eda6e4bb1..00000000000 Binary files a/autopilot/images/pc-01b.png and /dev/null differ diff --git a/autopilot/images/profile.png b/autopilot/images/profile.png deleted file mode 100644 index 40cf26bee20..00000000000 Binary files a/autopilot/images/profile.png and /dev/null differ diff --git a/autopilot/images/reset.png b/autopilot/images/reset.png deleted file mode 100644 index 0619b7fa03b..00000000000 Binary files a/autopilot/images/reset.png and /dev/null differ diff --git a/autopilot/images/sc.png b/autopilot/images/sc.png deleted file mode 100644 index bb326e64063..00000000000 Binary files a/autopilot/images/sc.png and /dev/null differ diff --git a/autopilot/images/sc1.png b/autopilot/images/sc1.png deleted file mode 100644 index 380887a45c1..00000000000 Binary files a/autopilot/images/sc1.png and /dev/null differ diff --git a/autopilot/images/self-deploy-welcome.png b/autopilot/images/self-deploy-welcome.png deleted file mode 100644 index 3ab1e4b3049..00000000000 Binary files a/autopilot/images/self-deploy-welcome.png and /dev/null differ diff --git a/autopilot/images/svr_mgr2.png b/autopilot/images/svr_mgr2.png deleted file mode 100644 index dd2e6737c65..00000000000 Binary files a/autopilot/images/svr_mgr2.png and /dev/null differ diff --git a/autopilot/images/troubleshoot-device-enrollment/0x80180014-error-code-enrollment-status-page.png b/autopilot/images/troubleshoot-device-enrollment/0x80180014-error-code-enrollment-status-page.png deleted file mode 100644 index 2061a39f299..00000000000 Binary files a/autopilot/images/troubleshoot-device-enrollment/0x80180014-error-code-enrollment-status-page.png and /dev/null differ diff --git a/autopilot/images/troubleshoot-device-enrollment/0x80180014-error-code-pre-provisioning-page.png b/autopilot/images/troubleshoot-device-enrollment/0x80180014-error-code-pre-provisioning-page.png deleted file mode 100644 index 13de9295cbf..00000000000 Binary files a/autopilot/images/troubleshoot-device-enrollment/0x80180014-error-code-pre-provisioning-page.png and /dev/null differ diff --git a/autopilot/images/update-flow.png b/autopilot/images/update-flow.png deleted file mode 100644 index c90f54e96c3..00000000000 Binary files a/autopilot/images/update-flow.png and /dev/null differ diff --git a/autopilot/images/update1.png b/autopilot/images/update1.png deleted file mode 100644 index 83d98a29b5b..00000000000 Binary files a/autopilot/images/update1.png and /dev/null differ diff --git a/autopilot/images/update2.png b/autopilot/images/update2.png deleted file mode 100644 index 04dbcaddc18..00000000000 Binary files a/autopilot/images/update2.png and /dev/null differ diff --git a/autopilot/images/update3.png b/autopilot/images/update3.png deleted file mode 100644 index 851adb58ec2..00000000000 Binary files a/autopilot/images/update3.png and /dev/null differ diff --git a/autopilot/images/wg03.png b/autopilot/images/wg03.png deleted file mode 100644 index 89ac12747c8..00000000000 Binary files a/autopilot/images/wg03.png and /dev/null differ diff --git a/autopilot/images/wg04.png b/autopilot/images/wg04.png deleted file mode 100644 index a59ea766b78..00000000000 Binary files a/autopilot/images/wg04.png and /dev/null differ diff --git a/autopilot/images/wg05.png b/autopilot/images/wg05.png deleted file mode 100644 index cea36fb6bd9..00000000000 Binary files a/autopilot/images/wg05.png and /dev/null differ diff --git a/autopilot/images/wg06.png b/autopilot/images/wg06.png deleted file mode 100644 index 68cd29c24dd..00000000000 Binary files a/autopilot/images/wg06.png and /dev/null differ diff --git a/autopilot/images/wg07.png b/autopilot/images/wg07.png deleted file mode 100644 index bc5a81bb3fb..00000000000 Binary files a/autopilot/images/wg07.png and /dev/null differ diff --git a/autopilot/images/white-glove-result.png b/autopilot/images/white-glove-result.png deleted file mode 100644 index de3701e76de..00000000000 Binary files a/autopilot/images/white-glove-result.png and /dev/null differ diff --git a/autopilot/images/windows_glyph.png b/autopilot/images/windows_glyph.png deleted file mode 100644 index 3a41d4dfb15..00000000000 Binary files a/autopilot/images/windows_glyph.png and /dev/null differ diff --git a/autopilot/images/winsetup1.png b/autopilot/images/winsetup1.png deleted file mode 100644 index c8048256c4f..00000000000 Binary files a/autopilot/images/winsetup1.png and /dev/null differ diff --git a/autopilot/images/winsetup2.png b/autopilot/images/winsetup2.png deleted file mode 100644 index 43db8443345..00000000000 Binary files a/autopilot/images/winsetup2.png and /dev/null differ diff --git a/autopilot/images/winsetup3.png b/autopilot/images/winsetup3.png deleted file mode 100644 index dbea3969def..00000000000 Binary files a/autopilot/images/winsetup3.png and /dev/null differ diff --git a/autopilot/images/winsetup4.png b/autopilot/images/winsetup4.png deleted file mode 100644 index 1121b1dff50..00000000000 Binary files a/autopilot/images/winsetup4.png and /dev/null differ diff --git a/autopilot/images/winsetup5.png b/autopilot/images/winsetup5.png deleted file mode 100644 index 2757253097b..00000000000 Binary files a/autopilot/images/winsetup5.png and /dev/null differ diff --git a/autopilot/images/winsetup6.png b/autopilot/images/winsetup6.png deleted file mode 100644 index e91843e1ff0..00000000000 Binary files a/autopilot/images/winsetup6.png and /dev/null differ diff --git a/autopilot/images/winsetup7.png b/autopilot/images/winsetup7.png deleted file mode 100644 index dadf85485e4..00000000000 Binary files a/autopilot/images/winsetup7.png and /dev/null differ diff --git a/autopilot/images/winsetup8.png b/autopilot/images/winsetup8.png deleted file mode 100644 index 9d7a499db07..00000000000 Binary files a/autopilot/images/winsetup8.png and /dev/null differ diff --git a/autopilot/includes/allow-users-to-join.md b/autopilot/includes/allow-users-to-join.md index b6d04467e5c..b0f079c4345 100644 --- a/autopilot/includes/allow-users-to-join.md +++ b/autopilot/includes/allow-users-to-join.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 06/19/2024 diff --git a/autopilot/includes/automatic-intune-enrollment.md b/autopilot/includes/automatic-intune-enrollment.md index b7cfd1ab669..bd24c22ba01 100644 --- a/autopilot/includes/automatic-intune-enrollment.md +++ b/autopilot/includes/automatic-intune-enrollment.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 06/19/2024 diff --git a/autopilot/includes/create-assigned-device-group.md b/autopilot/includes/create-assigned-device-group.md index b2f31fe2345..2b4edc32041 100644 --- a/autopilot/includes/create-assigned-device-group.md +++ b/autopilot/includes/create-assigned-device-group.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 06/27/2024 @@ -67,7 +67,7 @@ If the **Intune Provisioning Client** service principal with AppId **f1346770-5b Install-Module azuread ``` - If prompted to do so, agree to install **NuGet** and the **azuread** module from the **PSGallery**. + If prompted to do so, agree to install **NuGet** and the **azuread** module from the **PSGallery**. 1. Once the **azuread** module is installed, connect to Microsoft Entra ID by entering the following command: diff --git a/autopilot/includes/create-dynamic-device-group.md b/autopilot/includes/create-dynamic-device-group.md index 301d2eb5232..936dbaa235b 100644 --- a/autopilot/includes/create-dynamic-device-group.md +++ b/autopilot/includes/create-dynamic-device-group.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 06/19/2024 diff --git a/autopilot/includes/create-user-group.md b/autopilot/includes/create-user-group.md index 54ae9a42d41..04955fadd18 100644 --- a/autopilot/includes/create-user-group.md +++ b/autopilot/includes/create-user-group.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 06/03/2024 diff --git a/autopilot/includes/deregister-autopilot-device.md b/autopilot/includes/deregister-autopilot-device.md index 12e56de47b6..08b16043753 100644 --- a/autopilot/includes/deregister-autopilot-device.md +++ b/autopilot/includes/deregister-autopilot-device.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 06/28/2024 diff --git a/autopilot/includes/more-info-allow-users-to-join.md b/autopilot/includes/more-info-allow-users-to-join.md index 932c20c8e7f..01b09b75642 100644 --- a/autopilot/includes/more-info-allow-users-to-join.md +++ b/autopilot/includes/more-info-allow-users-to-join.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 06/03/2024 diff --git a/autopilot/includes/more-info-automatic-enrollment.md b/autopilot/includes/more-info-automatic-enrollment.md index ce8eb5cb030..ea5dd570f8f 100644 --- a/autopilot/includes/more-info-automatic-enrollment.md +++ b/autopilot/includes/more-info-automatic-enrollment.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 06/03/2024 diff --git a/autopilot/includes/more-info-groups.md b/autopilot/includes/more-info-groups.md index a62645c8b71..bcba396dbdd 100644 --- a/autopilot/includes/more-info-groups.md +++ b/autopilot/includes/more-info-groups.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 06/11/2024 diff --git a/autopilot/includes/registered-vs-joined.md b/autopilot/includes/registered-vs-joined.md index d36a8c63cd5..fd750712ac4 100644 --- a/autopilot/includes/registered-vs-joined.md +++ b/autopilot/includes/registered-vs-joined.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 06/19/2024 diff --git a/autopilot/index.yml b/autopilot/index.yml index 6802e2060e2..bd70f300a18 100644 --- a/autopilot/index.yml +++ b/autopilot/index.yml @@ -6,7 +6,7 @@ metadata: title: Windows Autopilot and Windows Autopilot device preparation documentation description: Windows Autopilot and Windows Autopilot device preparation is a collection of technologies used to set up and pre-configure new devices, getting them ready for productive use. ms.service: windows-client - ms.subservice: itpro-deploy + ms.subservice: autopilot ms.topic: landing-page ms.collection: - tier1 diff --git a/autopilot/known-issues.md b/autopilot/known-issues.md index b99bf9f59de..9966c4e2d99 100644 --- a/autopilot/known-issues.md +++ b/autopilot/known-issues.md @@ -2,13 +2,13 @@ title: Windows Autopilot known issues description: Be informed about known issues that might occur during Windows Autopilot deployment. # RSS subscription is based on this description so don't change. If the description needs to change, update RSS URL in the Tip in the article. ms.service: windows-client -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.localizationpriority: medium author: frankroj ms.author: frankroj ms.reviewer: jubaptis manager: aaroncz -ms.date: 06/26/2024 +ms.date: 08/29/2024 ms.collection: - M365-modern-desktop - highpri @@ -21,7 +21,7 @@ appliesto: # Windows Autopilot - known issues -This article describes known issues that can often be resolved with configuration changes, through cumulative updates, or might be resolved automatically in a future release. +This article describes known issues that can often be resolved with configuration changes or via cumulative updates. Some known issues might also be resolved automatically in a future release. > [!TIP] > @@ -41,17 +41,51 @@ This article describes known issues that can often be resolved with configuratio ## Known issues +### Autopilot deployment report doesn't support sorting + +Date added: *August 29, 2024* + +The Autopilot deployment report was updated to a new infrastructure that doesn't currently support column sorting. The issue will be addressed in the future. + + + +### Auto logon for Kiosk device profile only partially fixed + +Date added: *August 21, 2024* + +The know issue of [Kiosk device profiles not auto logging in when auto logon was enabled](#kiosk-device-profile-not-auto-logging-in) was previously reported as fixed. However, there are scenarios where the issue might still occur when using autologon with Kiosks and [Assigned Access](/windows/configuration/assigned-access/overview). If multiple reboots or unexpected reboots occur during the Windows out-of-box experience (OOBE) when initially configuring the Kiosk, the autologon entries in the registry might be deleted. The issue is being investigated. + +The following workarounds are available until the issue is resolved: + +1. Apply or reapply the kiosk profile after Windows Autopilot completes. + +1. Apply the autologon registry entries either manually or via a script. For example: + + ```cmd + reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "AutoAdminLogon" /t REG_DWORD /d 1 /f + + reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "DefaultDomainName" /t REG_SZ /d "." /f + + reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "DefaultUserName" /t REG_SZ /d "kioskUser0" /f + ``` + +1. Exclude items the required reboots during OOBE from Windows Autopilot. + +1. Manually enter the kiosk user credentials. + +For more information, see [Assigned Access recommendations - Automatic sign-in](/windows/configuration/assigned-access/recommendations#automatic-sign-in). For additional assistance, contact support. + ## BitLocker encryption defaults to 128-bit when 256-bit encryption is configured Date added: *July 8, 2024* -In some Windows Autopilot deployments of unregistered devices, BitLocker encryption may default to 128-bit even though the admin configured 256-bit encryption due to a known race condition. The issue is being investigated. Microsoft recommends that customers who need 256-bit BitLocker encryption register devices for Autopilot. +In some Windows Autopilot deployments of unregistered devices, BitLocker encryption might default to 128-bit even though the admin configured 256-bit encryption due to a known race condition. The issue is being investigated. Microsoft recommends that customers who need 256-bit BitLocker encryption register devices for Autopilot. ### Required apps aren't shown on the Enrollment Status Page (ESP) after an Autopilot Reset Date added: *May 17, 2024* -When an Autopilot Reset happens, the required apps aren't installed on the Enrollment Status Page (ESP) before the user reaches the desktop. The apps aren't tracked on the ESP, but they're installed when the user signs in to the desktop. +When an Autopilot Reset happens, the required apps aren't installed on the Enrollment Status Page (ESP) before the user reaches the desktop. The apps aren't tracked on the ESP, but the apps are installed when the user signs in to the desktop. ### Enrolled date for Autopilot device is incorrect @@ -81,7 +115,8 @@ Platforms with the Infineon SLB9672 TPM with firmware release 15.22 with EK cert ### Kiosk device profile not auto logging in -Date added: *January 30, 2023* +Date added: *January 30, 2023*
+Date updated: *August 21, 2024* There's currently a known issue in the following Windows Updates released in January 2023: @@ -89,12 +124,16 @@ There's currently a known issue in the following Windows Updates released in Jan - Windows 11, version 21H2: [KB5022287](https://support.microsoft.com/topic/january-10-2023-kb5022287-os-build-22000-1455-951898ec-2628-4d25-850e-9a44207bc139) - Windows 10, version 22H2: [KB5022282](https://support.microsoft.com/topic/january-10-2023-kb5022282-os-builds-19042-2486-19044-2486-and-19045-2486-9587e4e3-c2d7-48a6-86e2-8cd9146b47fd) -If these updates are installed on a device, Kiosk device profiles that have auto sign-in enabled won't auto sign in. After Autopilot completes provisioning, the device stays on the sign-in screen prompting for credentials. To work around this known issue, manually enter the kiosk user credentials with the username `kioskUser0` and no password. After the username is entered with no password, it should go to the desktop. This issue should be resolved in cumulative updates released for Windows 11 in April 2023 and Windows 10 in March 2023: +If these updates are installed on a device, Kiosk device profiles that have auto logon enabled won't auto log on. After Autopilot completes provisioning, the device stays on the sign-in screen prompting for credentials. To work around this known issue, manually enter the kiosk user credentials with the username `kioskUser0` and no password. After the username is entered with no password, it should go to the desktop. This issue should be resolved in cumulative updates released for Windows 11 in April 2023 and Windows 10 in March 2023: - Windows 11, version 22H2: [KB5025239](https://support.microsoft.com/topic/april-11-2023-kb5025239-os-build-22621-1555-5eaaaf42-bc4d-4881-8d38-97e0082a6982) or later. - Windows 11, version 21H2: [KB5025224](https://support.microsoft.com/topic/april-11-2023-kb5025224-os-build-22000-1817-ebc75372-608d-4a77-a6e0-cb1e15f117fc) or later. - Windows 10, version 22H2: [KB5023773](https://support.microsoft.com/topic/march-21-2023-kb5023773-os-builds-19042-2788-19044-2788-and-19045-2788-preview-5850ac11-dd43-4550-89ec-9e63353fef23) or later. +> [!NOTE] +> +> This issue was only partially fixed and can still occur under certain conditions. For more information, see [Auto logon for Kiosk device profile only partially fixed](#auto-logon-for-kiosk-device-profile-only-partially-fixed). + ### TPM attestation isn't working on AMD platforms with ASP fTPM Date added: *December 1, 2022* @@ -145,7 +184,7 @@ If there isn't an issue with the recovery environment, enter administrator crede Date added: *March 3, 2022* -1. The Intune Enrollment app must be excluded from any Conditional Access policy requiring **Terms of Use** because it isn't supported. See [Per-device terms of use](/azure/active-directory/conditional-access/terms-of-use#per-device-terms-of-use). +1. The Intune Enrollment app must be excluded from any Conditional Access policy requiring **Terms of Use** because it isn't supported. See [Per-device terms of use](/azure/active-directory/conditional-access/terms-of-use#per-device-terms-of-use). 1. Exceptions to Conditional Access policies to exclude **Microsoft Intune Enrollment** and **Microsoft Intune** cloud apps are needed to complete Autopilot enrollment in cases where restrictive polices are present such as: @@ -156,9 +195,9 @@ Date added: *March 3, 2022* If a policy is in place such that **all cloud apps** require a compliant device (there's no exclusion list), by default Microsoft Intune Enrollment is excluded, so that the device can register with Microsoft Entra ID and enroll with Intune and avoid a circular dependency. -1. **Hybrid Microsoft Entra devices**: When Hybrid Microsoft Entra devices are deployed with Autopilot, two device IDs are initially associated with the same device - one Microsoft Entra ID and one hybrid. The hybrid compliance state displays as **N/A** when viewed from the devices list in the [Azure portal](https://portal.azure.com) until a user signs in. Intune only syncs with the Hybrid device ID after a successful user sign-in. +1. **Hybrid Microsoft Entra devices**: When Hybrid Microsoft Entra devices are deployed with Autopilot, two device IDs are initially associated with the same device - one Microsoft Entra ID and one hybrid. The hybrid compliance state displays as **N/A** when viewed from the devices list in the [Azure portal](https://portal.azure.com) until a user signs in. Intune only syncs with the Hybrid device ID after a successful user sign-in. - The temporary **N/A** compliance state can cause issues with device based Conditional Access polices that block access based on compliance. In this case, Conditional Access is behaving as intended. To resolve the conflict, a user must to sign in to the device, or the device-based policy must be modified. For more information, see [Conditional Access: Require compliant or Microsoft Entra hybrid joined device](/azure/active-directory/conditional-access/howto-conditional-access-policy-compliant-device). + The temporary **N/A** compliance state can cause issues with device based Conditional Access polices that block access based on compliance. In this case, this behavior of Conditional Access is intended. To resolve the conflict, a user must to sign in to the device, or the device-based policy must be modified. For more information, see [Conditional Access: Require compliant or Microsoft Entra hybrid joined device](/azure/active-directory/conditional-access/howto-conditional-access-policy-compliant-device). 1. Conditional Access policies such as BitLocker compliance require a grace period for Autopilot devices. This grace period is needed because until the device is rebooted, the status of BitLocker and Secure Boot aren't captured. Since the status isn't't captured, it can't be used as part of the Compliance Policy. The grace period can be as short as 0.25 days. diff --git a/autopilot/manual-registration.md b/autopilot/manual-registration.md index 101ad806931..f9548ad43db 100644 --- a/autopilot/manual-registration.md +++ b/autopilot/manual-registration.md @@ -2,7 +2,7 @@ title: Manual registration of devices for Windows Autopilot description: Manual registration overview. ms.service: windows-client -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.localizationpriority: medium author: frankroj ms.author: frankroj diff --git a/autopilot/media/bitlocker/endpoint-security-disk-encryption-policy.png b/autopilot/media/bitlocker/endpoint-security-disk-encryption-policy.png deleted file mode 100644 index c12bb7e68da..00000000000 Binary files a/autopilot/media/bitlocker/endpoint-security-disk-encryption-policy.png and /dev/null differ diff --git a/autopilot/media/bitlocker/settings-catalog-drive-type.png b/autopilot/media/bitlocker/settings-catalog-drive-type.png deleted file mode 100644 index f4aca2987cc..00000000000 Binary files a/autopilot/media/bitlocker/settings-catalog-drive-type.png and /dev/null differ diff --git a/autopilot/media/enrollment-autopilot/assign-user.png b/autopilot/media/enrollment-autopilot/assign-user.png deleted file mode 100644 index 0af8572b57d..00000000000 Binary files a/autopilot/media/enrollment-autopilot/assign-user.png and /dev/null differ diff --git a/autopilot/media/enrollment-autopilot/autopilot-import-device-2.png b/autopilot/media/enrollment-autopilot/autopilot-import-device-2.png deleted file mode 100644 index e6f9600bc6d..00000000000 Binary files a/autopilot/media/enrollment-autopilot/autopilot-import-device-2.png and /dev/null differ diff --git a/autopilot/media/enrollment-autopilot/create-profile-basics.png b/autopilot/media/enrollment-autopilot/create-profile-basics.png deleted file mode 100644 index 5fe045a663b..00000000000 Binary files a/autopilot/media/enrollment-autopilot/create-profile-basics.png and /dev/null differ diff --git a/autopilot/media/enrollment-autopilot/friendly-name.png b/autopilot/media/enrollment-autopilot/friendly-name.png deleted file mode 100644 index 5c4e2a6ae55..00000000000 Binary files a/autopilot/media/enrollment-autopilot/friendly-name.png and /dev/null differ diff --git a/autopilot/media/enrollment-autopilot/select-user.png b/autopilot/media/enrollment-autopilot/select-user.png deleted file mode 100644 index 79e2d457ea2..00000000000 Binary files a/autopilot/media/enrollment-autopilot/select-user.png and /dev/null differ diff --git a/autopilot/media/windows-autopilot-hybrid/auto-enroll-azure-main.png b/autopilot/media/windows-autopilot-hybrid/auto-enroll-azure-main.png deleted file mode 100644 index 39e850c55ed..00000000000 Binary files a/autopilot/media/windows-autopilot-hybrid/auto-enroll-azure-main.png and /dev/null differ diff --git a/autopilot/media/windows-autopilot-hybrid/auto-enroll-mdm.png b/autopilot/media/windows-autopilot-hybrid/auto-enroll-mdm.png deleted file mode 100644 index 33f9f208804..00000000000 Binary files a/autopilot/media/windows-autopilot-hybrid/auto-enroll-mdm.png and /dev/null differ diff --git a/autopilot/media/windows10-autopilot-flowchart.png b/autopilot/media/windows10-autopilot-flowchart.png deleted file mode 100644 index 878c9d483d4..00000000000 Binary files a/autopilot/media/windows10-autopilot-flowchart.png and /dev/null differ diff --git a/autopilot/media/windows10-deployment-config-manager.png b/autopilot/media/windows10-deployment-config-manager.png deleted file mode 100644 index 509e0417411..00000000000 Binary files a/autopilot/media/windows10-deployment-config-manager.png and /dev/null differ diff --git a/autopilot/oem-registration.md b/autopilot/oem-registration.md index ccf3fa55156..8f0f92b8b3e 100644 --- a/autopilot/oem-registration.md +++ b/autopilot/oem-registration.md @@ -2,7 +2,7 @@ title: Windows Autopilot OEM registration process description: How OEMs add devices to Windows Autopilot. ms.service: windows-client -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.localizationpriority: medium author: frankroj ms.author: frankroj diff --git a/autopilot/overview.md b/autopilot/overview.md index b40ae2ef3c8..d32eecce349 100644 --- a/autopilot/overview.md +++ b/autopilot/overview.md @@ -2,7 +2,7 @@ title: Overview of Windows Autopilot description: Windows Autopilot is a collection of technologies used to set up and pre-configure new devices, getting them ready for productive use. ms.service: windows-client -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.localizationpriority: medium author: frankroj ms.author: frankroj diff --git a/autopilot/partner-registration.md b/autopilot/partner-registration.md index 39519890168..7ac754a7251 100644 --- a/autopilot/partner-registration.md +++ b/autopilot/partner-registration.md @@ -2,7 +2,7 @@ title: Reseller, distributor, or partner registration of Windows Autopilot devices description: How partners add devices to Windows Autopilot. ms.service: windows-client -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.localizationpriority: medium author: frankroj ms.author: frankroj diff --git a/autopilot/pre-provision.md b/autopilot/pre-provision.md index 3755f3df748..67958993f67 100644 --- a/autopilot/pre-provision.md +++ b/autopilot/pre-provision.md @@ -2,7 +2,7 @@ title: Windows Autopilot for pre-provisioned deployment description: Windows Autopilot for pre-provisioned deployment. ms.service: windows-client -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.localizationpriority: medium ms.reviewer: jubaptis manager: aaroncz diff --git a/autopilot/profiles.md b/autopilot/profiles.md index 2477654964c..944fbc34c41 100644 --- a/autopilot/profiles.md +++ b/autopilot/profiles.md @@ -1,7 +1,7 @@ --- title: Configure Autopilot profiles description: Learn how to configure device profiles for Windows Autopilot deployment. -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.localizationpriority: medium author: frankroj diff --git a/autopilot/registration-auth.md b/autopilot/registration-auth.md index b3a04bedcf0..6c8e1c61263 100644 --- a/autopilot/registration-auth.md +++ b/autopilot/registration-auth.md @@ -1,7 +1,7 @@ --- title: Windows Autopilot customer consent description: Learn how a cloud service provider (CSP) partner or an OEM can get customer authorization to register Windows Autopilot devices on the customer's behalf. -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.localizationpriority: medium author: frankroj diff --git a/autopilot/registration-overview.md b/autopilot/registration-overview.md index 15722176c7e..382a55ce285 100644 --- a/autopilot/registration-overview.md +++ b/autopilot/registration-overview.md @@ -2,7 +2,7 @@ title: Windows Autopilot registration overview description: Overview of Windows Autopilot device registration. ms.service: windows-client -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.localizationpriority: medium author: frankroj ms.author: frankroj diff --git a/autopilot/requirements.md b/autopilot/requirements.md index 019899b45e2..e94cbe9178f 100644 --- a/autopilot/requirements.md +++ b/autopilot/requirements.md @@ -2,13 +2,13 @@ title: Windows Autopilot requirements description: Software, Networking, Licensing, and Configuration requirements for Windows Autopilot. ms.service: windows-client -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.localizationpriority: medium author: frankroj ms.author: frankroj ms.reviewer: jubaptis manager: aaroncz -ms.date: 06/28/2024 +ms.date: 09/06/2024 ms.collection: - M365-modern-desktop - highpri diff --git a/autopilot/self-deploying.md b/autopilot/self-deploying.md index affa15222e1..a3cc171e358 100644 --- a/autopilot/self-deploying.md +++ b/autopilot/self-deploying.md @@ -1,7 +1,7 @@ --- title: Windows Autopilot self-deploying mode description: Self-deploying mode allows a device to be deployed with little to no user interaction. This mode is designed to deploy Windows as a kiosk, digital signage device, or a shared device. -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.localizationpriority: medium author: frankroj diff --git a/autopilot/troubleshooting-faq.yml b/autopilot/troubleshooting-faq.yml index 79a49c00bb7..4498640d149 100644 --- a/autopilot/troubleshooting-faq.yml +++ b/autopilot/troubleshooting-faq.yml @@ -3,13 +3,13 @@ metadata: title: Windows Autopilot troubleshooting FAQ description: Troubleshooting of common Windows Autopilot issues ms.service: windows-client - ms.subservice: itpro-deploy + ms.subservice: autopilot ms.localizationpriority: medium author: frankroj ms.author: frankroj ms.reviewer: jubaptis manager: aaroncz - ms.date: 08/02/2024 + ms.date: 08/08/2024 ms.collection: - M365-modern-desktop - highpri @@ -394,6 +394,38 @@ sections: | **Group Policy Objects (GPOs) that affect Windows Autopilot for [pre-provisioned deployment](pre-provision.md)** | Windows Autopilot pre-provisioning doesn't work when any of the four GPO policy settings listed here are enabled.

**GPO path**:
Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

**Policies**:
[Interactive logon: Message title for users attempting to log on](/windows/security/threat-protection/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on)

[Interactive logon: Message text for users attempting to log on](/windows/security/threat-protection/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on)

[Interactive logon: Require Windows Hello for Business or smart card](/windows/security/threat-protection/security-policy-settings/interactive-logon-require-smart-card)

[User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode - Prompt for credentials on the secure desktop](/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode) | | **[PreferredAadTenantDomainName](/windows/client-management/mdm/policy-csp-authentication#preferredaadtenantdomainname)** | When this policy is enabled, it adds the preferred domain to **DefaultUser0**, which causes autologon to fail. | + - name: Troubleshooting application install issues during Windows Autopilot + questions: + - question: | + Why is the error message "Another installation is in progress, please try again later" occurring during the ESP of a Windows Autopilot deployment? + answer: | + The Enrollment Status Page (ESP) used by Windows Autopilot doesn't support mixing of line-of-business (LOB) and Win32 applications. Both LOB and Win32 applications use **TrustedInstaller** which doesn't allow simultaneous installations. If both an LOB and Win32 application attempt to install at the same time, the following error message occurs during ESP: + + `Another installation is in progress, please try again later.` + + For more information, see [Set up the Enrollment Status Page - Device setup: Apps](/mem/intune/enrollment/windows-enrollment-status#device-setup-apps). + + If mixing LOB and Win32 apps is required, consider using [Windows Autopilot device preparation](device-preparation/overview.md), which doesn't use ESP so therefore supports mixing of LOB and Win32 apps. + + - question: | + During the ESP of a Windows Autopilot deployment, why does the Microsoft 365 Click-to-Run version of Office fail to install the Teams Machine-Wide Installer, or cause other Win32 app MSI based installs to fail? + answer: | + The [Teams Machine-Wide Installer](/microsoftteams/msi-deployment) component of the Microsoft 365 Click-to-Run version of Office includes an MSI installation. ESP doesn't track the Teams Machine-Wide Installer MSI install. Because ESP doesn't track the Teams Machine-Wide Installer MSI install, it can cause a conflict when other Win32 app MSI based installs attempt to install during ESP. MSIs install via **TrustedInstaller** which doesn't allow simultaneous installations. This conflict can cause either the Teams Machine-Wide Installer to fail or other MSI based installs to fail during ESP. For more information, see [Set up the Enrollment Status Page - Device setup: Apps](/mem/intune/enrollment/windows-enrollment-status#device-setup-apps). + + This issue might be random and might not always occur. The issue occurs due to a timing issue between the **Teams Machine-Wide Installer** MSI install and other Win32 app MSI installs. + + To work around the issue or avoid the error, use one of the following solutions: + + 1. Don't install **Teams** as part of the Microsoft 365 Click-to-Run install of Office. Instead, deploy **Teams** as a Win32 app after the Windows Autopilot deployment completes. + + 1. Don't install the Microsoft 365 Click-to-Run version of Office during ESP. Instead, deploy the Microsoft 365 Click-to-Run install of Office after the Windows Autopilot deployment completes. + + 1. Use a custom PowerShell script for Intune Management Extension (IME) that checks if **TrustedInstaller** is currently installing another MSI. If it is, then wait for the current MSI to finish installing before launching a new MSI install. + + 1. For Windows 11 deployments, use [Windows Autopilot device preparation](device-preparation/overview.md). Windows Autopilot device preparation doesn't use ESP so therefore supports mixing of LOB and Win32 apps. + + 1. Continue on error for ESP failures. If the problem occurs with this option enabled, some applications including **Teams** might not install. However, ESP continues and doesn't fail. + additionalContent: | ## Related content diff --git a/autopilot/tutorial/autopilot-scenarios.md b/autopilot/tutorial/autopilot-scenarios.md index c1d9bd273b1..da3f50674ff 100644 --- a/autopilot/tutorial/autopilot-scenarios.md +++ b/autopilot/tutorial/autopilot-scenarios.md @@ -13,7 +13,7 @@ ms.collection: - tier1 - highpri - essentials-get-started -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/existing-devices/create-autopilot-task-sequence.md b/autopilot/tutorial/existing-devices/create-autopilot-task-sequence.md index 76502d96d77..d8f0c625fa6 100644 --- a/autopilot/tutorial/existing-devices/create-autopilot-task-sequence.md +++ b/autopilot/tutorial/existing-devices/create-autopilot-task-sequence.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/existing-devices/create-collection.md b/autopilot/tutorial/existing-devices/create-collection.md index 0e54bd6dbd2..f7189bff124 100644 --- a/autopilot/tutorial/existing-devices/create-collection.md +++ b/autopilot/tutorial/existing-devices/create-collection.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/existing-devices/create-json-file.md b/autopilot/tutorial/existing-devices/create-json-file.md index 5ee57b1ab99..f96ebae258c 100644 --- a/autopilot/tutorial/existing-devices/create-json-file.md +++ b/autopilot/tutorial/existing-devices/create-json-file.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/existing-devices/create-json-package.md b/autopilot/tutorial/existing-devices/create-json-package.md index cf6e134bf04..a6d7703f263 100644 --- a/autopilot/tutorial/existing-devices/create-json-package.md +++ b/autopilot/tutorial/existing-devices/create-json-package.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/existing-devices/deploy-autopilot-task-sequence.md b/autopilot/tutorial/existing-devices/deploy-autopilot-task-sequence.md index 0f73c3fc894..f2c0ef008d9 100644 --- a/autopilot/tutorial/existing-devices/deploy-autopilot-task-sequence.md +++ b/autopilot/tutorial/existing-devices/deploy-autopilot-task-sequence.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/existing-devices/existing-devices-workflow.md b/autopilot/tutorial/existing-devices/existing-devices-workflow.md index fd80be62cf6..327d2dd0f83 100644 --- a/autopilot/tutorial/existing-devices/existing-devices-workflow.md +++ b/autopilot/tutorial/existing-devices/existing-devices-workflow.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/existing-devices/install-modules.md b/autopilot/tutorial/existing-devices/install-modules.md index c2f3b9372ab..620bb88447f 100644 --- a/autopilot/tutorial/existing-devices/install-modules.md +++ b/autopilot/tutorial/existing-devices/install-modules.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/existing-devices/register-device.md b/autopilot/tutorial/existing-devices/register-device.md index d143ff69129..b19f9e64262 100644 --- a/autopilot/tutorial/existing-devices/register-device.md +++ b/autopilot/tutorial/existing-devices/register-device.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/existing-devices/run-autopilot-task-sequence.md b/autopilot/tutorial/existing-devices/run-autopilot-task-sequence.md index b78b0203c09..00b8dc49434 100644 --- a/autopilot/tutorial/existing-devices/run-autopilot-task-sequence.md +++ b/autopilot/tutorial/existing-devices/run-autopilot-task-sequence.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/existing-devices/setup-autopilot-profile.md b/autopilot/tutorial/existing-devices/setup-autopilot-profile.md index 9b595f13d51..72965295914 100644 --- a/autopilot/tutorial/existing-devices/setup-autopilot-profile.md +++ b/autopilot/tutorial/existing-devices/setup-autopilot-profile.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/existing-devices/speed-up-deployment.md b/autopilot/tutorial/existing-devices/speed-up-deployment.md index f931978af3f..b5e7cfbc33b 100644 --- a/autopilot/tutorial/existing-devices/speed-up-deployment.md +++ b/autopilot/tutorial/existing-devices/speed-up-deployment.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/includes/assign-autopilot-device-to-user-via-csv.md b/autopilot/tutorial/includes/assign-autopilot-device-to-user-via-csv.md index e5fef781e43..353d71b85c7 100644 --- a/autopilot/tutorial/includes/assign-autopilot-device-to-user-via-csv.md +++ b/autopilot/tutorial/includes/assign-autopilot-device-to-user-via-csv.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 06/19/2024 diff --git a/autopilot/tutorial/includes/assign-autopilot-device-to-user.md b/autopilot/tutorial/includes/assign-autopilot-device-to-user.md index 3ed580eb432..846a5a18ec6 100644 --- a/autopilot/tutorial/includes/assign-autopilot-device-to-user.md +++ b/autopilot/tutorial/includes/assign-autopilot-device-to-user.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 06/28/2024 diff --git a/autopilot/tutorial/includes/autopilot-profile-steps-after.md b/autopilot/tutorial/includes/autopilot-profile-steps-after.md index b2617d22bba..18e9a914dd0 100644 --- a/autopilot/tutorial/includes/autopilot-profile-steps-after.md +++ b/autopilot/tutorial/includes/autopilot-profile-steps-after.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 06/19/2024 diff --git a/autopilot/tutorial/includes/autopilot-profile-steps-before.md b/autopilot/tutorial/includes/autopilot-profile-steps-before.md index f4725e771fd..2fc9ac44429 100644 --- a/autopilot/tutorial/includes/autopilot-profile-steps-before.md +++ b/autopilot/tutorial/includes/autopilot-profile-steps-before.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 06/28/2024 diff --git a/autopilot/tutorial/includes/computer-account-limit.md b/autopilot/tutorial/includes/computer-account-limit.md index ce89e9f9ab1..1a38e4ce74a 100644 --- a/autopilot/tutorial/includes/computer-account-limit.md +++ b/autopilot/tutorial/includes/computer-account-limit.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 06/19/2024 diff --git a/autopilot/tutorial/includes/configure-and-assign-esp.md b/autopilot/tutorial/includes/configure-and-assign-esp.md index a43bf9ba760..a3d827fb0d8 100644 --- a/autopilot/tutorial/includes/configure-and-assign-esp.md +++ b/autopilot/tutorial/includes/configure-and-assign-esp.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 06/28/2024 diff --git a/autopilot/tutorial/includes/device-group-description.md b/autopilot/tutorial/includes/device-group-description.md index 0e9a4dd89dc..790472c1996 100644 --- a/autopilot/tutorial/includes/device-group-description.md +++ b/autopilot/tutorial/includes/device-group-description.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 06/19/2024 diff --git a/autopilot/tutorial/includes/domain-join-profile.md b/autopilot/tutorial/includes/domain-join-profile.md index 70452a2e05a..67d21b3a657 100644 --- a/autopilot/tutorial/includes/domain-join-profile.md +++ b/autopilot/tutorial/includes/domain-join-profile.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 06/19/2024 diff --git a/autopilot/tutorial/includes/import-hardware-hash.md b/autopilot/tutorial/includes/import-hardware-hash.md index f791769d2e8..06d6707a23b 100644 --- a/autopilot/tutorial/includes/import-hardware-hash.md +++ b/autopilot/tutorial/includes/import-hardware-hash.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 06/28/2024 diff --git a/autopilot/tutorial/includes/intune-connector.md b/autopilot/tutorial/includes/intune-connector.md index a0acba2c5d3..c6c5e04f3e2 100644 --- a/autopilot/tutorial/includes/intune-connector.md +++ b/autopilot/tutorial/includes/intune-connector.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 06/28/2024 diff --git a/autopilot/tutorial/includes/more-info-autopilot-profile.md b/autopilot/tutorial/includes/more-info-autopilot-profile.md index 7f027c20cb6..558b969523d 100644 --- a/autopilot/tutorial/includes/more-info-autopilot-profile.md +++ b/autopilot/tutorial/includes/more-info-autopilot-profile.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 06/19/2024 diff --git a/autopilot/tutorial/includes/more-info-computer-account-limit.md b/autopilot/tutorial/includes/more-info-computer-account-limit.md index d60aec8ee09..b0016a1f17a 100644 --- a/autopilot/tutorial/includes/more-info-computer-account-limit.md +++ b/autopilot/tutorial/includes/more-info-computer-account-limit.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 06/19/2024 diff --git a/autopilot/tutorial/includes/more-info-esp.md b/autopilot/tutorial/includes/more-info-esp.md index 68686d52c42..48fcae2f1a8 100644 --- a/autopilot/tutorial/includes/more-info-esp.md +++ b/autopilot/tutorial/includes/more-info-esp.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 06/19/2024 diff --git a/autopilot/tutorial/includes/more-info-register-device.md b/autopilot/tutorial/includes/more-info-register-device.md index 41ff6dabde7..2eabbff384d 100644 --- a/autopilot/tutorial/includes/more-info-register-device.md +++ b/autopilot/tutorial/includes/more-info-register-device.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 06/19/2024 diff --git a/autopilot/tutorial/includes/more-info-technician-flow.md b/autopilot/tutorial/includes/more-info-technician-flow.md index 6f87c17fa31..5a9efc39447 100644 --- a/autopilot/tutorial/includes/more-info-technician-flow.md +++ b/autopilot/tutorial/includes/more-info-technician-flow.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 06/19/2024 diff --git a/autopilot/tutorial/includes/more-info-user-flow.md b/autopilot/tutorial/includes/more-info-user-flow.md index 3d6bb3c87e0..487e970d1db 100644 --- a/autopilot/tutorial/includes/more-info-user-flow.md +++ b/autopilot/tutorial/includes/more-info-user-flow.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 06/19/2024 diff --git a/autopilot/tutorial/includes/network-connectivity.md b/autopilot/tutorial/includes/network-connectivity.md index 38cb833299e..cd222bcf815 100644 --- a/autopilot/tutorial/includes/network-connectivity.md +++ b/autopilot/tutorial/includes/network-connectivity.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 06/19/2024 diff --git a/autopilot/tutorial/includes/register-autopilot-device.md b/autopilot/tutorial/includes/register-autopilot-device.md index 273dbc15c57..98e3b5312ee 100644 --- a/autopilot/tutorial/includes/register-autopilot-device.md +++ b/autopilot/tutorial/includes/register-autopilot-device.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 06/28/2024 diff --git a/autopilot/tutorial/includes/technician-flow.md b/autopilot/tutorial/includes/technician-flow.md index 8b7501cd9b6..8202c707c5e 100644 --- a/autopilot/tutorial/includes/technician-flow.md +++ b/autopilot/tutorial/includes/technician-flow.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 06/19/2024 diff --git a/autopilot/tutorial/includes/tips-aadj-screens.md b/autopilot/tutorial/includes/tips-aadj-screens.md index 3704a72a0f7..7ff86f503cf 100644 --- a/autopilot/tutorial/includes/tips-aadj-screens.md +++ b/autopilot/tutorial/includes/tips-aadj-screens.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 06/19/2024 diff --git a/autopilot/tutorial/includes/tips-assignments.md b/autopilot/tutorial/includes/tips-assignments.md index f60444bd65b..e2b0dfb10f6 100644 --- a/autopilot/tutorial/includes/tips-assignments.md +++ b/autopilot/tutorial/includes/tips-assignments.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 06/19/2024 diff --git a/autopilot/tutorial/includes/tips-esp-progress.md b/autopilot/tutorial/includes/tips-esp-progress.md index abd1ad1e2f5..4229e2e0c61 100644 --- a/autopilot/tutorial/includes/tips-esp-progress.md +++ b/autopilot/tutorial/includes/tips-esp-progress.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 06/19/2024 diff --git a/autopilot/tutorial/includes/tips-haadj-lock.md b/autopilot/tutorial/includes/tips-haadj-lock.md index 872a0f423fb..a9295c6af9d 100644 --- a/autopilot/tutorial/includes/tips-haadj-lock.md +++ b/autopilot/tutorial/includes/tips-haadj-lock.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 06/19/2024 diff --git a/autopilot/tutorial/includes/tips-haadj-screens.md b/autopilot/tutorial/includes/tips-haadj-screens.md index 4e4452226d8..7ed03f5d6b2 100644 --- a/autopilot/tutorial/includes/tips-haadj-screens.md +++ b/autopilot/tutorial/includes/tips-haadj-screens.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 06/19/2024 diff --git a/autopilot/tutorial/includes/tips-pre-provision-compliance-user-flow.md b/autopilot/tutorial/includes/tips-pre-provision-compliance-user-flow.md index 5509bac0568..e9e56ebca23 100644 --- a/autopilot/tutorial/includes/tips-pre-provision-compliance-user-flow.md +++ b/autopilot/tutorial/includes/tips-pre-provision-compliance-user-flow.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 06/19/2024 diff --git a/autopilot/tutorial/includes/tips-pre-provision-wait-user-flow.md b/autopilot/tutorial/includes/tips-pre-provision-wait-user-flow.md index 522bd32fb6e..9eccefa932a 100644 --- a/autopilot/tutorial/includes/tips-pre-provision-wait-user-flow.md +++ b/autopilot/tutorial/includes/tips-pre-provision-wait-user-flow.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 07/23/2024 diff --git a/autopilot/tutorial/includes/tips-qr-codes.md b/autopilot/tutorial/includes/tips-qr-codes.md index a421ca4e046..6f8b5db58d3 100644 --- a/autopilot/tutorial/includes/tips-qr-codes.md +++ b/autopilot/tutorial/includes/tips-qr-codes.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 06/19/2024 diff --git a/autopilot/tutorial/includes/tips-technician-flow-inherit.md b/autopilot/tutorial/includes/tips-technician-flow-inherit.md index 77089c338d8..b0939eab5ab 100644 --- a/autopilot/tutorial/includes/tips-technician-flow-inherit.md +++ b/autopilot/tutorial/includes/tips-technician-flow-inherit.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 06/19/2024 diff --git a/autopilot/tutorial/includes/tips-technician-flow-screens.md b/autopilot/tutorial/includes/tips-technician-flow-screens.md index f664ea1df16..1edec497528 100644 --- a/autopilot/tutorial/includes/tips-technician-flow-screens.md +++ b/autopilot/tutorial/includes/tips-technician-flow-screens.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 06/19/2024 diff --git a/autopilot/tutorial/includes/verify-autopilot-profile-assignment.md b/autopilot/tutorial/includes/verify-autopilot-profile-assignment.md index ba5366d92c2..234f294c110 100644 --- a/autopilot/tutorial/includes/verify-autopilot-profile-assignment.md +++ b/autopilot/tutorial/includes/verify-autopilot-profile-assignment.md @@ -2,7 +2,7 @@ author: frankroj ms.author: frankroj manager: aaroncz -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.topic: include ms.date: 06/28/2024 diff --git a/autopilot/tutorial/pre-provisioning/azure-ad-join-allow-users-to-join.md b/autopilot/tutorial/pre-provisioning/azure-ad-join-allow-users-to-join.md index 50351eec132..914ad4d33a7 100644 --- a/autopilot/tutorial/pre-provisioning/azure-ad-join-allow-users-to-join.md +++ b/autopilot/tutorial/pre-provisioning/azure-ad-join-allow-users-to-join.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/pre-provisioning/azure-ad-join-assign-device-to-user.md b/autopilot/tutorial/pre-provisioning/azure-ad-join-assign-device-to-user.md index 9dec27ad867..cb791d8abd5 100644 --- a/autopilot/tutorial/pre-provisioning/azure-ad-join-assign-device-to-user.md +++ b/autopilot/tutorial/pre-provisioning/azure-ad-join-assign-device-to-user.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/pre-provisioning/azure-ad-join-automatic-enrollment.md b/autopilot/tutorial/pre-provisioning/azure-ad-join-automatic-enrollment.md index 547d63c28e3..98040abf649 100644 --- a/autopilot/tutorial/pre-provisioning/azure-ad-join-automatic-enrollment.md +++ b/autopilot/tutorial/pre-provisioning/azure-ad-join-automatic-enrollment.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/pre-provisioning/azure-ad-join-autopilot-profile.md b/autopilot/tutorial/pre-provisioning/azure-ad-join-autopilot-profile.md index 6bc8a209233..c7ac55d8f6d 100644 --- a/autopilot/tutorial/pre-provisioning/azure-ad-join-autopilot-profile.md +++ b/autopilot/tutorial/pre-provisioning/azure-ad-join-autopilot-profile.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/pre-provisioning/azure-ad-join-device-group.md b/autopilot/tutorial/pre-provisioning/azure-ad-join-device-group.md index dabd1e08a78..033931c5409 100644 --- a/autopilot/tutorial/pre-provisioning/azure-ad-join-device-group.md +++ b/autopilot/tutorial/pre-provisioning/azure-ad-join-device-group.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/pre-provisioning/azure-ad-join-esp.md b/autopilot/tutorial/pre-provisioning/azure-ad-join-esp.md index 9b893e6f4be..fd121b9cf1d 100644 --- a/autopilot/tutorial/pre-provisioning/azure-ad-join-esp.md +++ b/autopilot/tutorial/pre-provisioning/azure-ad-join-esp.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/pre-provisioning/azure-ad-join-register-device.md b/autopilot/tutorial/pre-provisioning/azure-ad-join-register-device.md index 28005a24780..073272d3573 100644 --- a/autopilot/tutorial/pre-provisioning/azure-ad-join-register-device.md +++ b/autopilot/tutorial/pre-provisioning/azure-ad-join-register-device.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/pre-provisioning/azure-ad-join-technician-flow.md b/autopilot/tutorial/pre-provisioning/azure-ad-join-technician-flow.md index 8ec1098fa0c..d28b74f7f0f 100644 --- a/autopilot/tutorial/pre-provisioning/azure-ad-join-technician-flow.md +++ b/autopilot/tutorial/pre-provisioning/azure-ad-join-technician-flow.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 @@ -57,7 +57,7 @@ For an overview of the Windows Autopilot for pre-provisioned deployment Microsof ## Next step: User flow > [!div class="nextstepaction"] -> [Step 8: User flow](azure-ad-join-user-flow.md) +> [Step 9: User flow](azure-ad-join-user-flow.md) ## Related content diff --git a/autopilot/tutorial/pre-provisioning/azure-ad-join-user-flow.md b/autopilot/tutorial/pre-provisioning/azure-ad-join-user-flow.md index 762ff80a68c..8ee5af36cee 100644 --- a/autopilot/tutorial/pre-provisioning/azure-ad-join-user-flow.md +++ b/autopilot/tutorial/pre-provisioning/azure-ad-join-user-flow.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/pre-provisioning/azure-ad-join-workflow.md b/autopilot/tutorial/pre-provisioning/azure-ad-join-workflow.md index e480ef3b8d4..f7c88ea8768 100644 --- a/autopilot/tutorial/pre-provisioning/azure-ad-join-workflow.md +++ b/autopilot/tutorial/pre-provisioning/azure-ad-join-workflow.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-assign-device-to-user.md b/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-assign-device-to-user.md index 1565c2501e7..e1ca668aac6 100644 --- a/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-assign-device-to-user.md +++ b/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-assign-device-to-user.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-automatic-enrollment.md b/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-automatic-enrollment.md index 2afe5eee7a5..6b8bd3d8d29 100644 --- a/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-automatic-enrollment.md +++ b/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-automatic-enrollment.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-autopilot-profile.md b/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-autopilot-profile.md index 9ef8cd9e01b..27bdc807fed 100644 --- a/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-autopilot-profile.md +++ b/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-autopilot-profile.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-computer-account-limit.md b/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-computer-account-limit.md index 3caeee7356f..43581884b84 100644 --- a/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-computer-account-limit.md +++ b/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-computer-account-limit.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-device-group.md b/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-device-group.md index 715b8426da0..4c43a0e0dca 100644 --- a/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-device-group.md +++ b/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-device-group.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-domain-join-profile.md b/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-domain-join-profile.md index c7d934a9999..a1be397537e 100644 --- a/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-domain-join-profile.md +++ b/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-domain-join-profile.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-esp.md b/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-esp.md index d289ed93382..b3a434baf9a 100644 --- a/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-esp.md +++ b/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-esp.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-intune-connector.md b/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-intune-connector.md index 47e217f7eac..67e4a27c904 100644 --- a/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-intune-connector.md +++ b/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-intune-connector.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-register-device.md b/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-register-device.md index 5c326d9341b..b5da52db97c 100644 --- a/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-register-device.md +++ b/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-register-device.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-technician-flow.md b/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-technician-flow.md index c71060cf31a..8320e82e9d1 100644 --- a/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-technician-flow.md +++ b/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-technician-flow.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-user-flow.md b/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-user-flow.md index 8b59922948f..97a1695b593 100644 --- a/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-user-flow.md +++ b/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-user-flow.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-workflow.md b/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-workflow.md index c92da5ee749..6d9b1140576 100644 --- a/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-workflow.md +++ b/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-workflow.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/reset/autopilot-reset-overview.md b/autopilot/tutorial/reset/autopilot-reset-overview.md index c226ccb39d5..6fdd9904fe6 100644 --- a/autopilot/tutorial/reset/autopilot-reset-overview.md +++ b/autopilot/tutorial/reset/autopilot-reset-overview.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/reset/local-autopilot-reset.md b/autopilot/tutorial/reset/local-autopilot-reset.md index 1d79f109399..037396dae36 100644 --- a/autopilot/tutorial/reset/local-autopilot-reset.md +++ b/autopilot/tutorial/reset/local-autopilot-reset.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/reset/remote-autopilot-reset.md b/autopilot/tutorial/reset/remote-autopilot-reset.md index 662a642f7dc..48cc5240107 100644 --- a/autopilot/tutorial/reset/remote-autopilot-reset.md +++ b/autopilot/tutorial/reset/remote-autopilot-reset.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/self-deploying/self-deploying-automatic-enrollment.md b/autopilot/tutorial/self-deploying/self-deploying-automatic-enrollment.md index 704b1bcda2c..6fdb1085fb1 100644 --- a/autopilot/tutorial/self-deploying/self-deploying-automatic-enrollment.md +++ b/autopilot/tutorial/self-deploying/self-deploying-automatic-enrollment.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/self-deploying/self-deploying-autopilot-profile.md b/autopilot/tutorial/self-deploying/self-deploying-autopilot-profile.md index 8c3150563c7..b036e3f6905 100644 --- a/autopilot/tutorial/self-deploying/self-deploying-autopilot-profile.md +++ b/autopilot/tutorial/self-deploying/self-deploying-autopilot-profile.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/self-deploying/self-deploying-deploy-device.md b/autopilot/tutorial/self-deploying/self-deploying-deploy-device.md index 120ab0d9524..eeea52bf88d 100644 --- a/autopilot/tutorial/self-deploying/self-deploying-deploy-device.md +++ b/autopilot/tutorial/self-deploying/self-deploying-deploy-device.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/self-deploying/self-deploying-device-group.md b/autopilot/tutorial/self-deploying/self-deploying-device-group.md index 49daf27b367..cc27c806558 100644 --- a/autopilot/tutorial/self-deploying/self-deploying-device-group.md +++ b/autopilot/tutorial/self-deploying/self-deploying-device-group.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/self-deploying/self-deploying-esp.md b/autopilot/tutorial/self-deploying/self-deploying-esp.md index 0bc8d3d9206..2eee8d4e2f8 100644 --- a/autopilot/tutorial/self-deploying/self-deploying-esp.md +++ b/autopilot/tutorial/self-deploying/self-deploying-esp.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/self-deploying/self-deploying-register-device.md b/autopilot/tutorial/self-deploying/self-deploying-register-device.md index 6f99db720e3..8e6b4e59b63 100644 --- a/autopilot/tutorial/self-deploying/self-deploying-register-device.md +++ b/autopilot/tutorial/self-deploying/self-deploying-register-device.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/self-deploying/self-deploying-workflow.md b/autopilot/tutorial/self-deploying/self-deploying-workflow.md index 3efe4e12a9e..bc658e23b6c 100644 --- a/autopilot/tutorial/self-deploying/self-deploying-workflow.md +++ b/autopilot/tutorial/self-deploying/self-deploying-workflow.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/user-driven/azure-ad-join-allow-users-to-join.md b/autopilot/tutorial/user-driven/azure-ad-join-allow-users-to-join.md index de2e5c2b693..81b8312809f 100644 --- a/autopilot/tutorial/user-driven/azure-ad-join-allow-users-to-join.md +++ b/autopilot/tutorial/user-driven/azure-ad-join-allow-users-to-join.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/user-driven/azure-ad-join-assign-device-to-user.md b/autopilot/tutorial/user-driven/azure-ad-join-assign-device-to-user.md index 48055e2ff4f..607e2ddd533 100644 --- a/autopilot/tutorial/user-driven/azure-ad-join-assign-device-to-user.md +++ b/autopilot/tutorial/user-driven/azure-ad-join-assign-device-to-user.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/user-driven/azure-ad-join-automatic-enrollment.md b/autopilot/tutorial/user-driven/azure-ad-join-automatic-enrollment.md index 88ee263759b..5c6c0cdceab 100644 --- a/autopilot/tutorial/user-driven/azure-ad-join-automatic-enrollment.md +++ b/autopilot/tutorial/user-driven/azure-ad-join-automatic-enrollment.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/user-driven/azure-ad-join-autopilot-profile.md b/autopilot/tutorial/user-driven/azure-ad-join-autopilot-profile.md index 01553712f5d..416c6bc3c13 100644 --- a/autopilot/tutorial/user-driven/azure-ad-join-autopilot-profile.md +++ b/autopilot/tutorial/user-driven/azure-ad-join-autopilot-profile.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/user-driven/azure-ad-join-deploy-device.md b/autopilot/tutorial/user-driven/azure-ad-join-deploy-device.md index ae10af97155..ea26a9706bf 100644 --- a/autopilot/tutorial/user-driven/azure-ad-join-deploy-device.md +++ b/autopilot/tutorial/user-driven/azure-ad-join-deploy-device.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/user-driven/azure-ad-join-device-group.md b/autopilot/tutorial/user-driven/azure-ad-join-device-group.md index 6ea0130c8ce..f14db15b644 100644 --- a/autopilot/tutorial/user-driven/azure-ad-join-device-group.md +++ b/autopilot/tutorial/user-driven/azure-ad-join-device-group.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/user-driven/azure-ad-join-esp.md b/autopilot/tutorial/user-driven/azure-ad-join-esp.md index 026bbbacfa1..9fc9ebe144e 100644 --- a/autopilot/tutorial/user-driven/azure-ad-join-esp.md +++ b/autopilot/tutorial/user-driven/azure-ad-join-esp.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/user-driven/azure-ad-join-register-device.md b/autopilot/tutorial/user-driven/azure-ad-join-register-device.md index f49cef7b84f..f86017e6af8 100644 --- a/autopilot/tutorial/user-driven/azure-ad-join-register-device.md +++ b/autopilot/tutorial/user-driven/azure-ad-join-register-device.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/user-driven/azure-ad-join-workflow.md b/autopilot/tutorial/user-driven/azure-ad-join-workflow.md index b506eabdd71..68731176313 100644 --- a/autopilot/tutorial/user-driven/azure-ad-join-workflow.md +++ b/autopilot/tutorial/user-driven/azure-ad-join-workflow.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/user-driven/hybrid-azure-ad-join-assign-device-to-user.md b/autopilot/tutorial/user-driven/hybrid-azure-ad-join-assign-device-to-user.md index 6701bfe9b51..80e8026852e 100644 --- a/autopilot/tutorial/user-driven/hybrid-azure-ad-join-assign-device-to-user.md +++ b/autopilot/tutorial/user-driven/hybrid-azure-ad-join-assign-device-to-user.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/user-driven/hybrid-azure-ad-join-automatic-enrollment.md b/autopilot/tutorial/user-driven/hybrid-azure-ad-join-automatic-enrollment.md index 003b3ebf2cc..e540987de83 100644 --- a/autopilot/tutorial/user-driven/hybrid-azure-ad-join-automatic-enrollment.md +++ b/autopilot/tutorial/user-driven/hybrid-azure-ad-join-automatic-enrollment.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/user-driven/hybrid-azure-ad-join-autopilot-profile.md b/autopilot/tutorial/user-driven/hybrid-azure-ad-join-autopilot-profile.md index 297df952a7f..f13778c7514 100644 --- a/autopilot/tutorial/user-driven/hybrid-azure-ad-join-autopilot-profile.md +++ b/autopilot/tutorial/user-driven/hybrid-azure-ad-join-autopilot-profile.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/user-driven/hybrid-azure-ad-join-computer-account-limit.md b/autopilot/tutorial/user-driven/hybrid-azure-ad-join-computer-account-limit.md index c1384ef2de9..440f49fa5cb 100644 --- a/autopilot/tutorial/user-driven/hybrid-azure-ad-join-computer-account-limit.md +++ b/autopilot/tutorial/user-driven/hybrid-azure-ad-join-computer-account-limit.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/user-driven/hybrid-azure-ad-join-deploy-device.md b/autopilot/tutorial/user-driven/hybrid-azure-ad-join-deploy-device.md index 341335f9484..d094b88c0c1 100644 --- a/autopilot/tutorial/user-driven/hybrid-azure-ad-join-deploy-device.md +++ b/autopilot/tutorial/user-driven/hybrid-azure-ad-join-deploy-device.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/user-driven/hybrid-azure-ad-join-device-group.md b/autopilot/tutorial/user-driven/hybrid-azure-ad-join-device-group.md index 9a27ec76ad9..824be5a3d94 100644 --- a/autopilot/tutorial/user-driven/hybrid-azure-ad-join-device-group.md +++ b/autopilot/tutorial/user-driven/hybrid-azure-ad-join-device-group.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/user-driven/hybrid-azure-ad-join-domain-join-profile.md b/autopilot/tutorial/user-driven/hybrid-azure-ad-join-domain-join-profile.md index d443dbfa1ce..5be10d3e76a 100644 --- a/autopilot/tutorial/user-driven/hybrid-azure-ad-join-domain-join-profile.md +++ b/autopilot/tutorial/user-driven/hybrid-azure-ad-join-domain-join-profile.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/user-driven/hybrid-azure-ad-join-esp.md b/autopilot/tutorial/user-driven/hybrid-azure-ad-join-esp.md index daf6dd6b1bd..e65593d2ea1 100644 --- a/autopilot/tutorial/user-driven/hybrid-azure-ad-join-esp.md +++ b/autopilot/tutorial/user-driven/hybrid-azure-ad-join-esp.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/user-driven/hybrid-azure-ad-join-intune-connector.md b/autopilot/tutorial/user-driven/hybrid-azure-ad-join-intune-connector.md index fbab12c98a8..007a097530c 100644 --- a/autopilot/tutorial/user-driven/hybrid-azure-ad-join-intune-connector.md +++ b/autopilot/tutorial/user-driven/hybrid-azure-ad-join-intune-connector.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/user-driven/hybrid-azure-ad-join-register-device.md b/autopilot/tutorial/user-driven/hybrid-azure-ad-join-register-device.md index c545fea91fc..3a38510987f 100644 --- a/autopilot/tutorial/user-driven/hybrid-azure-ad-join-register-device.md +++ b/autopilot/tutorial/user-driven/hybrid-azure-ad-join-register-device.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/tutorial/user-driven/hybrid-azure-ad-join-workflow.md b/autopilot/tutorial/user-driven/hybrid-azure-ad-join-workflow.md index 54754a54a6e..62dbc18b1bd 100644 --- a/autopilot/tutorial/user-driven/hybrid-azure-ad-join-workflow.md +++ b/autopilot/tutorial/user-driven/hybrid-azure-ad-join-workflow.md @@ -12,7 +12,7 @@ ms.topic: tutorial ms.collection: - tier1 - highpri -ms.subservice: itpro-deploy +ms.subservice: autopilot appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/autopilot/user-driven.md b/autopilot/user-driven.md index a0d7751407d..3c96ea6a7d5 100644 --- a/autopilot/user-driven.md +++ b/autopilot/user-driven.md @@ -2,7 +2,7 @@ title: Windows Autopilot User-Driven Mode description: With Windows Autopilot user-driven mode, devices can be configured to deploy to a ready-to-use state without requiring help from IT personnel. ms.service: windows-client -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.localizationpriority: medium author: frankroj ms.author: frankroj diff --git a/autopilot/whats-new.md b/autopilot/whats-new.md index f67f1099ee7..ca690e1231a 100644 --- a/autopilot/whats-new.md +++ b/autopilot/whats-new.md @@ -2,7 +2,7 @@ title: What's new in Windows Autopilot description: News and resources about the latest updates and past versions of Windows Autopilot. # RSS subscription is based on this description so don't change. If the description needs to change, update RSS URL in the Tip in the article. ms.service: windows-client -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.localizationpriority: medium author: frankroj ms.author: frankroj diff --git a/autopilot/windows-autopilot-hybrid.md b/autopilot/windows-autopilot-hybrid.md index 5f8579f5747..8f097b831b2 100644 --- a/autopilot/windows-autopilot-hybrid.md +++ b/autopilot/windows-autopilot-hybrid.md @@ -6,10 +6,10 @@ author: frankroj ms.author: frankroj manager: aaroncz ms.reviewer: jubaptis -ms.date: 06/28/2024 +ms.date: 09/04/2024 ms.topic: how-to ms.service: windows-client -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.localizationpriority: medium ms.collection: - M365-identity-device-management @@ -63,19 +63,9 @@ Although not required, configuring Microsoft Entra hybrid join for Active Direct - To increase scale and availability, multiple connectors can be installed in the environment. We recommend installing the Connector on a server that's not running any other Intune connectors. Each connector must be able to create computer objects in any domain that needs to be supported. - - -- If the organization has multiple domains and multiple Intune Connectors are installed, a domain service account that can create computer objects in all domains must be used. This requirement is true even if Microsoft Entra hybrid join is only implemented for a specific domain. If these domains are untrusted domains, the connectors must be uninstalled from domains where Windows Autopilot isn't used. Otherwise, with multiple connectors across multiple domains, all connectors must be able to create computer objects in all domains. - - This connector service account must have the following permissions: - - - [**Log on as a service**](/windows/security/threat-protection/security-policy-settings/log-on-as-a-service). - - Must be part of the **Domain user** group. - - Must be a member of the local **Administrators** group on the Windows server that hosts the connector. - - > [!IMPORTANT] - > - > Managed service accounts aren't supported for the service account. The service account must be a domain account. + - The Intune Connector requires the [same endpoints as Intune](/mem/intune/fundamentals/intune-endpoints). @@ -140,7 +130,7 @@ Before beginning the installation, make sure that all of the [Intune connector s ### Install steps -1. By default Windows Server has Internet Explorer Enhanced Security Configuration turned on. Internet Explorer Enhanced Security Configuration might cause problems singing into the Intune Connector for Active Directory. Since Internet Explorer is deprecated and in most instances, not even installed on Windows Server, Microsoft recommends to turn off Internet Explorer Enhanced Security Configuration. To turn off Internet Explorer Enhanced Security Configuration: +1. By default Windows Server has Internet Explorer Enhanced Security Configuration turned on. Internet Explorer Enhanced Security Configuration might cause problems signing into the Intune Connector for Active Directory. Since Internet Explorer is deprecated and in most instances, not even installed on Windows Server, Microsoft recommends to turn off Internet Explorer Enhanced Security Configuration. To turn off Internet Explorer Enhanced Security Configuration: 1. On the server where the Intune Connector is being installed, open **Server Manager**. diff --git a/autopilot/windows-autopilot-reset.md b/autopilot/windows-autopilot-reset.md index 86c52cbe3aa..a4c332f4405 100644 --- a/autopilot/windows-autopilot-reset.md +++ b/autopilot/windows-autopilot-reset.md @@ -1,14 +1,14 @@ --- title: Windows Autopilot Reset description: Windows Autopilot Reset takes the device back to a business-ready state, allowing the next user to sign in and get productive quickly and easily. -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.service: windows-client ms.localizationpriority: medium author: frankroj ms.author: frankroj ms.reviewer: jubaptis manager: aaroncz -ms.date: 06/11/2024 +ms.date: 08/22/2024 ms.collection: - M365-modern-desktop - highpri @@ -36,7 +36,7 @@ The Windows Autopilot Reset process automatically keeps information from the exi - Provisioning packages previously applied to the device. - A provisioning package present on a USB drive when the reset process is started. - Microsoft Entra device membership and mobile device management (MDM) enrollment information. -- System Center Endpoint Protection (SCEP) certificates. +- Simple Certificate Enrollment Protocol (SCEP) certificates. Windows Autopilot Reset blocks the user from accessing the desktop until this information is restored, including reapplying any provisioning packages. For devices enrolled in an MDM service, Windows Autopilot Reset also blocks until an MDM sync is completed. When Autopilot reset is used on a device, the device's primary user is removed. The next user who signs in after the reset will be set as the primary user. diff --git a/autopilot/windows-autopilot-scenarios.md b/autopilot/windows-autopilot-scenarios.md index bc6700e0deb..6846ae50ec3 100644 --- a/autopilot/windows-autopilot-scenarios.md +++ b/autopilot/windows-autopilot-scenarios.md @@ -2,7 +2,7 @@ title: Windows Autopilot scenarios and capabilities description: Follow along with several typical Windows Autopilot deployment scenarios, such as redeploying a device in a business-ready state. ms.service: windows-client -ms.subservice: itpro-deploy +ms.subservice: autopilot ms.localizationpriority: medium author: frankroj ms.author: frankroj diff --git a/memdocs/analytics/advanced-endpoint-analytics.md b/memdocs/analytics/advanced-endpoint-analytics.md index 1e1ebbb4848..9f308a406b1 100644 --- a/memdocs/analytics/advanced-endpoint-analytics.md +++ b/memdocs/analytics/advanced-endpoint-analytics.md @@ -80,4 +80,5 @@ For more information, go to: - [Device scopes](device-scopes.md) - [Enhanced device timeline](enhanced-device-timeline.md) - [Battery health](battery-health.md) -- [Device query](device-query.md) \ No newline at end of file +- [Device query](device-query.md) +- [Resource Performance report](resource-performance-report.md) \ No newline at end of file diff --git a/memdocs/analytics/device-query.md b/memdocs/analytics/device-query.md index 71074425429..c288c73daef 100644 --- a/memdocs/analytics/device-query.md +++ b/memdocs/analytics/device-query.md @@ -48,9 +48,6 @@ For a user to use Device query, you must assign the **Managed Devices** - **Quer To use Device query, devices must be Intune managed and corporate owned. -> [!NOTE] -> -> Device query is currently not supported in U.S. Government Community Cloud (GCC) High, or U.S. Department of Defense (DoD) environments. ## Supported platforms diff --git a/memdocs/analytics/device-scopes.md b/memdocs/analytics/device-scopes.md index f77f6f0ca07..ceb0b8b2029 100644 --- a/memdocs/analytics/device-scopes.md +++ b/memdocs/analytics/device-scopes.md @@ -102,4 +102,5 @@ For more information, go to: - [Enhanced device timeline](enhanced-device-timeline.md) - [Anomaly detection](anomaly-detection.md) - [What is Intune Advanced Analytics](advanced-endpoint-analytics.md) -- [Battery health](battery-health.md) \ No newline at end of file +- [Battery health](battery-health.md) +- [Resource Performance report](resource-performance-report.md) \ No newline at end of file diff --git a/memdocs/analytics/media/anomaly-detection/device-timeline.png b/memdocs/analytics/media/anomaly-detection/device-timeline.png deleted file mode 100644 index 9711f845267..00000000000 Binary files a/memdocs/analytics/media/anomaly-detection/device-timeline.png and /dev/null differ diff --git a/memdocs/analytics/media/resource-perf-report/report-home.png b/memdocs/analytics/media/resource-perf-report/report-home.png new file mode 100644 index 00000000000..79000958952 Binary files /dev/null and b/memdocs/analytics/media/resource-perf-report/report-home.png differ diff --git a/memdocs/analytics/media/resource-perf-report/rp-report.png b/memdocs/analytics/media/resource-perf-report/rp-report.png new file mode 100644 index 00000000000..74f035b20ba Binary files /dev/null and b/memdocs/analytics/media/resource-perf-report/rp-report.png differ diff --git a/memdocs/analytics/media/resource-perf-report/select-device.png b/memdocs/analytics/media/resource-perf-report/select-device.png new file mode 100644 index 00000000000..545415a2b51 Binary files /dev/null and b/memdocs/analytics/media/resource-perf-report/select-device.png differ diff --git a/memdocs/analytics/resource-performance-report.md b/memdocs/analytics/resource-performance-report.md new file mode 100644 index 00000000000..d6b4af225b1 --- /dev/null +++ b/memdocs/analytics/resource-performance-report.md @@ -0,0 +1,171 @@ +--- +title: Resource Performance report in Microsoft Intune Advanced Analytics +titleSuffix: Microsoft Intune +description: This article provides an overview of the resource performance report for cloud-managed Windows devices +ms.date: 08/19/2024 +ms.service: microsoft-intune +ms.subservice: endpoint-analytics +ms.topic: conceptual +author: Smritib17 +ms.author: smbhardwaj +manager: dougeby +ms.localizationpriority: high + +--- + +# Resource Performance report in Microsoft Intune Advanced Analytics + +The resource performance report provides visibility into the performance of processors and RAM in cloud-managed Windows devices and its influence on user experience. + +The score helps you identify emerging hardware issues that might be impacting user productivity so you can proactively make improvements before users generate support tickets. + +The insights show not only how much your score can improve by upgrading the CPU or RAM in affected devices, but also help you identify resources for replacement before warranties expire. + +## License requirements + +With a Windows 365 license, you get access to this report for the Cloud PCs in your organization. + +However, the report for physical devices is part of Intune Advanced Analytics and is included as an Intune-add on under [Microsoft Intune Suite](../intune/fundamentals/intune-add-ons.md) and requires an extra cost to the licensing options that include Microsoft Intune. + +## Prerequisites + +For Advanced Analytics capabilities, including resource performance, devices should be cloud-managed; either Intune-only managed or Co-managed. + +After [enrollment](enroll-intune.md), client devices require a restart to fully enable all analytics. + +> [!NOTE] +> It may take up to 48 hours after you buy licenses or start a trial to see Resource performance data in your tenant. + +> [!NOTE] +> Resource performance report is currently not supported in US Government Community Cloud (GCC) High or U.S. Department of Defense (DoD) environments. + +## Resource performance report + +1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). + +2. Select **Report** > **Endpoint analytics** > **Resource performance**. + +3. The Resource performance report page shows a **Resource performance score** tab, **Device performance** tab, and a **Model performance** tab. For more information on each of the tabs, see [Reporting Tabs](#reporting-tabs). + +:::image type="content" source="media/resource-perf-report/report-home.png" lightbox="media/resource-perf-report/report-home.png" alt-text="This is a screenshot of the Resource performance report page"::: + +## Resource performance score + +The Resource performance score provides an overall performance rating (from 0 to 100) of CPU and RAM for your organization’s Windows physical devices and Cloud PCs. + +This score is a weighted average of CPU spike time score and RAM Spike time score. + +This score helps identify device resources that need to be replaced to improve user experience and boost productivity. + +#### CPU spike time score + +The CPU spike time score (from 0 to 100) is assigned based on the device’s usage duration and the CPU spike time %, which is the percentage of the usage duration in which the device experiences CPU spikes. High usage and spikes indicate a poor experience with the device and result in low scores. Conversely, low spikes indicate a good experience with the device and result in high scores. + +**CPU spike time %**: The daily metric trends graph plots the ratio of CPU spike times to total usage time. This CPU spike % data is averaged over a 14-day period ending on the date at the bottom of the graph. + +Usage over 50% is considered a spike. + +- To improve the performance of CPU in Windows physical devices, you could upgrade the processors by increasing the number of cores or the clock speed, optimize the operating system or adjust power settings. + +- To improve the performance of CPU in Cloud PCs, you could upgrade to a higher configuration of Cloud PCs. + +#### RAM spike time score + +The RAM spike time score (from 0 to 100) is assigned based on the device’s usage duration and the RAM spike time %, which is the percentage of the usage duration in which the device experiences RAM spikes. High usage and spikes indicate a poor experience with the device and result in low scores. Conversely, low spikes indicate a good experience with the device and result in high scores. + +**RAM spike time %**: The daily metric trends graph plots the ratio of RAM spike times to total usage time. This RAM spike % data is averaged over a 14-day period ending on the date at the bottom of the graph. Usage over 50% is considered a spike. + + - To improve the performance of RAM in Windows physical devices, you could add more RAM, upgrade to higher-speed RAM, or modify UEFI/BIOS settings to optimize utilization. + + - To improve the performance of RAM in Cloud PCs, you could upgrade to a higher configuration of Cloud PCs. + +**Baseline** helps you see if you're meeting goals. You can set the baseline to the organizational median or a custom value. + +**Insights and recommendations** suggest actions that you can take to improve your scores. + +## Insights and recommendations + +The Resource performance page provides a prioritized list of insights and recommendations, described in this section: + +#### High CPU usage in physical devices + +These Windows physical devices experience higher CPU spike % than the rest of the devices in your organization, resulting in poor user experience and lower productivity. + +This category has two sub-categories: + +1. Physical devices that experience high CPU spike %. + +2. Physical device models that experience high CPU spike %. + +Besides giving visibility into devices that aren’t supporting your user’s goals, these insights also allow you to identify devices with underperforming CPUs that are within warranty and eligible for replacement. + +#### High RAM usage in physical devices + +These Windows physical devices experience higher RAM spike % than the rest of the devices in your organization, resulting in poor user experience and lower productivity. + +This category has two sub-categories: (1) physical devices that experience high RAM spike % and (2) physical device models that experience high RAM spike %. + +Besides giving visibility into devices that aren’t supporting your user’s goals, these insights also allow you to identify devices with underperforming RAM that are within warranty and eligible for replacement. + +#### Cloud PCs + +These Windows 365 Cloud PCs experience higher CPU or RAM spike % than the rest of the devices in your organization, resulting in poor user experience and lower productivity. + +These insights provide visibility into Cloud PCs that aren’t supporting your user’s goals. Upgrading these devices to a higher configuration of Cloud PCs will improve the user experience. + +## Reporting tabs + +The Resource performance page has reporting tabs that provide support for insights. + +The tabs are: + +- Device performance + +- Model performance + +#### Device performance tab + +This tab provides CPU and RAM performance metrics and scores for all your Windows physical and Cloud PC devices. You can sort by a particular metric (for example, CPU spike time %) to see which devices have the worst scores for that metric to help with troubleshooting. You can filter the list of devices based on a range of a particular metric (for example, devices with RAM spike time score between 0 and 40). You can also search for a device by name. + +#### Model performance tab + +This tab lets you see the CPU and RAM performance metrics and scores by device model, which can help you identify whether problems are isolated to particular models. + +## Device-level details + +To get details on a specific Windows device in your organization, you can select a device’s name in the **Device performance** tab. You can also use the filters or search for a device to view the row corresponding to the device you're interested in learning more about. + +:::image type="content" source="media/resource-perf-report/select-device.png" lightbox="media/resource-perf-report/select-device.png" alt-text="In the Device Performance tab, use filters or search for a device to view the device details"::: + +The device-level details page includes the CPU and RAM spike-time history over the last 14 days for which this data is available. The page also includes device details such as model, manufacturer, processor name, number of processor cores, the processor base speed, RAM, and disk type. + +:::image type="content" source="media/resource-perf-report/rp-report.png" lightbox="media/resource-perf-report/rp-report.png" alt-text="This is a screenshot of device levels details"::: + +## Limitations + +- Some data points in the report might show **--** when not available. When you export the report, data points that aren't available appear as **-1** in the generated .csv file. + +- Health status appears differently in the report and the exported .csv + - **HealthStatus .csv value**: + - `0`: Unknown + - `1`: Insufficient data + - `2`: Needs attention + - `3`: Meeting goals + +- Some columns such as ResourcePerfScore and TotalRamInMB in the generated .csv file have data type double whereas the corresponding columns Resource performance score and RAM in the report have data type int. + +- Column MachineType in the generated .csv file can take values Physical, CPC, and Others whereas the corresponding column Device Type in the report takes values physical, virtual, and unknown respectively. + +## Next steps + +For more information, go to: + +- [What is Intune Advanced Analytics](advanced-endpoint-analytics.md) + +- [Use Intune Suite add-on capabilities](../intune/fundamentals/intune-add-ons.md) + +- [Device scopes](device-scopes.md) + +- [Device query](device-query.md) + +- [Battery health](battery-health.md) diff --git a/memdocs/analytics/toc.yml b/memdocs/analytics/toc.yml index 2260f9341b1..682e35732ed 100644 --- a/memdocs/analytics/toc.yml +++ b/memdocs/analytics/toc.yml @@ -22,7 +22,9 @@ items: - name: Data platform schema href: data-platform-schema.md - name: Battery health - href: battery-health.md + href: battery-health.md + - name: Resource Performance + href: resource-performance-report.md - name: Quickstarts items: - name: Enroll Intune devices diff --git a/memdocs/configmgr/comanage/media/properties-workloads.png b/memdocs/configmgr/comanage/media/properties-workloads.png deleted file mode 100644 index 23f6e5b85d2..00000000000 Binary files a/memdocs/configmgr/comanage/media/properties-workloads.png and /dev/null differ diff --git a/memdocs/configmgr/compliance/deploy-use/create-configuration-baselines.md b/memdocs/configmgr/compliance/deploy-use/create-configuration-baselines.md index f47a5af6545..e7eb3ae1dd2 100644 --- a/memdocs/configmgr/compliance/deploy-use/create-configuration-baselines.md +++ b/memdocs/configmgr/compliance/deploy-use/create-configuration-baselines.md @@ -115,7 +115,7 @@ When `User1` uses `Device2`, only `Configuration Baseline 2` gets evaluated when ### Create and deploy a compliance policy with a rule for baseline compliance policy assessment -1. In the **Assets and Compliance** workspace, expand **Compliance Settings**, then select the **Compliance Polices** node. +1. In the **Assets and Compliance** workspace, expand **Compliance Settings**, then select the **Compliance Policies** node. 1. Click **Create Compliance Policy** in the ribbon to bring up the **Create Compliance Policy Wizard**. 1. On the **General** page, select **Compliance rules for devices managed with the Configuration Manager client**. - Devices must be managed with the Configuration Manager client to include custom configuration baselines as part of compliance policy assessment. @@ -126,7 +126,7 @@ When `User1` uses `Device2`, only `Configuration Baseline 2` gets evaluated when 1. Click **OK**, then **Next** to get to the **Summary** page. 1. Verify your selections and click **Next** then **Close**. -1. In the **Compliance Polices** node, right-click on the policy you created, and select **Deploy**. +1. In the **Compliance Policies** node, right-click on the policy you created, and select **Deploy**. 1. Choose your collection, alert generation settings, and your compliance evaluation schedule for the policy. 1. Click **OK** to deploy the compliance policy. diff --git a/memdocs/configmgr/core/get-started/2019/includes/1910/3608345.md b/memdocs/configmgr/core/get-started/2019/includes/1910/3608345.md index c9c8d39955a..c1bcfebbbe3 100644 --- a/memdocs/configmgr/core/get-started/2019/includes/1910/3608345.md +++ b/memdocs/configmgr/core/get-started/2019/includes/1910/3608345.md @@ -51,7 +51,7 @@ Try to complete the tasks. Then send [Feedback](../../../../understand/product-f #### Create and deploy a compliance policy with a rule for baseline compliance policy assessment -1. In the **Assets and Compliance** workspace, expand **Compliance Settings**, then select the **Compliance Polices** node. +1. In the **Assets and Compliance** workspace, expand **Compliance Settings**, then select the **Compliance Policies** node. 1. Click **Create Compliance Policy** in the ribbon to bring up the **Create Compliance Policy Wizard**. 1. On the **General** page, select **Compliance rules for devices managed with the Configuration Manager client**. - Devices must be managed with the Configuration Manager client to include custom configuration baselines as part of compliance policy assessment. @@ -62,7 +62,7 @@ Try to complete the tasks. Then send [Feedback](../../../../understand/product-f 1. Click **OK**, then **Next** to get to the **Summary** page. 1. Verify your selections and click **Next** then **Close**. -1. In the **Compliance Polices** node, right-click on the policy you created, and select **Deploy**. +1. In the **Compliance Policies** node, right-click on the policy you created, and select **Deploy**. 1. Choose your collection, alert generation settings, and your compliance evaluation schedule for the policy. 1. Click **OK** to deploy the compliance policy. diff --git a/memdocs/configmgr/core/get-started/2019/includes/1911/4960084.md b/memdocs/configmgr/core/get-started/2019/includes/1911/4960084.md index aafa83b0843..0c266983e01 100644 --- a/memdocs/configmgr/core/get-started/2019/includes/1911/4960084.md +++ b/memdocs/configmgr/core/get-started/2019/includes/1911/4960084.md @@ -22,7 +22,7 @@ Microsoft Intune family of products is an integrated solution for managing all o The following Microsoft management solutions are all now part of the **Microsoft Intune** brand: - [Configuration Manager](/configmgr) -- [Intune](/intune) +- [Intune](/mem/intune/fundamentals/account-sign-up) - [Desktop Analytics](../../../../../desktop-analytics/overview.md) - [Autopilot](/intune/enrollment/enrollment-autopilot) - Other features in the [Device Management Admin Console](https://techcommunity.microsoft.com/t5/enterprise-mobility-security/microsoft-intune-rolls-out-an-improved-streamlined-endpoint/ba-p/937760) diff --git a/memdocs/configmgr/core/get-started/2020/includes/2010/7752243.md b/memdocs/configmgr/core/get-started/2020/includes/2010/7752243.md index 8ac75c4ca11..fae4c202b12 100644 --- a/memdocs/configmgr/core/get-started/2020/includes/2010/7752243.md +++ b/memdocs/configmgr/core/get-started/2020/includes/2010/7752243.md @@ -34,6 +34,6 @@ Try to complete the tasks. Then send [Feedback](../../technical-preview-2003.md# 1. Select **OK** to deploy the policy. > [!Tip] -> Create new policies to target Windows Server operating systems. Existing Windows Defender Application Control polices won't work with Windows Server operating systems. +> Create new policies to target Windows Server operating systems. Existing Windows Defender Application Control policies won't work with Windows Server operating systems. diff --git a/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1709.md b/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1709.md index 6811f8770a6..baef08073df 100644 --- a/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1709.md +++ b/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1709.md @@ -106,7 +106,7 @@ The following are general prerequisites for you to enable co-management: After you enable co-management, Configuration Manager continues to manage all workloads. When you decide that you are ready, you can have Intune start managing available workloads. In this release, you can have Intune manage the following workloads. #### Compliance policies -Compliance policies define the rules and settings that a device must comply with to be considered compliant by conditional access polices. You can also use compliance policies to monitor and remediate compliance issues with devices independently of conditional access. +Compliance policies define the rules and settings that a device must comply with to be considered compliant by conditional access policies. You can also use compliance policies to monitor and remediate compliance issues with devices independently of conditional access. #### Windows Update for Business policies Windows Update for Business policies let you configure deferral policies for Windows 10 feature updates or quality updates for Windows 10 devices managed directly by Windows Update for Business. For details, see [Configure Windows Update for Business deferral policies](/sccm/sum/deploy-use/integrate-windows-update-for-business-windows-10#configure-windows-update-for-business-deferral-policies). diff --git a/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1805.md b/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1805.md index 78778665cb2..5c9df06f66b 100644 --- a/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1805.md +++ b/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1805.md @@ -145,7 +145,7 @@ The following management insight rules have actions in this release: ## Transition device configuration workload to Intune using co-management -You can now transition the device configuration workload from Configuration Manager to Intune after enabling co-management. Transitioning this workload lets you use Intune to deploy MDM polices, while continuing to use Configuration Manager for deploying applications. +You can now transition the device configuration workload from Configuration Manager to Intune after enabling co-management. Transitioning this workload lets you use Intune to deploy MDM policies, while continuing to use Configuration Manager for deploying applications. To transition this workload, go to the co-management properties page and move the slider bar from Configuration Manager to **Pilot** or **All**. For more information, see [Co-management for Windows 10 devices](../../comanage/overview.md). diff --git a/memdocs/configmgr/core/misc/media/overview-page.png b/memdocs/configmgr/core/misc/media/overview-page.png deleted file mode 100644 index 0243e8c6f53..00000000000 Binary files a/memdocs/configmgr/core/misc/media/overview-page.png and /dev/null differ diff --git a/memdocs/configmgr/core/misc/media/proactive-remediations-create.png b/memdocs/configmgr/core/misc/media/proactive-remediations-create.png deleted file mode 100644 index e181cfe36c8..00000000000 Binary files a/memdocs/configmgr/core/misc/media/proactive-remediations-create.png and /dev/null differ diff --git a/memdocs/configmgr/core/misc/media/proactive-remediations-device-status.png b/memdocs/configmgr/core/misc/media/proactive-remediations-device-status.png deleted file mode 100644 index 4ffe66a3986..00000000000 Binary files a/memdocs/configmgr/core/misc/media/proactive-remediations-device-status.png and /dev/null differ diff --git a/memdocs/configmgr/core/misc/media/proactive-remediations-report-overview.png b/memdocs/configmgr/core/misc/media/proactive-remediations-report-overview.png deleted file mode 100644 index 38e02a8faba..00000000000 Binary files a/memdocs/configmgr/core/misc/media/proactive-remediations-report-overview.png and /dev/null differ diff --git a/memdocs/configmgr/core/misc/media/proactive-remediations-script-settings.png b/memdocs/configmgr/core/misc/media/proactive-remediations-script-settings.png deleted file mode 100644 index 0dc7612ae9a..00000000000 Binary files a/memdocs/configmgr/core/misc/media/proactive-remediations-script-settings.png and /dev/null differ diff --git a/memdocs/configmgr/core/misc/media/recommended-software.png b/memdocs/configmgr/core/misc/media/recommended-software.png deleted file mode 100644 index dea56fd79f5..00000000000 Binary files a/memdocs/configmgr/core/misc/media/recommended-software.png and /dev/null differ diff --git a/memdocs/configmgr/core/plan-design/changes/whats-new-in-version-1910.md b/memdocs/configmgr/core/plan-design/changes/whats-new-in-version-1910.md index 3d9cec79770..a19c65d8522 100644 --- a/memdocs/configmgr/core/plan-design/changes/whats-new-in-version-1910.md +++ b/memdocs/configmgr/core/plan-design/changes/whats-new-in-version-1910.md @@ -38,7 +38,7 @@ The Microsoft Intune family of products is an integrated solution for managing a The following Microsoft management solutions are all now part of the Microsoft Intune family of products: - [Configuration Manager](/configmgr) -- [Intune](/intune) +- [Intune](/mem/intune/fundamentals/account-sign-up) - [Desktop Analytics](../../../desktop-analytics/overview.md) - [Autopilot](/intune/enrollment/enrollment-autopilot) - Other features in the [Device Management Admin Console](https://techcommunity.microsoft.com/t5/enterprise-mobility-security/microsoft-intune-rolls-out-an-improved-streamlined-endpoint/ba-p/937760) diff --git a/memdocs/configmgr/core/plan-design/hierarchy/accounts.md b/memdocs/configmgr/core/plan-design/hierarchy/accounts.md index 6a23513502e..bd3e33d9388 100644 --- a/memdocs/configmgr/core/plan-design/hierarchy/accounts.md +++ b/memdocs/configmgr/core/plan-design/hierarchy/accounts.md @@ -2,12 +2,12 @@ title: Accounts used titleSuffix: Configuration Manager description: Identify and manage the Windows groups, accounts, and SQL Server objects used in Configuration Manager. -ms.date: 03/29/2022 +ms.date: 09/04/2024 ms.subservice: core-infra ms.service: configuration-manager ms.topic: reference -author: Banreet -ms.author: banreetkaur +author: BalaDelli +ms.author: baladell manager: apoorvseth ms.localizationpriority: medium ms.collection: tier3 @@ -20,6 +20,9 @@ ms.reviewer: mstewart,aaroncz Use the following information to identify the Windows groups, accounts, and SQL Server objects that are used in Configuration Manager, how they're used, and any requirements. +> [!IMPORTANT] +> If you are specifying an account in a remote domain or forest, be sure to specify the domain FQDN before the user name and not just the domain NetBIOS name. For example, specify Corp.Contoso.com\UserName instead of just Corp\UserName. This allows Configuration Manager to use Kerberos when the account is used to authenticate to the remote site system. Using the FQDN often fixes authentication failures resulting from recent hardening changes around NTLM in Windows monthly updates. + - [Windows groups that Configuration Manager creates and uses](#bkmk_groups) - [Configuration Manager_CollectedFilesAccess](#configmgr_collectedfilesaccess) - [Configuration Manager_DViewAccess](#configmgr_dviewaccess) @@ -361,12 +364,16 @@ The site server uses the **Exchange Server connection account** to connect to th ### Management point connection account -The management point uses the **Management point connection account** to connect to the Configuration Manager site database. It uses this connection to send and retrieve information for clients. The management point uses its computer account by default, but you can configure a user account instead. When the management point is in an untrusted domain from the site server, you must specify a user account. +The management point uses the **Management point connection account** to connect to the Configuration Manager site database. It uses this connection to send and retrieve information for clients. The management point uses its computer account by default, but you can configure an alternate account instead. When the management point is in an untrusted domain from the site server, you must specify a alternate user account. + + > [!NOTE] + > For enhanced security posture it is recommended to leverage alternate account rather than Computer account for ‘Management point connection account’. Create the account as a low-right local account on the computer that runs Microsoft SQL Server. > [!IMPORTANT] -> Don't grant interactive sign-in rights to this account. +> - Don't grant interactive sign-in rights to this account. +> - If you are specifying an account in a remote domain or forest, be sure to specify the domain FQDN before the user name and not just the domain NetBIOS name. For example, specify Corp.Contoso.com\UserName instead of just Corp\UserName. This allows Configuration Manager to use Kerberos when the account is used to authenticate to the remote site system. Using the FQDN often fixes authentication failures resulting from recent hardening changes around NTLM in Windows monthly updates. ### Multicast connection account @@ -514,7 +521,7 @@ The site server uses the **Site system installation account** to install, reinst This account requires local administrative permissions on the target site systems. Additionally, this account must have **Access this computer from the network** in the security policy on the target site systems. > [!IMPORTANT] -> If you are specifying an account in a remote domain or forest, be sure to specify the domain FQDN before the user name and not just the domain NetBIOS name. For example, specify Corp.Contoso.com\UserName instead of just Corp\UserName. This allows Configuration Manager to use Kerberos when the account is used to authenticate to the remote site system. Using the FQDN often fixes authentication failures resulting from recent hardening changes around NTLM in Windows monthly updates. +> If you are specifying an account in a remote domain or forest, be sure to specify the domain FQDN before the user name and not just the domain NetBIOS name. For example, specify Corp.Contoso.com\UserName instead of just Corp\UserName. This allows Configuration Manager to use Kerberos when the account is used to authenticate to the remote site system. Using the FQDN often fixes authentication failures resulting from recent hardening changes around NTLM in Windows monthly updates. > [!TIP] > If you have many domain controllers and these accounts are used across domains, before you set up the site system, check that Active Directory has replicated these accounts. diff --git a/memdocs/configmgr/core/plan-design/hierarchy/media/ports.png b/memdocs/configmgr/core/plan-design/hierarchy/media/ports.png deleted file mode 100644 index a842720c901..00000000000 Binary files a/memdocs/configmgr/core/plan-design/hierarchy/media/ports.png and /dev/null differ diff --git a/memdocs/configmgr/core/servers/manage/powerbi-report-server.md b/memdocs/configmgr/core/servers/manage/powerbi-report-server.md index df5f1b0acbb..4b562ad8ae9 100644 --- a/memdocs/configmgr/core/servers/manage/powerbi-report-server.md +++ b/memdocs/configmgr/core/servers/manage/powerbi-report-server.md @@ -42,7 +42,7 @@ Save Power BI Desktop report files (.PBIX) and deploy them to the Power BI Repor > When using Configuration Manager version 2111 or earlier with Power BI Desktop (Optimized for Power BI Report Server - May 2021) or later, you may notice the following behavior: > - You might experience delays updating the data source on newly updated reports. > - You may receive `The remote server returned an error; (400) Bad Request.` errors in the **SRSRP.log**. - > For more information about the relevant change to Power BI Desktop (optimized for Power BI Report Server) May 2021, see [Change data source connection strings in Power BI reports](/power-bi/report-server/connect-data-source-apis). The version before the connection change ocurred is [January 2021](https://www.microsoft.com/download/details.aspx?id=55330). + > For more information about the relevant change to Power BI Desktop (optimized for Power BI Report Server) May 2021, see [Change data source connection strings in Power BI reports](/power-bi/report-server/connect-data-source-apis). The version before the connection change ocurred is January 2021. - Power BI integration uses the same role-based administration for reporting. - Power BI Report Server doesn't support reports that are enabled for role-based access. All report viewers will see the same results, whatever their assigned scope. diff --git a/memdocs/configmgr/core/servers/manage/powerbi-sample-reports.md b/memdocs/configmgr/core/servers/manage/powerbi-sample-reports.md index bb266095bb3..6e6afaad898 100644 --- a/memdocs/configmgr/core/servers/manage/powerbi-sample-reports.md +++ b/memdocs/configmgr/core/servers/manage/powerbi-sample-reports.md @@ -24,13 +24,13 @@ You can integrate [Power BI Report Server](/power-bi/report-server/get-started) - Configuration Manager reporting services point with [Power BI Report Server integrated](powerbi-report-server.md) -- Microsoft Power BI Desktop (Optimized for Power BI Report Server). Use a version released between September 2019 and [January 2021](https://www.microsoft.com/download/details.aspx?id=55330). For versioning information, see the [Change log for Power BI Report Server](/power-bi/report-server/changelog). +- Microsoft Power BI Desktop (Optimized for Power BI Report Server). Use a version released between September 2019 and January 2021. For versioning information, see the [Change log for Power BI Report Server](/power-bi/report-server/changelog). > [!IMPORTANT] > Use versions of Power BI Desktop: > - That are from the [Microsoft Download Center](https://www.microsoft.com/download/). Don't use a version from the Microsoft Store > - [That states they're **Optimized for Power BI Report Server**](/power-bi/report-server/install-powerbi-desktop). Don't use versions that aren't **Optimized for Power BI Report Server**. - > - That were released no earlier than September 2019 and no later than January 2021. [Microsoft Power BI Desktop (Optimized for Power BI Report Server - January 2021)](https://www.microsoft.com/download/details.aspx?id=55330) is recommended. + > - That were released no earlier than September 2019 and no later than January 2021. Microsoft Power BI Desktop (Optimized for Power BI Report Server - January 2021) is recommended. ## Download the sample reports diff --git a/memdocs/configmgr/core/servers/manage/updates.md b/memdocs/configmgr/core/servers/manage/updates.md index 5694fc7ee6d..16b889671c6 100644 --- a/memdocs/configmgr/core/servers/manage/updates.md +++ b/memdocs/configmgr/core/servers/manage/updates.md @@ -53,14 +53,13 @@ Some updates for Configuration Manager are available as both an in-console updat #### Supported versions -The following supported versions of Configuration Manager are currently available as a baseline, an update, or both: +The following supported versions`*`, of Configuration Manager are currently available as a baseline, an update, or both: | Version | Availability date | [Support end date](current-branch-versions-supported.md) | Baseline | In-console update | |-------------|-----------|------------|--------------|------------------------| | [**2403**](../../plan-design/changes/whats-new-in-version-2403.md)
(5.00.9128) | April 22, 2024 | October 22, 2025 | Yes[Note 1](#bkmk_note1) | Yes | | [**2309**](../../plan-design/changes/whats-new-in-version-2309.md)
(5.00.9122) | October 9, 2023 | April 9, 2025 | No | Yes | | [**2303**](../../plan-design/changes/whats-new-in-version-2303.md)
(5.00.9106) | April 10, 2023 | October 10, 2024 | Yes[Note 1](#bkmk_note1) | Yes | -| [**2211**](../../plan-design/changes/whats-new-in-version-2211.md)
(5.00.9096) | December 5, 2022 | June 5, 2024 | No | Yes | > [!NOTE] > The **Availability date** in this table is when the [early update ring](checklist-for-installing-update-2403.md#early-update-ring) was released. Baseline media will be available on the VLSC soon after the update is globally available. @@ -78,12 +77,17 @@ For example, search the VLSC for `Microsoft Configmgr (current branch)`. Find th > [!NOTE] > The search string may be different on other media sites. For example, on the [Visual Studio Subscriptions Portal](https://my.visualstudio.com/), search for `Microsoft Configuration Manager`. +> [!NOTE] +> `*` **Supported Versions in Configuration Manager**: In the context of Configuration Manager, the term `supported` encompasses both *engineering* and *assisted technical support*. While no further engineering development will occur for the versions in question, users will not have access to phone or online assisted technical support for these versions. However, Technical Support will assist with upgrading to a supported version of Configuration Manager. Users will resume their regular assisted technical support once Configuration Manager is upgraded to a supported version." + + #### Historical versions The following table lists historical versions of Configuration Manager current branch that are out of support: | Version | Availability date | Support end date | Baseline | In-console update | |----------------------------------|-------------------|--------------------|----------|-------------------| +| **2211**
(5.00.9096)) | December 5, 2022 | June 5, 2024 | No | Yes | | **2207**
(5.00.9088)) | August 12, 2022 | February 12, 2024 | No | Yes | | **2203**
(5.00.9078) | April 6, 2022 | October 6, 2023 | Yes | Yes | | **2111**
(5.00.9068) | December 1, 2021 | June 1, 2023 | No | Yes | diff --git a/memdocs/configmgr/develop/core/understand/media/powershellv5window.png b/memdocs/configmgr/develop/core/understand/media/powershellv5window.png deleted file mode 100644 index f6edfd4c628..00000000000 Binary files a/memdocs/configmgr/develop/core/understand/media/powershellv5window.png and /dev/null differ diff --git a/memdocs/configmgr/hotfix/2303/29166583.md b/memdocs/configmgr/hotfix/2303/29166583.md new file mode 100644 index 00000000000..d16be3c2dd6 --- /dev/null +++ b/memdocs/configmgr/hotfix/2303/29166583.md @@ -0,0 +1,62 @@ +--- +title: Management point security update for Microsoft Configuration Manager version 2303 +titleSuffix: Configuration Manager +description: Management point security update for Configuration Manager 2303 +ms.date: 09/05/2024 +ms.subservice: core-infra +ms.service: configuration-manager +ms.topic: reference +ms.assetid: b8cb0347-a26c-46e2-8ddd-8ddd61cd89a4 +author: baladelli +ms.author: baladell +manager: apoorvseth +--- + +# Management point security update for Configuration Manager 2303 + +*Applies to: Configuration Manager (current branch, version 2303)* + +## Summary of KB29166583 + +An update is available to harden the security of Configuration Manager environment. The update improves the security of connections between the management point and site server database. + + > [!NOTE] + > For enhanced security posture it is recommended to leverage alternate account rather than Computer account for ‘Management point connection account’. + +Installation of this update resolves the following security issue: + +• CVE-2024-43468 + +### Known issues + +We identified an issue after installing the hotfix. Hence this KB is no longer applicable to install and we republish this once a fix has been identified. + +### Update information for Microsoft Configuration Manager current branch, version 2303 + +This update is available in the Updates and Servicing node of the Configuration Manager console for version 2303 environments. + +### Restart information + +This update doesn't require a computer restart or a [site reset](../../core/servers/manage/modify-your-infrastructure.md#bkmk_reset) after installation. + +### Additional installation information + +After you install this update on a primary site, preexisting secondary sites must be manually updated. To update a secondary site in the Configuration Manager console, select **Administration** > **Site Configuration** > **Sites** > **Recover Secondary Site**, and then select the secondary site. The primary site then reinstalls that secondary site by using the updated files. Configurations and settings for the secondary site aren't affected by this reinstallation. The new, upgraded, and reinstalled secondary sites under that primary site automatically receive this update. + +Run the following SQL Server command on the site database to check whether the update version of a secondary site matches that of its parent primary site: + ```sql + select dbo.fnGetSecondarySiteCMUpdateStatus ('SiteCode_of_secondary_site') + ``` +If the value 1 is returned, the site is up to date, with all the hotfixes applied on its parent primary site. + +If the value 0 is returned, the site hasn't installed all the fixes that are applied to the primary site, and you should use the **Recover Secondary Site** option to update the secondary site. + +## File information +File information is available in the downloadable [KB29166583_FileList.txt](https://aka.ms/KB29166583_FileList_2303) text file. + +## Release history +- September 4, 2024: Initial hotfix release +- September 5, 2024: Hotfix revoked + +## References +[Updates and servicing for Configuration Manager](../../core/servers/manage/updates.md) diff --git a/memdocs/configmgr/hotfix/2309/29166583.md b/memdocs/configmgr/hotfix/2309/29166583.md new file mode 100644 index 00000000000..7d6598e9786 --- /dev/null +++ b/memdocs/configmgr/hotfix/2309/29166583.md @@ -0,0 +1,62 @@ +--- +title: Management point security update for Microsoft Configuration Manager version 2309 +titleSuffix: Configuration Manager +description: Management point security update for Configuration Manager 2309 +ms.date: 09/05/2024 +ms.subservice: core-infra +ms.service: configuration-manager +ms.topic: reference +ms.assetid: 19d171f9-e4fd-4d75-925c-2205be90d76c +author: Baladelli +ms.author: baladell +manager: apoorvseth +--- + +# Management point security update for Configuration Manager 2309 + +*Applies to: Configuration Manager (current branch, version 2309)* + +## Summary of KB29166583 + +An update is available to harden the security of Configuration Manager environment. The update improves the security of connections between the management point and site server database. + + > [!NOTE] + > For enhanced security posture it is recommended to leverage alternate account rather than Computer account for ‘Management point connection account’. + +Installation of this update resolves the following security issue: + +• CVE-2024-43468 + +### Known issues + +We identified an issue after installing the hotfix. Hence this KB is no longer applicable to install and we republish this once a fix has been identified. + +### Update information for Microsoft Configuration Manager current branch, version 2309 + +This update is available in the Updates and Servicing node of the Configuration Manager console for version 2309 environments. + +### Restart information + +This update doesn't require a computer restart or a [site reset](../../core/servers/manage/modify-your-infrastructure.md#bkmk_reset) after installation. + +### Additional installation information + +After you install this update on a primary site, preexisting secondary sites must be manually updated. To update a secondary site in the Configuration Manager console, select **Administration** > **Site Configuration** > **Sites** > **Recover Secondary Site**, and then select the secondary site. The primary site then reinstalls that secondary site by using the updated files. Configurations and settings for the secondary site aren't affected by this reinstallation. The new, upgraded, and reinstalled secondary sites under that primary site automatically receive this update. + +Run the following SQL Server command on the site database to check whether the update version of a secondary site matches that of its parent primary site: + ```sql + select dbo.fnGetSecondarySiteCMUpdateStatus ('SiteCode_of_secondary_site') + ``` +If the value 1 is returned, the site is up to date, with all the hotfixes applied on its parent primary site. + +If the value 0 is returned, the site hasn't installed all the fixes that are applied to the primary site, and you should use the **Recover Secondary Site** option to update the secondary site. + +## File information +File information is available in the downloadable [KB29166583_FileList.txt](https://aka.ms/KB29166583_FileList_2309) text file. + +## Release history +- September 4, 2024: Initial hotfix release +- September 5, 2024: Hotfix revoked + +## References +[Updates and servicing for Configuration Manager](../../core/servers/manage/updates.md) diff --git a/memdocs/configmgr/hotfix/2403/29166583.md b/memdocs/configmgr/hotfix/2403/29166583.md new file mode 100644 index 00000000000..4d50f97df46 --- /dev/null +++ b/memdocs/configmgr/hotfix/2403/29166583.md @@ -0,0 +1,62 @@ +--- +title: Management point security update for Microsoft Configuration Manager version 2403 +titleSuffix: Configuration Manager +description: Management point security update for Configuration Manager 2403 +ms.date: 09/05/2024 +ms.subservice: core-infra +ms.service: configuration-manager +ms.topic: reference +ms.assetid: f558a961-40c8-447b-b25c-f8f2b663cb90 +author: Baladelli +ms.author: baladell +manager: Apoorvseth +--- + +# Management point security update for Configuration Manager 2403 + +*Applies to: Configuration Manager (current branch, version 2403)* + +## Summary of KB29166583 + +An update is available to harden the security of Configuration Manager environment. The update improves the security of connections between the management point and site server database. + + > [!NOTE] + > For enhanced security posture it is recommended to leverage alternate account rather than Computer account for ‘Management point connection account’. + +Installation of this update resolves the following security issue: + +• CVE-2024-43468 + +### Known issues + +We identified an issue after installing the hotfix. Hence this KB is no longer applicable to install and we republish this once a fix has been identified. + +### Update information for Microsoft Configuration Manager current branch, version 2403 + +This update is available in the Updates and Servicing node of the Configuration Manager console for version 2403 environments. + +### Restart information + +This update doesn't require a computer restart or a [site reset](../../core/servers/manage/modify-your-infrastructure.md#bkmk_reset) after installation. + +### Additional installation information + +After you install this update on a primary site, preexisting secondary sites must be manually updated. To update a secondary site in the Configuration Manager console, select **Administration** > **Site Configuration** > **Sites** > **Recover Secondary Site**, and then select the secondary site. The primary site then reinstalls that secondary site by using the updated files. Configurations and settings for the secondary site aren't affected by this reinstallation. The new, upgraded, and reinstalled secondary sites under that primary site automatically receive this update. + +Run the following SQL Server command on the site database to check whether the update version of a secondary site matches that of its parent primary site: + ```sql + select dbo.fnGetSecondarySiteCMUpdateStatus ('SiteCode_of_secondary_site') + ``` +If the value 1 is returned, the site is up to date, with all the hotfixes applied on its parent primary site. + +If the value 0 is returned, the site hasn't installed all the fixes that are applied to the primary site, and you should use the **Recover Secondary Site** option to update the secondary site. + +## File information +File information is available in the downloadable [KB29166583_FileList.txt](https://aka.ms/KB29166583_FileList_2403) text file. + +## Release history +- September 4, 2024: Initial hotfix release +- September 5, 2024: Hotfix revoked + +## References +[Updates and servicing for Configuration Manager](../../core/servers/manage/updates.md) diff --git a/memdocs/configmgr/hotfix/TOC.yml b/memdocs/configmgr/hotfix/TOC.yml index 0773d7c555d..988bb8dbad8 100644 --- a/memdocs/configmgr/hotfix/TOC.yml +++ b/memdocs/configmgr/hotfix/TOC.yml @@ -8,13 +8,17 @@ items: - name: KB 28290310 CMG update for 2403 href: 2403/28290310.md - name: KB 28458746 Software update client fix for 2403 - href: 2403/28458746.md + href: 2403/28458746.md + - name: KB 29166583 MP security update for 2403 + href: 2403/29166583.md - name: Version 2309 items: - name: KB 24341484 Summary of changes in 2309 href: 2309/24341484.md - name: KB 25858444 Update rollup for Configuration Manager version 2309 href: 2309/25858444.md + - name: KB 29166583 MP security update for 2309 + href: 2309/29166583.md - name: Version 2303 items: - name: KB 16900870 Summary of changes in 2303 @@ -25,6 +29,8 @@ items: href: 2303/24721208.md - name: KB 25073607 Client update for Configuration Manager version 2303 href: 2303/25073607.md + - name: KB 29166583 MP security update for 2303 + href: 2303/29166583.md - name: Version 2211 items: - name: KB 15582417 Summary of changes in 2211 diff --git a/memdocs/configmgr/hotfix/index.yml b/memdocs/configmgr/hotfix/index.yml index 0325ccad57d..f85932bf3c4 100644 --- a/memdocs/configmgr/hotfix/index.yml +++ b/memdocs/configmgr/hotfix/index.yml @@ -26,7 +26,9 @@ landingContent: - text: KB 28290310 CMG update for 2403 url: 2403/28290310.md - text: KB 28458746 Software update client fix for 2403 - url: 2403/28458746.md + url: 2403/28458746.md + - text: KB 29166583 MP security update for 2403 + url: 2403/29166583.md - title: Configuration Manager 2309 linkLists: - linkListType: overview @@ -37,6 +39,8 @@ landingContent: url: 2309/26129847.md - text: 25858444 Update rollup for Configuration Manager version 2309 url: 2309/25858444.md + - text: KB 29166583 MP security update for 2309 + url: 2309/29166583.md - title: Configuration Manager 2303 linkLists: - linkListType: overview @@ -49,6 +53,8 @@ landingContent: url: 2303/24721208.md - text: 25073607 Client update for Configuration Manager version 2303 url: 2303/25073607.md + - text: KB 29166583 MP security update for 2303 + url: 2303/29166583.md - title: Configuration Manager 2211 linkLists: - linkListType: overview diff --git a/memdocs/configmgr/mdt/media/TroubleshootingReference1.jpg b/memdocs/configmgr/mdt/media/TroubleshootingReference1.jpg deleted file mode 100644 index 73afb00c1c0..00000000000 Binary files a/memdocs/configmgr/mdt/media/TroubleshootingReference1.jpg and /dev/null differ diff --git a/memdocs/configmgr/mdt/media/TroubleshootingReference10.jpg b/memdocs/configmgr/mdt/media/TroubleshootingReference10.jpg deleted file mode 100644 index 8d208386f8b..00000000000 Binary files a/memdocs/configmgr/mdt/media/TroubleshootingReference10.jpg and /dev/null differ diff --git a/memdocs/configmgr/mdt/media/TroubleshootingReference11.jpg b/memdocs/configmgr/mdt/media/TroubleshootingReference11.jpg deleted file mode 100644 index 66b0ac08090..00000000000 Binary files a/memdocs/configmgr/mdt/media/TroubleshootingReference11.jpg and /dev/null differ diff --git a/memdocs/configmgr/mdt/media/TroubleshootingReference12.jpg b/memdocs/configmgr/mdt/media/TroubleshootingReference12.jpg deleted file mode 100644 index 53487a8ec11..00000000000 Binary files a/memdocs/configmgr/mdt/media/TroubleshootingReference12.jpg and /dev/null differ diff --git a/memdocs/configmgr/mdt/media/TroubleshootingReference13.jpg b/memdocs/configmgr/mdt/media/TroubleshootingReference13.jpg deleted file mode 100644 index 79a470bffe1..00000000000 Binary files a/memdocs/configmgr/mdt/media/TroubleshootingReference13.jpg and /dev/null differ diff --git a/memdocs/configmgr/mdt/media/TroubleshootingReference14.jpg b/memdocs/configmgr/mdt/media/TroubleshootingReference14.jpg deleted file mode 100644 index 5d66e26cca7..00000000000 Binary files a/memdocs/configmgr/mdt/media/TroubleshootingReference14.jpg and /dev/null differ diff --git a/memdocs/configmgr/mdt/media/TroubleshootingReference15.jpg b/memdocs/configmgr/mdt/media/TroubleshootingReference15.jpg deleted file mode 100644 index 5ed4b06fcbf..00000000000 Binary files a/memdocs/configmgr/mdt/media/TroubleshootingReference15.jpg and /dev/null differ diff --git a/memdocs/configmgr/mdt/media/TroubleshootingReference16.jpg b/memdocs/configmgr/mdt/media/TroubleshootingReference16.jpg deleted file mode 100644 index 03eaad77813..00000000000 Binary files a/memdocs/configmgr/mdt/media/TroubleshootingReference16.jpg and /dev/null differ diff --git a/memdocs/configmgr/mdt/media/TroubleshootingReference17.jpg b/memdocs/configmgr/mdt/media/TroubleshootingReference17.jpg deleted file mode 100644 index fb81c768d51..00000000000 Binary files a/memdocs/configmgr/mdt/media/TroubleshootingReference17.jpg and /dev/null differ diff --git a/memdocs/configmgr/mdt/media/TroubleshootingReference18.jpg b/memdocs/configmgr/mdt/media/TroubleshootingReference18.jpg deleted file mode 100644 index 58191fe5058..00000000000 Binary files a/memdocs/configmgr/mdt/media/TroubleshootingReference18.jpg and /dev/null differ diff --git a/memdocs/configmgr/mdt/media/TroubleshootingReference19.jpg b/memdocs/configmgr/mdt/media/TroubleshootingReference19.jpg deleted file mode 100644 index 32ba99add2b..00000000000 Binary files a/memdocs/configmgr/mdt/media/TroubleshootingReference19.jpg and /dev/null differ diff --git a/memdocs/configmgr/mdt/media/TroubleshootingReference2.jpg b/memdocs/configmgr/mdt/media/TroubleshootingReference2.jpg deleted file mode 100644 index aeee0aff5da..00000000000 Binary files a/memdocs/configmgr/mdt/media/TroubleshootingReference2.jpg and /dev/null differ diff --git a/memdocs/configmgr/mdt/media/TroubleshootingReference20.jpg b/memdocs/configmgr/mdt/media/TroubleshootingReference20.jpg deleted file mode 100644 index c39493a659f..00000000000 Binary files a/memdocs/configmgr/mdt/media/TroubleshootingReference20.jpg and /dev/null differ diff --git a/memdocs/configmgr/mdt/media/TroubleshootingReference21.jpg b/memdocs/configmgr/mdt/media/TroubleshootingReference21.jpg deleted file mode 100644 index f6cd08e16f7..00000000000 Binary files a/memdocs/configmgr/mdt/media/TroubleshootingReference21.jpg and /dev/null differ diff --git a/memdocs/configmgr/mdt/media/TroubleshootingReference22.jpg b/memdocs/configmgr/mdt/media/TroubleshootingReference22.jpg deleted file mode 100644 index 7b4d2bd0584..00000000000 Binary files a/memdocs/configmgr/mdt/media/TroubleshootingReference22.jpg and /dev/null differ diff --git a/memdocs/configmgr/mdt/media/TroubleshootingReference23.jpg b/memdocs/configmgr/mdt/media/TroubleshootingReference23.jpg deleted file mode 100644 index 0f26b641832..00000000000 Binary files a/memdocs/configmgr/mdt/media/TroubleshootingReference23.jpg and /dev/null differ diff --git a/memdocs/configmgr/mdt/media/TroubleshootingReference24.jpg b/memdocs/configmgr/mdt/media/TroubleshootingReference24.jpg deleted file mode 100644 index a922b783786..00000000000 Binary files a/memdocs/configmgr/mdt/media/TroubleshootingReference24.jpg and /dev/null differ diff --git a/memdocs/configmgr/mdt/media/TroubleshootingReference25.jpg b/memdocs/configmgr/mdt/media/TroubleshootingReference25.jpg deleted file mode 100644 index 22a359c0489..00000000000 Binary files a/memdocs/configmgr/mdt/media/TroubleshootingReference25.jpg and /dev/null differ diff --git a/memdocs/configmgr/mdt/media/TroubleshootingReference3.jpg b/memdocs/configmgr/mdt/media/TroubleshootingReference3.jpg deleted file mode 100644 index 0b525090c5c..00000000000 Binary files a/memdocs/configmgr/mdt/media/TroubleshootingReference3.jpg and /dev/null differ diff --git a/memdocs/configmgr/mdt/media/TroubleshootingReference4.jpg b/memdocs/configmgr/mdt/media/TroubleshootingReference4.jpg deleted file mode 100644 index 77c0af7ebd5..00000000000 Binary files a/memdocs/configmgr/mdt/media/TroubleshootingReference4.jpg and /dev/null differ diff --git a/memdocs/configmgr/mdt/media/TroubleshootingReference5.jpg b/memdocs/configmgr/mdt/media/TroubleshootingReference5.jpg deleted file mode 100644 index 71b695e8b05..00000000000 Binary files a/memdocs/configmgr/mdt/media/TroubleshootingReference5.jpg and /dev/null differ diff --git a/memdocs/configmgr/mdt/media/TroubleshootingReference6.jpg b/memdocs/configmgr/mdt/media/TroubleshootingReference6.jpg deleted file mode 100644 index 4e33ea1ece2..00000000000 Binary files a/memdocs/configmgr/mdt/media/TroubleshootingReference6.jpg and /dev/null differ diff --git a/memdocs/configmgr/mdt/media/TroubleshootingReference7.jpg b/memdocs/configmgr/mdt/media/TroubleshootingReference7.jpg deleted file mode 100644 index ccbf7a3324c..00000000000 Binary files a/memdocs/configmgr/mdt/media/TroubleshootingReference7.jpg and /dev/null differ diff --git a/memdocs/configmgr/mdt/media/TroubleshootingReference8.jpg b/memdocs/configmgr/mdt/media/TroubleshootingReference8.jpg deleted file mode 100644 index 657aed3a2c7..00000000000 Binary files a/memdocs/configmgr/mdt/media/TroubleshootingReference8.jpg and /dev/null differ diff --git a/memdocs/configmgr/mdt/media/TroubleshootingReference9.jpg b/memdocs/configmgr/mdt/media/TroubleshootingReference9.jpg deleted file mode 100644 index 0ddf5bb91b4..00000000000 Binary files a/memdocs/configmgr/mdt/media/TroubleshootingReference9.jpg and /dev/null differ diff --git a/memdocs/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager.md b/memdocs/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager.md index 160fb98e04a..f3c4ce07522 100644 --- a/memdocs/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager.md +++ b/memdocs/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager.md @@ -66,7 +66,7 @@ To use Application Control with Configuration Manager, devices must be running s - Windows Server 2019 or later > [!TIP] -> Existing Application Control polices created with Configuration Manager version 2006 or earlier won't work with Windows Server. To support Windows Server, create new Application Control policies. +> Existing Application Control policies created with Configuration Manager version 2006 or earlier won't work with Windows Server. To support Windows Server, create new Application Control policies. ## Before you start diff --git a/memdocs/configmgr/sum/deploy-use/media/13507410-sum-adrfolder.png b/memdocs/configmgr/sum/deploy-use/media/13507410-sum-adrfolder.png deleted file mode 100644 index 4d5b07163ab..00000000000 Binary files a/memdocs/configmgr/sum/deploy-use/media/13507410-sum-adrfolder.png and /dev/null differ diff --git a/memdocs/configmgr/sum/get-started/media/import-catalog-update-into-wsus.png b/memdocs/configmgr/sum/get-started/media/import-catalog-update-into-wsus.png deleted file mode 100644 index b1c19c30900..00000000000 Binary files a/memdocs/configmgr/sum/get-started/media/import-catalog-update-into-wsus.png and /dev/null differ diff --git a/memdocs/configmgr/sum/get-started/media/wsus-console-import-updates.png b/memdocs/configmgr/sum/get-started/media/wsus-console-import-updates.png deleted file mode 100644 index 436348f9fed..00000000000 Binary files a/memdocs/configmgr/sum/get-started/media/wsus-console-import-updates.png and /dev/null differ diff --git a/memdocs/docfx.json b/memdocs/docfx.json index 5d2ca406ba3..89b70305144 100644 --- a/memdocs/docfx.json +++ b/memdocs/docfx.json @@ -83,7 +83,9 @@ "claydetels19", "beccarobins", "Stacyrch140", - "American-Dipper" + "American-Dipper", + "padmagit77", + "aditisrivastava07" ] }, "fileMetadata": { diff --git a/memdocs/endpoint-manager-overview.md b/memdocs/endpoint-manager-overview.md index ef76cb7a34c..2d6686dd13f 100644 --- a/memdocs/endpoint-manager-overview.md +++ b/memdocs/endpoint-manager-overview.md @@ -7,7 +7,7 @@ keywords: author: MandiOhlinger ms.author: mandia manager: dougeby -ms.date: 11/03/2023 +ms.date: 08/20/2024 ms.topic: overview ms.service: microsoft-intune ms.subservice: @@ -34,7 +34,7 @@ ms.collection: This article provides an overview of endpoint management solutions at Microsoft. -:::image type="content" source="./media/endpoint-management-microsoft.png" alt-text="Endpoint management for Microsoft includes Microsoft Intune, Windows Autopilot and Endpoint analytics. It also integrates with Microsoft Entra ID, on-premises Configuration Manager, mobile threat defense partners, Security Copilot, Microsoft 365 apps and more." lightbox="./media/endpoint-management-microsoft.png"::: +:::image type="content" source="./media/endpoint-management-microsoft.png" alt-text="Endpoint management for Microsoft includes Microsoft Intune, Windows Autopilot, and Endpoint analytics. It integrates with Microsoft Entra ID, on-premises Configuration Manager, mobile threat defense partners, Security Copilot, and Microsoft 365 apps." lightbox="./media/endpoint-management-microsoft.png"::: ## Microsoft Intune @@ -48,13 +48,14 @@ Microsoft Intune is a family of products and services. The Intune family include These products and services offer a **cloud-based unified endpoint management** solution. It simplifies management across multiple operating systems, cloud, on-premises, mobile, desktop, and virtualized endpoints. It also: -- **Supports data protection on company-owned and bring your own devices** through non-intrusive mobile application management. +- Uses the Intune service for **cloud-native mobile device management (MDM) and mobile application management (MAM)**. End users and devices only need internet access; no need for on-premises infrastructure. +- **Supports data protection on company-owned and bring your own devices** through nonintrusive mobile application management. - Empowers organizations to **provide data protection and endpoint compliance** that support a Zero Trust security model. - Brings together **device visibility, endpoint security, and data-driven insights** to increase IT efficiency. In hybrid work environments, admin tasks and end user experiences are improved. -Intune integrates with other services, including Azure Active Directory (AD), on-premises Configuration Manager, mobile threat defense (MTD) apps & services, Win32 & custom LOB apps, and more. +Intune integrates with other services, including Microsoft Entra, on-premises Configuration Manager, mobile threat defense (MTD) apps & services, Win32 & custom LOB apps, and more. -If you're moving to the cloud or are adopting more cloud-based services, Intune is a great place to start. +If you're moving to the cloud or are adopting more cloud-based services, then use Intune. For more information, go to: @@ -63,11 +64,11 @@ For more information, go to: ## Configuration Manager and co-management -Configuration Manager is an on-premises management solution that can **manage desktops, Windows servers, and laptops** that are on your network or are internet-based. You can use Configuration Manager to manage data centers, apps, software updates, and operating systems. +Configuration Manager is an on-premises management solution that uses Active Directory and Group Policy Objects (GPOs). It can **manage desktops, Windows servers, and laptops** that are on your network or are internet-based. You can use Configuration Manager to manage data centers, apps, software updates, and operating systems. -To benefit from all that's happening in Microsoft Intune, connect to the cloud with co-management. Co-management combines your existing on-premises Configuration Manager investment with some of the cloud-based features in Intune, including using the web-based Microsoft Intune admin center. +To benefit from everything that's happening in Microsoft Intune, connect your Configuration Manager to the cloud with co-management. Co-management combines your existing on-premises Configuration Manager investment with some of the cloud-based features in Intune, including using the web-based Microsoft Intune admin center. -Co-management is a great way to get started with Intune and to start moving some workloads to the cloud. +Co-management is a great way to get started with cloud-based device management, and to start moving some workloads to the cloud. For more information, go to: @@ -81,9 +82,8 @@ The Intune Suite is a collection of add-on features that are available in Intune - Remote help for secure help desk connections - Microsoft Tunnel VPN for mobile application management of devices that aren't enrolled in Intune -- Endpoint Privilege Management (EPM) so standard non-admin users can complete tasks that require elevated privileges -- Manage specialty devices, like AR/VR headsets, large smart-screen devices, and select conference room meeting devices -- And more +- Endpoint Privilege Management (EPM) so standard nonadmin users can complete tasks that require elevated privileges +- Support for specialty devices, like AR/VR headsets, large smart-screen devices, and select conference room meeting devices The suite and its individual features are available as add-ons to your existing licenses and are also licensed individually. @@ -99,7 +99,7 @@ The [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) is a The admin center also plugs-in other key device management services, including: -- [**Azure AD Privileged Identity Management** to monitor access to important resources](/azure/active-directory/privileged-identity-management/pim-configure) +- [**Microsoft Entra Privileged Identity Management** to monitor access to important resources](/azure/active-directory/privileged-identity-management/pim-configure) - [**Microsoft Tunnel** VPN gateway solution that runs on Linux](./intune/protect/microsoft-tunnel-overview.md) - [**Mobile threat defense** partners](./intune/protect/mobile-threat-defense.md) - [**Remote Help** for remote assistance](/mem/intune/fundamentals/remote-help) @@ -109,29 +109,40 @@ The admin center also plugs-in other key device management services, including: ## Microsoft Entra ID -Microsoft Entra ID, previously known as Azure Active Directory (Azure AD), is a cloud-native service that's used by Intune to **manage the identities of users, devices, and groups**. The Intune policies you create are assigned to these users, devices, and groups. When devices are enrolled in Intune, your users sign in to their devices with their Azure AD accounts (`user@contoso.com`). +Microsoft Entra ID, previously known as Azure Active Directory (Azure AD), is a cloud-native service that's used by Intune to **manage the identities of users, devices, and groups**. The Intune policies you create are assigned to these users, devices, and groups. When devices are enrolled in Intune, your users sign in to their devices with their Microsoft Entra accounts (`user@contoso.com`). -**Azure AD Premium**, which may be an extra cost, has [more features](https://azure.microsoft.com/pricing/details/active-directory/) to help protect devices, apps, and data, including dynamic groups, automatic enrollment in Intune, and conditional access. +**Microsoft Entra** has [different license plans that include more features](https://www.microsoft.com/security/business/microsoft-entra-pricing) to help protect devices, apps, and data, including dynamic groups, automatic enrollment in Intune, and Conditional Access. For more information, go to: - [Add users](./intune/fundamentals/users-add.md) - [Set up auto enrollment](./intune/enrollment/windows-enroll.md) -- [Learn about conditional access and Intune](./intune/protect/conditional-access.md) +- [Learn about Conditional Access and Intune](./intune/protect/conditional-access.md) ## Windows Autopilot -Windows Autopilot is a cloud-native service that **sets up and preconfigures devices**, getting them ready for use. It can also reset and repurpose existing devices. It's designed to simplify the lifecycle of Windows devices from initial deployment through end of life, benefitting IT and end users. +Windows Autopilot is a cloud-native service that **sets up and preconfigures devices**, getting them ready for use. It can also reset and repurpose existing devices. Windows Autopilot is designed to simplify the lifecycle of Windows devices from initial deployment through end of life, which benefits IT and end users. -Use Windows Autopilot to preconfigure devices, automatically join devices to Azure AD, automatically enroll the devices in Intune, customize the out of box experience (OOBE), and more. You can also integrate Windows Autopilot with Configuration Manager and co-management for more device configurations. +Use Windows Autopilot to preconfigure devices, automatically join devices to Microsoft Entra, automatically enroll the devices in Intune, customize the out of box experience (OOBE), and more. You can also integrate Windows Autopilot with Configuration Manager and co-management for more device configurations. If you constantly provision new devices or repurpose existing devices, then use Windows Autopilot. For more information, go to: -- [Windows Autopilot overview](/autopilot/overview) +- [Get an overview of Windows Autopilot](/autopilot/overview) - [Enroll Windows devices in Intune](/autopilot/enrollment-autopilot) +## Microsoft Copilot in Intune + +[Microsoft Copilot in Intune](./intune/copilot/copilot-intune-overview.md) is a **cloud-native service that uses AI to get information quickly**. Intune has capabilities that are powered by [Microsoft Copilot for Security](/security-copilot/microsoft-security-copilot). These capabilities access your Intune data, and can: + +- Help you manage your policies and settings. +- Understand your security posture. +- Troubleshoot device issues. +- Create Kusto Query Language (KQL) queries. + +For more information, go to [Microsoft Copilot in Intune](./intune/copilot/copilot-intune-overview.md). + ## Windows 365 Windows 365 Cloud PCs are **virtual machines that are hosted in the cloud-native Windows 365 service**. They're accessible from anywhere and from any device that has internet access. Cloud PCs include a Windows desktop experience and are associated with a user. @@ -164,7 +175,7 @@ Endpoint analytics is a cloud-native service that provides **metrics and recomme You can get data on: - Startup performance -- How frequently devices restart +- Device restart frequencies - A list of apps that affect end-user productivity - Recommendations on how to improve performance @@ -182,6 +193,6 @@ For more information, go to: ## Learn more - [Learn more about cloud-native endpoints](./solutions/cloud-native-endpoints/cloud-native-endpoints-overview.md) -- [Microsoft 365 Feature comparison and licensing](https://www.microsoft.com/licensing/product-licensing/microsoft-365-enterprise) -- [Microsoft Intune licensing](./intune/fundamentals/licenses.md) +- [Compare Microsoft 365 features and licensing](https://www.microsoft.com/licensing/product-licensing/microsoft-365-enterprise) +- [Learn more about Microsoft Intune licensing](./intune/fundamentals/licenses.md) - [Get started with Microsoft Intune](./intune/fundamentals/get-started-with-intune.md) diff --git a/memdocs/intune/apps/app-configuration-managed-home-screen-app.md b/memdocs/intune/apps/app-configuration-managed-home-screen-app.md index a5d2cf28c6e..2b5947a2204 100644 --- a/memdocs/intune/apps/app-configuration-managed-home-screen-app.md +++ b/memdocs/intune/apps/app-configuration-managed-home-screen-app.md @@ -8,7 +8,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 07/08/2024 +ms.date: 08/12/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: apps @@ -33,13 +33,13 @@ ms.custom: intune-azure # Configure the Microsoft Managed Home Screen app for Android Enterprise -The Managed Home Screen is the application used for corporate-owned Android Enterprise dedicated devices enrolled via Intune and running in multi-app kiosk mode. For these devices, the Managed Home Screen acts as the launcher for other approved apps to run on top of it. The Managed Home Screen provides IT admins the ability to customize their devices and to restrict the capabilities that the end user can access. For even more details, see [How to setup Microsoft Managed Home Screen on Dedicated devices in multi-app kiosk mode](https://techcommunity.microsoft.com/t5/intune-customer-success/how-to-setup-microsoft-managed-home-screen-on-dedicated-devices/ba-p/1388060). +The Managed Home Screen is the application used for corporate-owned Android Enterprise dedicated devices and fully managed user affiliated devices enrolled via Intune and running in multi-app kiosk mode. For these devices, the Managed Home Screen acts as the launcher for other approved apps to run on top of it. The Managed Home Screen provides IT admins the ability to customize their devices and to restrict the capabilities that the end user can access. For even more details, see [How to setup Microsoft Managed Home Screen on Dedicated devices in multi-app kiosk mode](https://techcommunity.microsoft.com/t5/intune-customer-success/how-to-setup-microsoft-managed-home-screen-on-dedicated-devices/ba-p/1388060). ## When to configure the Microsoft Managed Home Screen app -First, ensure that your devices are supported. Intune supports the enrollment of Android Enterprise dedicated devices for Android devices running OS version 8.0 and above that reliably connect to Google Mobile Services. Similarly, Managed Home Screen supports Android devices running OS version 8.0 and above. +First, ensure that your devices are supported. Intune supports the enrollment of Android Enterprise dedicated devices and fully managed devices running OS version 8.0 and above that reliably connect to Google Mobile Services. Similarly, Managed Home Screen supports Android devices running OS version 8.0 and above. -Typically, if settings are available to you through device configuration profiles (**Devices** > **Manage devices** > **Configuration**), configure the settings there. Doing so will save you time, minimize errors, and will give you a better Intune-support experience. However, some of the Managed Home Screen settings are currently only available via the **App configuration policies** pane in the Intune admin center. Use this document to learn how to configure the different settings either using the configuration designer or a JSON script. Additionally, use this document to learn what Managed Home Screen settings are available using device configuration profiles. You may also see [Dedicated device settings](../configuration/device-restrictions-android-for-work.md#device-experience) for a full list of settings available in **Devices** > **Manage devices** > **Configuration** that impact the Managed Home Screen. +Typically, if settings are available to you through device configuration profiles (**Devices** > **Manage devices** > **Configuration**), configure the settings there. Doing so will save you time, minimize errors, and will give you a better Intune-support experience. However, some of the Managed Home Screen settings are currently only available via the **App configuration policies** pane in the Intune admin center. Use this document to learn how to configure the different settings either using the configuration designer or a JSON script. Additionally, use this document to learn what Managed Home Screen settings are available using device configuration profiles. You may also see [Device settings](../configuration/device-restrictions-android-for-work.md#device-experience) for a full list of settings available in **Devices** > **Manage devices** > **Configuration** that impact the Managed Home Screen. If using App configuration, navigate to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and select **Apps** > **App configuration policies**. Add a configuration policy for **Managed devices** running **Android** and choose **Managed Home Screen** as the associated app. Select **Configuration settings** to configure the different available Managed Home Screen settings. @@ -80,10 +80,9 @@ The following table lists the Managed Home Screen available configuration keys, | Set device wall paper | string | Default | Allows you to set a wallpaper of your choice. Enter the URL of the image that you want to set as a wallpaper. | ✔️ | | Define theme color | string | light | Specify if you want Managed Home Screen to run in "light" or "dark" mode. | ❌ | | Block pinning browser web pages to MHS | bool | FALSE | Set this restriction to `true` to block users from pinning web pages from any browser onto Managed Home Screen. | ❌ | -| Enable updated user experience | bool | FALSE | Set to **true** to display the updated app design, with improvements to user workflows for usability and supportability, for MHS. If **false**, user will continue to see previous workflows on the app.

**NOTE**: Starting in August 2024, previous Managed Home Screen workflows will be removed and all devices will be required to use the updated app design. | ❌ | -| Top Bar Primary Element | choice | | Use this key to select whether the primary element of the top bar will be the device Serial Number, Device Name, or Tenant Name. This setting can only be used if **Enable sign in** key is set to **false**. If the **Enable sign in** key is set to **true**, the user's name will be shown as the primary element. **Enable updated user experience** must be set to **true** to make the top bar visible on users devices. If you select serial number, **Show serial number for all supported OS versions on MHS** must be set to `{{SerialNumber}}`. If you select device name, **Show device name for all supported OS version on MHS** must be set to `{{DeviceName}}`. | ❌ | -| Top Bar Secondary Element | choice | | Use this key to select whether the secondary element of the top bar will be the device Serial Number, Device Name, or Tenant Name. **Enable updated user experience** must be set to **true** to make the top bar visible on users devices. If you select serial number, **Show serial number for all supported OS versions on MHS** must be set to `{{SerialNumber}}`. If you select device name, **Show device name for all supported OS version on MHS** must be set to `{{DeviceName}}`. | ❌ | -| Top Bar User Name Style | choice | | Use this setting to select the style of the user's name in the top bar based on the following list:


This setting can only be used if the **Enable sign in** key is set to **true**. **Enable updated user experience** must be set to **true** to make the top bar visible on users devices. | ❌ | +| Top Bar Primary Element | choice | | Use this key to select whether the primary element of the top bar will be the device Serial Number, Device Name, or Tenant Name. This setting can only be used if **Enable sign in** key is set to **false**. If the **Enable sign in** key is set to **true**, the user's name will be shown as the primary element. If you select serial number, **Show serial number for all supported OS versions on MHS** must be set to `{{SerialNumber}}`. If you select device name, **Show device name for all supported OS version on MHS** must be set to `{{DeviceName}}`. | ❌ | +| Top Bar Secondary Element | choice | | Use this key to select whether the secondary element of the top bar will be the device Serial Number, Device Name, or Tenant Name. If you select serial number, **Show serial number for all supported OS versions on MHS** must be set to `{{SerialNumber}}`. If you select device name, **Show device name for all supported OS version on MHS** must be set to `{{DeviceName}}`. | ❌ | +| Top Bar User Name Style | choice | | Use this setting to select the style of the user's name in the top bar based on the following list:
This setting can only be used if the **Enable sign in** key is set to **true**. | ❌ | **Configurations for device peripherals and Managed Home Screen settings**: @@ -96,9 +95,9 @@ The following table lists the Managed Home Screen available configuration keys, | Show Bluetooth setting | bool | FALSE | Turning this setting to True allows the end user to turn on or off Bluetooth and to connect to different Bluetooth-capable devices. | ✔️ | | Show volume setting | bool | FALSE | Turning this setting to True allows the end user to access a volume slider to adjust media volume. | ✔️ | | Show flashlight setting | bool | FALSE | Turning this setting to True allows the end user to on or off the device's flashlight. If the device doesn't support a flashlight, then this setting won't appear, even if configured to True. | ✔️ | -| Show brightness slider | bool | FALSE | Turn this setting to TRUE to allow end users to access a brightness slider to adjust the device screen brightness. This configuration is only available when **Enable updated user experience** is set to TRUE. | ❌ | -| Show adaptive brightness toggle | bool | FALSE | Turn this setting to TRUE to allow end users to turn adaptive brightness on and off on the device. Adaptive brightness allows the device to select an optimal brightness based on ambient lighting. This configuration is only available when **Enable updated user experience** is set to TRUE. | ❌ | -| Show autorotate toggle | bool | FALSE | Turn this setting to TRUE to allow end users to access a toggle to turn on and off the device's auto-rotation setting. This configuration is only available when **Enable updated user experience** is set to TRUE.| ❌ | +| Show brightness slider | bool | FALSE | Turn this setting to TRUE to allow end users to access a brightness slider to adjust the device screen brightness. | ❌ | +| Show adaptive brightness toggle | bool | FALSE | Turn this setting to TRUE to allow end users to turn adaptive brightness on and off on the device. Adaptive brightness allows the device to select an optimal brightness based on ambient lighting. | ❌ | +| Show autorotate toggle | bool | FALSE | Turn this setting to TRUE to allow end users to access a toggle to turn on and off the device's auto-rotation setting. | ❌ | | Show device info setting | bool | FALSE | True allows end users to access quick info about the device from the Managed Setting menu. Accessible information includes device's make, model, serial number, and IPv4 and IPv6 details. On OS version 9 and newer, to let users see the device's serial number, ensure that **Show serial number for all supported OS version on MHS** is configured to display `{{SerialNumber}}`. MAC address details are available from the **Device Information** page of the Managed Home Screen (MHS) app. Use the MAC address when troubleshooting device connectivity issues. | ✔️ | | Show device's name on MHS | bool | FALSE | Turn this setting to True to easily view the device's Intune admin center "device name" property from the Managed Settings menu when **Show device info setting** is set to True. Make sure to also include the string property "Device's name," which is auto-populated by Intune with the correct value. | ❌ | | Show serial number for all supported OS version on MHS | choice | {{SerialNumber}} | Ensure that in-app config device_serial_number is configured to display {{SerialNumber}} when **Show device info setting** is set to True. This value is auto-populated by Intune with the correct value. | ❌ | @@ -106,7 +105,7 @@ The following table lists the Managed Home Screen available configuration keys, | Enable virtual home button | bool | FALSE | True allows end users to have access to a Managed Home Screen home button that will return the user to the Managed Home Screen from the current task they are in. | ✔️ | | Type of virtual home button | string | swipe_up | Use swipe_up to access home button with a swipe up gesture. Use float to access a sticky, persistent home button that can be moved around the screen by the end user. | ✔️ | | Enable notifications badge | bool | FALSE | Enables the notification badge for app icons that shows the number of new notifications on the app. If you enable this setting, end users will see notification badges on apps that have unread notifications. If you keep this configuration key disabled, the end user won't see any notification badged to apps that might have unread notifications. | ✔️ | -| Battery and Signal Strength indicator bar | bool | TRUE | Turning this setting to True shows the battery and signal strength indicator bar. | ❌ | +| Battery and Signal Strength indicator bar | bool | FALSE | Turning this setting to True shows the battery and signal strength indicator bar. | ❌ | | Type of virtual app switcher button | string | | The configuration key is `virtual_app_switcher_type` and the possible values are `none`, `float`, and `swipe_up`. Use `swipe_up` to access app switcher button with a swipe up gesture. Use `float` to access a sticky, persistent app switcher button that can be moved around the screen by the end user. | ❌ | > [!IMPORTANT] @@ -116,7 +115,10 @@ The following table lists the Managed Home Screen available configuration keys, > > On Android devices running OS 11, when an end-user tries to connect to a network via the Managed Home Screen app, they will get prompted with a consent pop-up. This pop-up comes from the Android platform, and is not specific to the Managed Home Screen app. Additionally, when an end-user tries to connect to a password protected network via the Managed Home Screen app, they will be asked to input the password. Even if the password is correct, the network will only change if the device is not connected to a network. Devices that are already connected to a stable network will not be able connect to a password protected network via the Managed Home Screen app. > -> On Android devices running OS 10, when an end-user tries to connect to a network via the Managed Home Screen app, they will get prompted with a consent via notifications. Because of this prompt, users on OS 10 will need to have access to the status bar and notifications in order to complete the consent step. Use the [General settings for dedicated devices](../configuration/device-restrictions-android-for-work.md#dedicated-devices) to make status bar and notifications available to your end-users, if appropriate. Additionally, when an end-user tries to connect to a password protected network via the Managed Home Screen app, they will be asked to input the password. Even if the password is correct, the network will only change if the device is not already connected to a stable network. +> On Android devices running OS 10, when an end-user tries to connect to a network via the Managed Home Screen app, they will get prompted with a consent via notifications. Because of this prompt, users on OS 10 will need to have access to the status bar and notifications in order to complete the consent step. Use the [General settings for fully managed and dedicated devices](../configuration/device-restrictions-android-for-work.md#dedicated-devices) to make status bar and notifications available to your end-users, if appropriate. Additionally, when an end-user tries to connect to a password protected network via the Managed Home Screen app, they will be asked to input the password. Even if the password is correct, the network will only change if the device is not already connected to a stable network. + +> [!IMPORTANT] +> End users cannot automatically connect to Enterprise Wi-Fi networks they select from the MHS settings menu, even if that network has been pre-configured using either Intune or another external source. While managed devices can still reliably utilize these networks, end users cannot initialize a connection from within MHS to the preconfigured networks. > [!IMPORTANT] > For devices running on Android 10+ and using Managed Home Screen, for Bluetooth pairing to successfully work on devices that require a pairing key, admins must enable the following Android system apps: @@ -167,8 +169,8 @@ The following table lists the Managed Home Screen available configuration keys, |-|-|-|-|-| | Enable sign in | bool | FALSE | Turn this setting to True to enable end-users to sign into Managed Home Screen. When used with Microsoft Entra shared device mode, users who sign in to Managed Home Screen will get automatically signed in to all other apps on the device that have participated with Microsoft Entra shared device mode. By default this setting is off. | ✔️

NOTE: On devices that have a device configuration profile with the [**Enabled System Navigation Features** setting](../configuration/device-restrictions-android-for-work.md#dedicated-devices) set to **Home and Overview buttons**, end users can ignore and skip the sign in screen. | | Sign in type | string | Microsoft Entra ID | Set this configuration to "AAD" to sign in with a Microsoft Entra account. Otherwise, set this configuration to "Other". Users who sign in with a non-AAD account won't get single sign-on to all apps that have integrated with Microsoft Entra shared device mode, but will still get signed in to Managed Home Screen. By default, this setting uses "AAD" user accounts. This setting can only be used if **Enable sign in** has been set to True. | ✔️ | -| Domain name | string | | Set a domain name to be appended to usernames for sign in. If this is not set, users will need to enter the domain name. To allow users to select between multiple domain name options, add semicolon delimited strings. Enable sign in must be set to TRUE to use this configuration. This configuration is only available when **Enable updated user experience** is set to TRUE.

**NOTE**: This setting does not prevent users from inputting alternative domain names. | ❌ | -| Login hint text | string | | Set a custom login hint string by entering a string. If no string is set, the default string "Enter email or phone number" will be displayed. Enable sign in must be set to TRUE to use this configuration. This configuration is only available when **Enable updated user experience** is set to TRUE. | ❌ | +| Domain name | string | | Set a domain name to be appended to usernames for sign in. If this is not set, users will need to enter the domain name. To allow users to select between multiple domain name options, add semicolon delimited strings. Enable sign in must be set to TRUE to use this configuration.

**NOTE**: This setting does not prevent users from inputting alternative domain names. | ❌ | +| Login hint text | string | | Set a custom login hint string by entering a string. If no string is set, the default string "Enter email or phone number" will be displayed. Enable sign in must be set to TRUE to use this configuration. | ❌ | | Set to the url of wallpaper | string | | Allows you to set a wallpaper of your choice for the sign in screen. To use this setting, enter the URL of the image that you want set for the sign-in screen wallpaper. This image can be different than the Managed Home Screen wallpaper that is configured with **Set device wallpaper**. This setting can only be used if **Enable sign in** has been set to True. | ✔️ | | Enable show organization logo on sign in page | bool | TRUE | Turn this setting to True to use a company logo that will appear on the sign-in screen. This setting is used with **Organization logo on sign in page** and can only be used if **Enable sign in** has been set to TRUE. | ✔️ | | Organization logo on sign in page | string | | Allows you to brand your device with a logo of your choice on the Managed Home Screen sign-in screen. To use this setting, enter the URL of the image that you want set for the logo. This setting can only be used if **Enable show organization logo on sign in page** and **Enable sign in** have been set to True. | ✔️ | @@ -178,7 +180,7 @@ The following table lists the Managed Home Screen available configuration keys, | Maximum number of attempts for session PIN | string | | Define the maximum number of times a user can attempt to enter their session PIN before getting automatically logged out from Managed Home Screen. The default value is zero (0), where zero (0) means the user gets infinite tries. This can be used with any of the complexity values for session PIN. This setting can only be used if **Enable session PIN** and **Enable sign in** have been set to True. | ❌ | | Customer facing folder | Bool | FALSE | Use this specification with **Create Managed Folder for grouping apps** to create a folder that can't be exited without a user entering their Session PIN. This setting can only be used if **Enable session PIN** and **Enable sign in** have been set to True. | ❌ | | Require PIN code after returning from screensaver | bool | FALSE | Turn this setting True if you want to require end-users to enter their Session PIN to resume activity on Managed Home Screen after the screensaver has appeared. This setting can only be used if **Enable sign in** has been set to True. | ✔️ | -| Minimum inactive time before session PIN is required | int | | The number of seconds the device is inactive before end-user input of session PIN is required. If set to 0, the device will always require PIN after screen saver, regardless of the inactive time. This configuration is only available when **Require PIN code after returning from screensaver** and **Enable updated user experience** are set to TRUE. | ✔️ | +| Minimum inactive time before session PIN is required | int | | The number of seconds the device is inactive before end-user input of session PIN is required. If set to 0, the device will always require PIN after screen saver, regardless of the inactive time. This configuration is only available when **Require PIN code after returning from screensaver** is set to TRUE. | ✔️ | | Enable auto sign-out | bool | FALSE | Turn this setting to True to automatically sign current user out of Managed Home Screen after a specified period of inactivity. When used with Microsoft Entra shared device mode, users will also get signed out of all apps on the device that participate with Microsoft Entra shared device mode. By default, this setting is turned off. This setting can only be used if **Enable sign in** has been set to True. | ✔️ | | Auto sign-out time | integer | 300 | Set a period of inactivity, in seconds, that can pass before user gets automatically signed out of Managed Home Screen. This setting can only be used if **Enable auto sign-out** and **Enable sign in** have been set to True. | ✔️ | | Count down time on auto sign-out dialog | integer | 60 | The amount of time, in seconds, to give notice to user before signing them out of Managed Home Screen. This setting can only be used if **Enable auto sign-out** and **Enable sign in** have been set to True. | ✔️ | @@ -348,10 +350,6 @@ The following syntax is an example JSON script with all the available configurat "key": "device_name", "valueString": "{{DeviceName}}" }, - { - "key": "enable_updated_user_experience", - "valueBool": false - }, { "key": "header_primary_element", "valueString": "Tenant Name" @@ -706,8 +704,8 @@ The following syntax is an example JSON script with all the available configurat ``` ## Managed Home Screen debug screen -You can access the Managed Home Screen's debug screen by selecting the **back** button until the debug screen is displayed (select the **back** button 15 times or more). From this debug screen, you can launch the Android Device Policy application, view and upload logs, or temporarily pause kiosk mode to update the device. For more information about pausing kiosk mode, see the **Leave kiosk mode** item in the Android Enterprise [dedicated device settings](../configuration/device-restrictions-android-for-work.md#device-experience). If you would like an easier way to access Managed Home Screen's debug screen, you can enable the **Quick access to debug menu** setting using device configuration policies or you can set the **Enable easy access debug menu** to `True` using application configuration policies. +You can access the Managed Home Screen's debug screen by selecting the **back** button until the debug screen is displayed (select the **back** button 15 times or more). From this debug screen, you can launch the Android Device Policy application, view and upload logs, or temporarily pause kiosk mode to update the device. For more information about pausing kiosk mode, see the **Leave kiosk mode** item in the Android Enterprise [fully managed and dedicated devices settings](../configuration/device-restrictions-android-for-work.md#device-experience). If you would like an easier way to access Managed Home Screen's debug screen, you can enable the **Quick access to debug menu** setting using device configuration policies or you can set the **Enable easy access debug menu** to `True` using application configuration policies. ## Next steps -- For more information about Android Enterprise dedicated devices, see [Set up Intune enrollment of Android Enterprise dedicated devices](../enrollment/android-kiosk-enroll.md). +- For more information about Android Enterprise dedicated devices, see [Set up Intune enrollment of Android Enterprise dedicated devices](../enrollment/android-kiosk-enroll.md). For more information about Android Enterprise fully managed devices, see [Set up enrollment for Android Enterprise fully managed devices](../enrollment/android-fully-managed-enroll.md). diff --git a/memdocs/intune/apps/app-configuration-policies-use-android.md b/memdocs/intune/apps/app-configuration-policies-use-android.md index 0f0c6e7e1cb..f033814e503 100644 --- a/memdocs/intune/apps/app-configuration-policies-use-android.md +++ b/memdocs/intune/apps/app-configuration-policies-use-android.md @@ -8,7 +8,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 10/05/2023 +ms.date: 08/08/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: apps diff --git a/memdocs/intune/apps/app-discovered-apps.md b/memdocs/intune/apps/app-discovered-apps.md index 6757625ec60..86474c2e248 100644 --- a/memdocs/intune/apps/app-discovered-apps.md +++ b/memdocs/intune/apps/app-discovered-apps.md @@ -8,7 +8,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 05/20/2024 +ms.date: 08/08/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: apps @@ -42,9 +42,15 @@ Intune provides an aggregated list of detected apps on the Intune enrolled devic 2. Select **Apps** > **Monitor** > **Discovered apps**. >[!NOTE] ->You can export the list of discovered apps to a .csv file by selecting **Export** from the **Discovered apps** pane. -> ->For discovered Win32 apps, there currently is no aggregate count. This type of data can only be viewed on a per-device basis. +>You can export the list of discovered apps to a *.csv* file by selecting **Export** from the **Discovered apps** pane. + +The **Discovered apps** report provides the following details: + +- Application name +- Platform +- Application version +- Device count +- Application publisher Intune also provides the list of discovered apps for the individual device in your tenant. diff --git a/memdocs/intune/apps/app-lifecycle.md b/memdocs/intune/apps/app-lifecycle.md index 215f0834e4e..7bfa42f10c1 100644 --- a/memdocs/intune/apps/app-lifecycle.md +++ b/memdocs/intune/apps/app-lifecycle.md @@ -41,7 +41,7 @@ The first step in app deployment is to add the apps, which you want to manage an ## Deploy -After you've added the app to Intune, you can then [assign it to users and devices that you manage](apps-deploy.md). Intune makes this process easy, and after the app is deployed, you can [monitor the success](apps-monitor.md) of the deployment from the Intune within the portal. Additionally, in some app stores, such as the [Apple](vpp-apps-ios.md) and [Windows](windows-store-for-business.md) app stores, you can purchase app licenses in bulk for your company. Intune can synchronize data with these stores so that you can deploy and track license usage for these types of apps right from the Intune administration console. +After you've added the app to Intune, you can then [assign it to users and devices that you manage](apps-deploy.md). Intune makes this process easy, and after the app is deployed, you can [monitor the success](apps-monitor.md) of the deployment from the Intune within the portal. Additionally, in some app stores, such as the [Apple](vpp-apps-ios.md) app store, you can purchase app licenses in bulk for your company. Intune can synchronize data with these stores so that you can deploy and track license usage for these types of apps right from the Intune administration console. ## Configure diff --git a/memdocs/intune/apps/app-management.md b/memdocs/intune/apps/app-management.md index 2d453cfa146..1131da1b39e 100644 --- a/memdocs/intune/apps/app-management.md +++ b/memdocs/intune/apps/app-management.md @@ -8,7 +8,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 03/20/2024 +ms.date: 08/09/2024 ms.topic: overview ms.service: microsoft-intune ms.subservice: apps @@ -24,12 +24,12 @@ ms.suite: ems search.appverid: MET150 #ms.tgt_pltfrm: ms.custom: intune-azure; get-started +ai-usage: ai-assisted ms.collection: - tier1 - M365-identity-device-management - highpri - highseo -- AI-Assisted - FocusArea_Apps_AppManagement --- @@ -105,7 +105,7 @@ The top of the App workload navigation menu provides commonly used app details: - **Overview**: Select this option to view the tenant name, the MDM authority, the tenant location, the account status, app installation status, and app protection policy status. - **All apps**: Select this option to display a list of all available apps. You can add additional apps from this page. Additionally, you can see the status of each app, as well as whether each app is assigned. For more information, see [Add apps](apps-add.md) and [Assign apps](apps-deploy.md). - **Monitor** - - **App licenses**: View, assign, and monitor volume-purchased apps from the app stores. For more information, see [iOS volume-purchased program (VPP) apps](vpp-apps-ios.md) and [Microsoft Store for Business volume-purchased apps](windows-store-for-business.md). + - **App licenses**: View, assign, and monitor volume-purchased apps from the app stores. For more information, see [iOS volume-purchased program (VPP) apps](vpp-apps-ios.md). - **Discovered apps**: View apps that were assigned by Intune or installed on a device. For more information, see [Intune discovered apps](app-discovered-apps.md). - **App install status**: View the status of an app assignment that you created. For more information, see [Monitor app information and assignments with Microsoft Intune](apps-monitor.md#device-and-user-status-graphs). - **App Protection status**: View the status of an app protection policy for a user that you select. @@ -133,7 +133,6 @@ The top of the App workload navigation menu provides commonly used app details: ## Additional information The following items within the console provide app related functionality: -- **Microsoft Store for Business**: Set up integration to the Microsoft Store for Business. Afterward, you can synchronize purchased applications to Intune, assign them, and track your license usage. For more information, see [Microsoft Store for Business volume-purchased apps](windows-store-for-business.md). - **Windows enterprise certificate**: Apply or view the status of a code-signing certificate that's used to distribute line-of-business apps to your managed Windows devices. - **Windows Symantec certificate**: Apply or view the status of a Symantec code-signing certificate. - **Windows side loading keys**: Add a Windows side-loading key that can be used to install an app directly to devices rather than publishing and downloading the app from the Windows store. For more information, see [Side-load a Windows app](app-sideload-windows.md). diff --git a/memdocs/intune/apps/app-protection-framework.md b/memdocs/intune/apps/app-protection-framework.md index 2bed001a63f..8b029770123 100644 --- a/memdocs/intune/apps/app-protection-framework.md +++ b/memdocs/intune/apps/app-protection-framework.md @@ -75,7 +75,7 @@ Administrators can incorporate the below configuration levels within their ring ### Conditional Access Policies -To ensure that only apps supporting App Protection Polices access work or school account data, Microsoft Entra Conditional Access policies are required. These policies are described in [Conditional Access: Require approved client apps or app protection policy](/azure/active-directory/conditional-access/howto-policy-approved-app-or-app-protection). +To ensure that only apps supporting App Protection Poliies access work or school account data, Microsoft Entra Conditional Access policies are required. These policies are described in [Conditional Access: Require approved client apps or app protection policy](/azure/active-directory/conditional-access/howto-policy-approved-app-or-app-protection). See **Require approved client apps or app protection policy with mobile devices** in [Conditional Access: Require approved client apps or app protection policy](/azure/active-directory/conditional-access/howto-policy-approved-app-or-app-protection) for steps to implement the specific policies. Finally, implement the steps in [Block legacy authentication](/azure/active-directory/conditional-access/block-legacy-authentication) to block legacy authentication capable iOS and Android apps. diff --git a/memdocs/intune/apps/app-protection-policies.md b/memdocs/intune/apps/app-protection-policies.md index ebb1971c394..11db27a5ad0 100644 --- a/memdocs/intune/apps/app-protection-policies.md +++ b/memdocs/intune/apps/app-protection-policies.md @@ -81,7 +81,7 @@ When you create an app protection policy for iOS/iPadOS and Android apps, you fo |:-------------|:-----------------------------------------------| | Target policy to | In the **Target policy to** dropdown box, choose to target your app protection policy to **All Apps**, **Microsoft Apps**, or **Core Microsoft Apps**.

Next, you can select **View a list of the apps that will be targeted** to view a list of the apps that will be affected by this policy.| | Public apps | If you don't want to select one of the predefined app groups, you can choose to target individual apps by selecting **Selected apps** in the **Target policy to** dropdown box. Click **Select public apps** to select public apps to target. | - | Custom apps | If you don't want to select one of the predefined app groups, you can choose to target individual apps by selecting **Selected apps** in the **Target policy to** dropdown box. Click **Select custom apps** to select custom apps to target based on a Bundle ID. You cannot choose a custom app when targeting all public apps in the same policy. | + | Custom apps | If you don't want to select one of the predefined app groups, you can choose to target individual apps by selecting **Selected apps** in the **Target policy to** dropdown box. Click **Select custom apps** to select custom apps to target based on a Bundle ID. You cannot choose a custom app when also targeting the options **All Apps**, **Microsoft Apps**, or **Core Microsoft Apps** in the same policy. | The app(s) you have selected will appear in the public and custom apps list. diff --git a/memdocs/intune/apps/app-protection-policy.md b/memdocs/intune/apps/app-protection-policy.md index 899250a9766..523604b534d 100644 --- a/memdocs/intune/apps/app-protection-policy.md +++ b/memdocs/intune/apps/app-protection-policy.md @@ -8,7 +8,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 07/30/2024 +ms.date: 08/09/2024 ms.topic: overview ms.service: microsoft-intune ms.subservice: apps @@ -25,11 +25,11 @@ ms.suite: ems search.appverid: MET150 #ms.tgt_pltfrm: ms.custom: intune-azure, get-started +ai-usage: ai-assisted ms.collection: - tier1 - M365-identity-device-management - highpri -- AI-Assisted --- # App protection policies overview @@ -84,7 +84,7 @@ The important benefits of using App protection policies are the following: There are additional benefits to using MDM with App protection policies, and companies can use App protection policies with and without MDM at the same time. For example, consider an employee that uses both a phone issued by the company, and their own personal tablet. The company phone is enrolled in MDM and protected by App protection policies while the personal device is protected by App protection policies only. -If you apply a MAM policy to the user without setting the device state, the user will get the MAM policy on both the BYOD device and the Intune-managed device. You can also apply a MAM policy based on the managed state. So when you create an app protection policy, next to **Target to all app types**, you'd select **No**. Then do any of the following: +If you apply a MAM policy to the user without setting the device state, the user will get the MAM policy on both the BYOD device and the Intune-managed device. You can also apply MAM policies based on the device management state. For more information see, [Target app protection policies based on device management state](../apps/app-protection-policies.md#target-app-protection-policies-based-on-device-management-state). When you create an app protection policy, select **No** next to **Target to all app types**. Then, do any of the following: - Apply a less strict MAM policy to Intune managed devices, and apply a more restrictive MAM policy to non MDM-enrolled devices. - Apply a MAM policy to unenrolled devices only. diff --git a/memdocs/intune/apps/apps-add-enterprise-app.md b/memdocs/intune/apps/apps-add-enterprise-app.md index 58e10838215..9a766e65e84 100644 --- a/memdocs/intune/apps/apps-add-enterprise-app.md +++ b/memdocs/intune/apps/apps-add-enterprise-app.md @@ -6,7 +6,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 01/08/2024 +ms.date: 09/11/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: apps @@ -208,7 +208,7 @@ The **Rules format** provides the following options: The Intune agent checks the results from the script. It reads the values written by the script to the STDOUT stream, the standard error (STDERR) stream, and the exit code. If the script exits with a nonzero value, the script fails and the application detection status isn't installed. If the exit code is zero and STDOUT has data, the application detection status is installed. > [!NOTE] - > We recommend encoding your script as UTF-8. When the script exits with the value of **0**, the script execution was successful. The second output channel indicates that the app was detected. STDOUT data indicates that the app was found on the client. We don't look for a particular string from STDOUT. + > We recommend encoding your script as UTF-8 BOM. When the script exits with the value of **0**, the script execution was successful. The second output channel indicates that the app was detected. STDOUT data indicates that the app was found on the client. We don't look for a particular string from STDOUT. When you add the app to Intune, the version of your Windows catalog app (Win32) is displayed in the Microsoft Intune admin center. The app version is provided in the **All apps** list, where you can filter by Windows catalog app (Win32) and select the optional **version** column. In the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Apps** > **All apps** > **Columns** > **Version** to display the app version in the app list. diff --git a/memdocs/intune/apps/apps-add-office365.md b/memdocs/intune/apps/apps-add-office365.md index 998bf547367..337e52c0f83 100644 --- a/memdocs/intune/apps/apps-add-office365.md +++ b/memdocs/intune/apps/apps-add-office365.md @@ -7,7 +7,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 08/31/2023 +ms.date: 08/08/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: apps diff --git a/memdocs/intune/apps/apps-add.md b/memdocs/intune/apps/apps-add.md index 4bb9c89ec5d..93aabf04b49 100644 --- a/memdocs/intune/apps/apps-add.md +++ b/memdocs/intune/apps/apps-add.md @@ -6,7 +6,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 05/01/2024 +ms.date: 08/09/2024 ms.topic: overview ms.service: microsoft-intune ms.subservice: apps @@ -17,12 +17,12 @@ ms.reviewer: bryanke ms.suite: ems search.appverid: MET150 ms.custom: intune-azure +ai-usage: ai-assisted ms.collection: - tier1 - M365-identity-device-management - highpri - FocusArea_Apps_Add -- AI-Assisted --- # Add apps to Microsoft Intune @@ -159,7 +159,6 @@ In addition to understanding web apps, store apps, and LOB apps, you should also - **Apple Volume Purchasing Program for Business (iOS)**: The iOS/iPadOS App Store lets you purchase multiple licenses for an app that you want to run in your company. Purchasing multiple copies helps you to efficiently manage apps in your company. For more information, see [Manage iOS/iPadOS volume-purchased apps](vpp-apps-ios.md). - **Android Enterprise fully managed work profile**: How you assign apps to Android Enterprise fully managed work profile devices differs from how you assign them to standard Android devices. All apps you install for Android Enterprise fully managed work profiles come from the Managed Google Play store. You use Intune to browse for the apps you want and approve them. The app then appears in the **Licensed apps** node of the portal, and you can manage assignment of the app as you would any other app. -- **Microsoft Store for Business (Windows 10)**: Microsoft Store for Business gives you a place to find and purchase apps for your organization, individually or in volume. By connecting the store to Microsoft Intune, you can manage volume-purchased apps in the portal. For more information, see [Manage apps from Microsoft Store for Business](windows-store-for-business.md). > [!NOTE] > The file extensions for Windows apps include **.msi**, **.appx**, **.appxbundle**, **.msix** and **.msixbundle**. @@ -208,7 +207,7 @@ When you add an app to Intune, you're given the option to select the category yo Previously, Intune contained a number of built-in apps that you could quickly assign. Based on Intune customer feedback, we removed this list, and the built-in apps are no longer displayed. However, if you have already assigned any built-in apps, the apps remain visible in the list of apps. You can continue to assign the apps as required. > [!NOTE] -> For the installation of a required non-Line-of-Business app, Intune will attempt to install the app by sending an install command whenever the device checks-in, given that the app is not detected and the app's install state is not *Install Pending*. +> For the installation of a required non-Line-of-Business app, Intune will attempt to install the app by sending an install command whenever the device checks in, given that the app is not detected and the app's install state is not *Install Pending*. ## Installing, updating, or removing required apps diff --git a/memdocs/intune/apps/apps-deploy-gcc-dod.md b/memdocs/intune/apps/apps-deploy-gcc-dod.md index 30a6f0dc30b..c244cc4e2e1 100644 --- a/memdocs/intune/apps/apps-deploy-gcc-dod.md +++ b/memdocs/intune/apps/apps-deploy-gcc-dod.md @@ -24,24 +24,11 @@ ms.collection: # Deploying apps using Intune on the GCC High and DoD Environments -Microsoft Intune can be used by tenant administrators to distribute apps to their workforce. The workforce is the company employee, the users of the apps. There are many types of apps that can be deployed from Intune on GCC High or DoD environments. If an administrator needs to upload and distribute a Windows app intended for a GCC High or DoD audience that is custom-made, created by third-party vendors, or as an offline app downloaded from the [Microsoft Store for Business](https://businessstore.microsoft.com/store), the admin can choose to distribute it as a [line-of-business app](apps-add.md#app-types-in-microsoft-intune). +Microsoft Intune can be used by tenant administrators to distribute apps to their workforce. The workforce is the company employee, the users of the apps. There are many types of apps that can be deployed from Intune on GCC High or DoD environments. If an administrator needs to upload and distribute a Windows app intended for a GCC High or DoD audience that is custom-made, created by third-party vendors, the admin can choose to distribute it as a [line-of-business app](apps-add.md#app-types-in-microsoft-intune). ## Add Windows apps using Intune -To add a Windows line-of-business app or a Win32 app intended for a GCC High or DoD environment using Intune, you can follow the [Windows LOB app](lob-apps-windows.md) or [Win32 app management](apps-win32-app-management.md) instructions. You may choose to deploy the Company Portal first from the Microsoft Store for Business. If you choose to use the Company Portal, you can manually install and deploy the Company Portal. For more information, see [How to configure the Microsoft Intune Company Portal app](company-portal-app.md). - -## Distribute Offline Apps from the Store for Business using Intune - -> [!NOTE] -> Syncronizing the Microsoft Store for Business (MSFB) with Intune is no longer possible. Admins must deploy Windows apps by uploading them directly to Intune. To get an offline version of a desired Microsoft Store app, an actual commercial account must be used to log in to MSFB to download the package. - -If you need to [download an offline-licensed app](/microsoft-store/distribute-offline-apps#download-an-offline-licensed-app) from the Microsoft Store for Business, follow these steps to download the application: - -1. Sign in to the [Store for Business](https://businessstore.microsoft.com/). -2. Select **Manage** > **Settings**. -3. Under **Shopping Experience**, set **Show offline apps** to **On**. - -When shopping for apps, if an offline version is available, you can choose to change the license type to offline. After getting the app, you can then manage it by selecting **Manage** > **Products & Services** in the [Store for Business](https://businessstore.microsoft.com/). Additionally, you can download the app and its dependencies. Then, you can deploy this downloaded app (and its dependencies) to users using Intune. +To add a Windows line-of-business app or a Win32 app intended for a GCC High or DoD environment using Intune, you can follow the [Windows LOB app](lob-apps-windows.md) or [Win32 app management](apps-win32-app-management.md) instructions. If you choose to use the Company Portal, you can manually install and deploy the Company Portal. For more information, see [How to configure the Microsoft Intune Company Portal app](company-portal-app.md). ## Compliance diff --git a/memdocs/intune/apps/apps-monitor.md b/memdocs/intune/apps/apps-monitor.md index 4da5d293552..6025ed0a3f7 100644 --- a/memdocs/intune/apps/apps-monitor.md +++ b/memdocs/intune/apps/apps-monitor.md @@ -84,7 +84,7 @@ A device status list is shown when you select **Device install status** in the * | **Device name** | The name of the device on platforms that allow naming a device **Note**: On other platforms, Intune creates a name from other properties. This attribute isn't available to any other device. | | **User name** | The name of the user | | **Platform** | The operating system of the device (Windows, iOS/iPadOS, Android, and so on) | -| **Version** | The version number of the app **Note**: For line-of-business (LOB) apps and Microsoft Store for Business apps, the full version number of the app is shown. The full version number identifies a specific release of the app. The number appears as _Version_(_Build_). For example, 2.2(2.2.17560800). For standard Store apps, no versions are shown. | +| **Version** | The version number of the app **Note**: For line-of-business (LOB) apps, the full version number of the app is shown. The full version number identifies a specific release of the app. The number appears as _Version_(_Build_). For example, 2.2(2.2.17560800). For standard Store apps, no versions are shown. | | **Status** | The status of the app | | **Status details** | The details of the status | | **Last check-in** | The date of the device's last sync with Intune | diff --git a/memdocs/intune/apps/apps-supported-intune-apps.md b/memdocs/intune/apps/apps-supported-intune-apps.md index aa1bd74cd87..cd522e13c7c 100644 --- a/memdocs/intune/apps/apps-supported-intune-apps.md +++ b/memdocs/intune/apps/apps-supported-intune-apps.md @@ -1,7 +1,7 @@ --- title: Supported Microsoft Intune apps titleSuffix: -description: This topic provides lists of support partner and Microsoft apps that are commonly used with Microsoft Intune. +description: This article provides lists of support partner and Microsoft apps that are commonly used with Microsoft Intune. keywords: author: Erikre ms.author: erikre @@ -23,7 +23,7 @@ ms.collection: # Microsoft Intune protected apps -The apps listed in this topic are supported partner and Microsoft apps that are commonly used with Microsoft Intune. Intune protected apps are enabled with a rich set of mobile application protection policies. +The apps listed in this article are supported partner and Microsoft apps that are commonly used with Microsoft Intune. Intune protected apps are enabled with a rich set of mobile application protection policies. > [!NOTE] > For your client line-of-business apps, you can incorporate mobile app management using the [Intune App Software Development Kit](../developer/app-sdk.md) (SDK), or the [App Wrapping Tool for iOS](../developer/app-wrapper-prepare-ios.md) and the [App Wrapping Tool for Android](../developer/app-wrapper-prepare-android.md). @@ -47,7 +47,7 @@ The following tables provide details of supported partner and Microsoft apps tha In addition to supporting the core App Protection Policy settings, apps are also capable of supporting **advanced App Protection Policy and App Configuration Policy** settings. These settings require app investment: - App Configuration Policies can be used by apps to customize app behavior and/or App Protection Policy settings. -- On enrolled devices, managed apps can leverage *org allowed accounts mode* to require sign-in with a specific identity and disable multi-identity functionality. +- On enrolled devices, managed apps can use *org allowed accounts mode* to require sign-in with a specific identity and disable multi-identity functionality. - The *Sync policy managed app data with native apps* App Protection Policy setting can be utilized by apps to restrict the synchronization of contact or calendar data to the native apps. - The *Org data notifications* App Protection Policy setting can be utilized by apps to limit the exposure of sensitive data in notifications. - The *Open data into Org documents* App Protection Policy setting can be utilized by apps to restrict importing data from unmanaged locations. @@ -144,6 +144,7 @@ The following apps support the core Intune App Protection Policy settings. Apps | App title | App description | App store links for supported platform(s) | |-------------------------------------------------|-------------------------|---------------------------------------------| +| :::no-loc text="365Pay":::

Partner app - 365Pay icon | The 365Pay app provides a quick way to buy products across various experiences offered in your workplace. Use your unique QR code to touchlessly checkout at any 365 self-checkout experiences. You can earn loyalty points while ordering ahead from the cafeteria and scan and pay for products using the app itself. The 365Pay app also helps you stay up to date on new and exciting products and promotions being offered at your location! | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.avinside&hl=en_US),
[App Store link (iOS)](https://apps.apple.com/us/app/365pay/id1087422156) | | :::no-loc text="Achievers":::

Partner app - Achievers icon | The Achievers app puts the power of recognition in your hands. Achieving great things is a challenge. Recognizing someone for great achievements is easy. Engage, align, and recognize colleagues with the touch of a screen at any time and anywhere. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.achievers.client),
[App Store link (iOS)](https://apps.apple.com/app/achievers/id945779451) | | :::no-loc text="Acronis Access":::

Partner app - Acronis Access icon | Safely access your business files from anywhere and any device with Acronis Access. Easily share documents with colleagues, customers, and vendors while keeping files and data secure and private, where only you and your organization can touch them. The app is designed for extreme ease of use with unparalleled security, privacy, and management capabilities. | [App Store link (iOS)](https://apps.apple.com/us/app/acronis-access/id429704844?mt=8) | | :::no-loc text="Adobe Acrobat Reader":::

Partner app - Adobe Acrobat Reader icon | Open, view, and work with PDFs in a Microsoft Intune managed environment with Adobe Acrobat Reader. Available for iOS/iPadOS and Android. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.adobe.reader),
[App Store link (iOS)](https://apps.apple.com/app/adobe-acrobat-reader-for-pdf/id469337564) | @@ -151,12 +152,12 @@ The following apps support the core Intune App Protection Policy settings. Apps | :::no-loc text="Align for Intune":::

Partner app - Align for Intune icon | Align for Intune allows you to review your legal documents, highlight documents with a touch of your finger, and markup documents with the Apple Pencil. Additionally, you can easily sync documents, making them instantly available on your laptop and to your teammates across the firm.

Align for Intune requires an Intune license. This app has been specially developed to operate with Microsoft Intune mobile application management (MAM). | [App Store link (iOS)](https://apps.apple.com/us/app/align-for-intune/id6468679454) | | :::no-loc text="Appian for Intune":::

Partner app - Appian for Intune icon | Appian empowers business users to monitor, collaborate, and take action on the go, enabling your mobile workforce to stay connected to key business processes and enterprise data.

Appian’s Business Process Management and Case Management Suite delivers mobile access to event notifications, forms, tasks, information, reports, content, and ad-hoc collaboration.

Appian provides the following:

  • Mobile access to the Appian platform
  • Mobile task management
  • Collaborative activity feed
  • Enterprise data discovery
  • Offline forms processing
  • Access to enterprise reports and analytics
This application requires authorized access to an instance of Appian. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.appian.android.intune),
[App Store link (iOS)](https://apps.apple.com/app/id1573771379) | | :::no-loc text="ArcGIS Indoors for Intune":::

Partner app - ArcGIS Indoors for Intune icon | ArcGIS Indoors for Intune provides an indoor mapping experience for understanding the location of things and activities happening within your organization’s indoor environment. Use the wayfinding, location sharing, and workspace reservation capabilities to feel more connected to your workplace or campus, see increased levels of productivity and collaboration, and less time feeling the stress of being lost. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.esri.indoors.intune),
[App Store link (iOS)](https://apps.apple.com/app/arcgis-indoors-for-intune/id1613222675) | -| :::no-loc text="ArchXtract (MDM)":::

Partner app - ArchXtract (MDM) icon | ArchXtract is used to decompress zip files between Microsoft Intune managed applications. The ArchXtract app is the upgraded version of the Intune managed decompression app known as ZipExtractor. ArchXtract supports a wide variety of compression methods.

Characteristic:

  • Microsoft Intune policies can be applied to protect company information
  • Supports Zip files can be created with major compression tools such as 7-zip, Lhaplus, WinZip, and WinRAR
  • Archive files, other than zip, can now be decompressed
  • Compression methods such as Deflate, Deflate64, BZip2, LZMA (no password), and PPMd can be decompressed
  • Devices which use the ArchXtract can be managed from web
  • Archive files with password can be decompressed on mobile devices
  • Open the file by changing the Encoding to prevent garbled characters
  • Text and Image files can be viewed.

Supported file types: bmp, jpeg, png, gif, PDF, txt, csv, html, xml

Supported compression methods include Deflate64, BZip2, LZMA (no password), PPMd.

Important: To use the full functionality of this application, you need a connect to a company work account and a valid subscription for Microsoft Intune. Some functions may not be available in some countries or regions. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=jp.co.cegb.archxtractforstore&hl=en_US&gl=US),
[App Store link (iOS)](https://apps.apple.com/app/archxtract-mdm-support/id1488048735) | +| :::no-loc text="ArchXtract (MDM)":::

Partner app - ArchXtract (MDM) icon | ArchXtract is used to decompress zip files between Microsoft Intune managed applications. The ArchXtract app is the upgraded version of the Intune managed decompression app known as ZipExtractor. ArchXtract supports a wide variety of compression methods.

Characteristic:

  • Microsoft Intune policies can be applied to protect company information
  • Supports Zip files can be created with major compression tools such as 7-zip, Lhaplus, WinZip, and WinRAR
  • Archive files, other than zip, can now be decompressed
  • Compression methods such as Deflate, Deflate64, BZip2, LZMA (no password), and PPMd can be decompressed
  • Devices, which use the ArchXtract can be managed from web
  • Archive files with password can be decompressed on mobile devices
  • Open the file by changing the Encoding to prevent garbled characters
  • Text and Image files can be viewed.

Supported file types: bmp, jpeg, png, gif, PDF, txt, csv, html, xml

Supported compression methods include Deflate64, BZip2, LZMA (no password), PPMd.

Important: To use the full functionality of this application, you need a connect to a company work account and a valid subscription for Microsoft Intune. Some functions may not be available in some countries or regions. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=jp.co.cegb.archxtractforstore&hl=en_US&gl=US),
[App Store link (iOS)](https://apps.apple.com/app/archxtract-mdm-support/id1488048735) | | :::no-loc text="Asana: Work in one place":::

Partner app - Asana - Work in one place icon | Asana allows you to manage team projects and your individual tasks. Asana organizes work so you and your teams are clear on what to do, when to do it, and how to get it done. By using Asana, you can do the following:

  • Access Asana on mobile or on the web.
  • Set up different projects to bring your team’s work together in one shared space.
  • Boost your productivity with My Tasks, where you can see all the work that’s been assigned to you in one to-do list.
  • Keep collaboration going, wherever you are.
  • Visit the web app to see how all of your projects are progressing with Portfolios.
  • Personalize task management with Custom Fields to capture important information about your tasks.
  • Choose timeline view for projects to see a Gantt chart with task dependencies.
  • Unlock the ability to track company goals and milestones with Goals.
| [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.asana.app),
[App Store link (iOS)](https://apps.apple.com/us/app/asana-work-in-one-place/id489969512) | | :::no-loc text="AssetScan For Intune":::

Partner app - AssetScan For Intune icon | AssetScan is a proprietary application linked to the Asset Point tool suite. AssetScan supports technology inventory gathering and verification for both data centers and desktop locations. | [App Store link (iOS)](https://apps.apple.com/app/assetscan-for-intune/id1582325082) | | :::no-loc text="Atom Edge":::

Partner app - Atom Edge icon | Atom Edge provides corporate security through an integrated suite of services, designed to elevate the operational capabilities of businesses. The Atom Edge application offers a comprehensive approach to security management, blending automation, real-time analytics, and strategic planning to ensure a safe and efficient working environment. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.arlanto.atomedge),
[App Store link (iOS)](https://apps.apple.com/app/atom-edge/id6472163711) | | :::no-loc text="AventX Mobile Work Orders":::

Partner app - Box - AventX Mobile Work Orders icon | AventX Mobile Work Orders allows maintenance users of Oracle eAM to view work order packets on the go with an iPhone or iPad – even offline. As with paper, users can mark-up electronic work orders with the added benefit of attaching rich media, like pictures and audio files, as context to the completed work. Adding to the efficiency of mobile, AventX allows technicians to route, close and upload completed work orders from anywhere, increasing time in the field and decreasing time spent manually entering the same information after the work is done. | [App Store link (iOS)](https://apps.apple.com/app/mobile-work-orders/id1144125126) | -| :::no-loc text="Beakon Mobile App":::

Partner app - Beakon Mobile App icon | The Beakon Mobile App helps you reduce workplace incidents and risk, while managing compliance. Beakon’s system enables employees and contractors to report audits, incidents, hazards, and near misses. You are then able to classify and manage incidents across your entire business and apply cost-efficient strategies to manage and minimize workplace risk. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=io.beakon&pli=1),
[App Store link (iOS)](https://apps.apple.com/app/beakon-mobile-app/id1365533931) | +| :::no-loc text="Beakon Mobile App":::

Partner app - Beakon Mobile App icon | The Beakon Mobile App helps you reduce workplace incidents and risk, while managing compliance. Beakon’s system enables employees and contractors to report audits, incidents, hazards, and near misses. You're then able to classify and manage incidents across your entire business and apply cost-efficient strategies to manage and minimize workplace risk. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=io.beakon&pli=1),
[App Store link (iOS)](https://apps.apple.com/app/beakon-mobile-app/id1365533931) | | :::no-loc text="Board Papers":::

Partner app - Board Papers icon | Board Papers is a board portal solution that combines an iPad application with Microsoft SharePoint® integration. | [App Store link (iOS)](https://apps.apple.com/app/board-papers/id458518678) | | :::no-loc text="Bob HR":::

Partner app - Box - Bob HR icon | Bob HR provides a seamless HR experience on the go.


An employee can:

  • Connect with coworkers through the social features – Post and react to Shoutouts, Kudos, and Polls
  • Get to know new joiners, birthdays, and work anniversaries
  • Clock in and out
  • Receive push notifications when it’s time to submit their timesheet, when their time off request is approved, and when they need to sign or read a document
  • Manage their timesheet
  • Request and manage their time off
  • See which of their teammates and coworkers are available or on leave
  • Review and sign documents
  • Search the employee directory and connect with their colleagues
  • Update personal information (self-service)
  • Access important company links

A manager can receive push notification and take action anytime, anywhere:

  • Approve/decline time off requests
  • Approve/decline employee timesheets
| [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.hibob&hl=en&gl=US),
[App Store link (iOS)](https://apps.apple.com/us/app/bob-hr/id1297148884) | | :::no-loc text="Box - Cloud Content Management":::

Partner app - Box - Cloud Content Management icon | Box helps you get work done on the go. It's fast, secure and simple to use, so you can be productive from anywhere, which is the reason 97,000 businesses, including Eli Lilly and Company, General Electric, KKR & Co., P&G and The GAP securely access and manage their critical information with Box. The Box app integrates with Intune SDK and supports a number of Intune Mobile Application Management policies without using Mobile Device Management. | [App Store link (iOS)](https://apps.apple.com/app/box-cloud-content-management/id290853822) | @@ -179,7 +180,7 @@ The following apps support the core Intune App Protection Policy settings. Apps | :::no-loc text="Dooray! for Intune":::

Partner app - Dooray! for Intune icon | Dooray! is the all-in-one collaboration solution including Task management, Messenger, Mail, Meeting, Calendar, Drive, Wiki, Workflow, Board, and more. Admins can manage policies to protect corporate data while keeping employees connected through the Microsoft Intune admin center for Dooray! for Intune.

Dooray! for Intune includes the following:

  • Project: Task, file, and wiki management in one place
  • Messenger: Efficient communication for collaboration
  • Mail: Smart mail system integrated with tasks and schedules
  • Meeting: Anytime, anywhere, anyone!
  • Calendar: Effective task and schedule management
  • Drive: Easy and secure file storage solution
  • Wiki: Collaboration on ideas and knowledge with your team
  • Workflow: Streamlined decision-making system
  • Board: Information sharing and communication
  • Stream: Notifications for important updates
| [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.dooray.intune),
[App Store link (iOS)](https://apps.apple.com/app/6448622191) | | :::no-loc text="Egnyte for Intune":::

Partner app - Egnyte for Intune icon | The Egnyte mobile app allows you to extend the office by working from anywhere with ease. You can securely access data, preview files, upload new content, collaborate on folders and file links, and edit and co-edit files in popular formats. You can also set up permissions for authorized access, create link expirations, and receive notifications when files are accessed.

Egnyte for Intune works with workspaces and devices managed by Microsoft Intune. Intune enables companies to control how the organization’s devices are used and also to configure specific policies. | [App Store link (iOS)](https://apps.apple.com/us/app/egnyte-for-intune/id1596098287) | | :::no-loc text="Egress Secure Mail for Intune":::

Partner app - Egress Secure Mail icon | Send and receive encrypted emails and files from your mobile device. Egress Secure Email provides user-friendly tools to secure sensitive data, with end-to-end encryption, access revocation and message restrictions to empower users to stay in control of the information they share.

The Egress Secure Email app requires you to be a licensed user of the Egress platform, with a valid subscription and appropriate infrastructure. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.egress.switchdroid.intune) | -| :::no-loc text="Enterprise Files for Intune":::

Partner app - Enterprise Files for Intune icon | Integrated with Intune Mobile Application Management, the Enterprise Files for Intune app provides safe document access to multiple back-end file stores. You can provide secure access to cloud and on-premises storage with enforceable MAM Protection Polices for your data. Users can have as much control over file actions as your business needs dictate, from viewing only to edit, copy, move and delete. Whether it’s PDF annotation, video, audio or image presentations, folder management, or document review and edit, Enterprise Files for Intune is an ideal tool for the task. | [App Store link (iOS)](https://apps.apple.com/app/id6443992292) | +| :::no-loc text="Enterprise Files for Intune":::

Partner app - Enterprise Files for Intune icon | Integrated with Intune Mobile Application Management, the Enterprise Files for Intune app provides safe document access to multiple back-end file stores. You can provide secure access to cloud and on-premises storage with enforceable MAM Protection Policies for your data. Users can have as much control over file actions as your business needs dictate, from viewing only to edit, copy, move and delete. Whether it’s PDF annotation, video, audio or image presentations, folder management, or document review and edit, Enterprise Files for Intune is an ideal tool for the task. | [App Store link (iOS)](https://apps.apple.com/app/id6443992292) | | :::no-loc text="ePRINTit SaaS":::

Partner app - ePRINTit SaaS icon | ePRINTit SaaS is a mobile printing platform connecting people who need to print with print locations. Offering print services for public and corporate printing, ePRINTit’s robust offerings are convenient and accessible for customers alike. For more information, visit [www.eprintit.com](https://www.eprintit.com). | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.eprintitsaas.mobile&pli=1),
[App Store link (iOS)](https://apps.apple.com/us/app/eprintit-saas/id6443684419) | | :::no-loc text="EVALARM":::

Partner app - EVALARM icon | EVALARM is a mobile crisis communication system that automatically informs the right group of people about a crisis and provides them with individual instructions and contact lists.

This application supports crisis communication processes as part of hazard prevention management in companies, authorities, universities, schools, kindergartens, hospitals and public institutions.

To configure the EVALARM platform, you define your individual crisis scenarios, determine which people or groups of people are alerted, and determine which instructions and contact lists are to be transmitted. | [App Store link (iOS)](https://apps.apple.com/app/evalarm/id966258645) | | :::no-loc text="F2 Manager Intune":::

Partner app - F2 Manager Intune icon | F2 Manager offers a combined calender and list view to view meetings and their related items. F2 Manager supports inline annotation and submittal handling (approval process).

**Note:** To use the F2 Manager app with your business data, you must be a user of the F2 eGovernment platform, with mobile services enabled by your IT department. | [App Store link (iOS)](https://apps.apple.com/app/f2-manager-intune/id1587696871) | @@ -202,7 +203,7 @@ The following apps support the core Intune App Protection Policy settings. Apps | :::no-loc text="iAnnotate for Intune/O365":::

Partner app - iAnnotate for Intune/O365 icon| Designed for Microsoft Intune enterprise users, iAnnotate for Intune/O365 allows you to read, annotate, and share PDFs, Microsoft 365 (Office) files, images and web pages. Seamlessly integrate with OneDrive and Outlook, while easily converting all MS documents to PDFs for quick markup. IT administrators must visit https://enterprise.iannotate.com/ to activate a 30-day free trial and to view the iAnnotate for Intune deployment guide. | [App Store link (iOS)](https://apps.apple.com/app/iannotate-for-intune-o365/id1567388828) | | :::no-loc text="iBabs for Intune":::

Partner app - iBabs for Intune icon| iBabs enables users to reduce the time needed to prepare for meetings and facilitates cooperation between colleagues.

This version of iBabs is intended for Enterprise users and government agencies, and it also requires a Microsoft Intune environment. | [App Store link (iOS)](https://apps.apple.com/us/app/ibabs-for-intune/id1130847428?mt=8) | | :::no-loc text="Idenprotect Go":::

Partner app - Idenprotect Go icon| Idenprotect Go is an Identity Driven internet browser designed specifically for enterprise mobile users to access both Intranet and Internet web pages. Idenprotect Go’s unique use of PKI technology allows biometric-based password-less authentication to Mutual TLS and Kerberos secured websites and services. Integration with Microsoft’s Intune SDK provides full app protection policy control via the Microsoft Intune platform providing MAM control of the application giving the ultimate balance of usability and security. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=uk.co.applymobile.idenprotectgo),
[App Store link (iOS)](https://apps.apple.com/app/idenprotect-go/id1544060692) | -| :::no-loc text="Island Enterprise Browser":::

Partner app - Island Enterprise Browser icon| Island is the browser designed for the enterprise that makes work fluid, while keeping it fundamentally secure. With core security controls naturally embedded in the browser itself, Island enables organizations to control, see, and govern how users, apps, and underlying data interact. This is done all while delivering the same smooth Chromium-based experience users expect. | [App Store link (iOS)](https://apps.apple.com/il/app/island-enterprise-browser/id1661957370) | +| :::no-loc text="Island Browser for Intune":::

Partner app - Island Browser for Intune icon | Island is the browser designed for the enterprise that makes work fluid, while keeping it fundamentally secure. With core security controls naturally embedded in the browser itself, Island enables organizations to control, see, and govern how users, apps, and underlying data interact. This is done all while delivering the same smooth Chromium-based experience users expect. This app version has been designed to work with Microsoft Intune MAM. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=io.island.island.intune),
[App Store link (iOS)](https://apps.apple.com/il/app/island-enterprise-browser/id1661957370) | | :::no-loc text="iManage Work 10 For Intune":::

Partner app - iManage Work 10 For Intune icon| Confidently and securely access content from iManage Work with Work Mobility for Intune. Empower users to find, edit, collaborate, and share documents and emails from their iOS device. iManage Mobility enables users to be productive from anywhere, with a consistent user experience and the same security protections as iManage Work 10. | [App Store link (iOS)](https://apps.apple.com/app/imanage-work-10-for-intune/id1337285529?ls=1) | | :::no-loc text="Incorta (BestBuy)":::

Partner app -Incorta (BestBuy) icon| With on-the-go business intelligence using your iOS device and Incorta Mobile App, dive deep into your operational analytics and favorite dashboards anytime, anywhere.

Fuel your curiosity, explore insights, and stay current with near real-time trends that impact business success.

The Incorta Mobile App includes the following features:

  • Interactive dashboards and insights
  • Dynamic filtering and drill-down navigation
  • Bookmarks and favorites
  • Export and share dashboards
| [App Store link (iOS)](https://apps.apple.com/us/app/incorta-bestbuy/id6446140689) | | :::no-loc text="Intapp 2.0":::

Partner app -Intapp 2.0 icon| The Intapp 2.0 application provides secure mobile access to Intapp CRM (DealCloud) and Risk and Compliance (Intake and Conflicts). Intapp 2.0 iOS app provides Intune protection by integrating the Intune SDK. The CRM product helps users stay on top of their day-to-day tasks while out of office, providing access to information beyond just what's available at your desk, with dashboards, views, and template reports optimized for on-the-go consumption. The Intapp Risk and Compliance solution makes it easy to manage client requests and related workflows, review and resolve conflicts reports, initiate conflicts quick search, and access client and matter data. This app requires access to an existing cloud environment of Intapp CRM or Risk & Compliance. | [App Store link (iOS)](https://apps.apple.com/us/app/intapp-2-0/id1666527728?uo=2) | @@ -216,7 +217,7 @@ The following apps support the core Intune App Protection Policy settings. Apps | :::no-loc text="LiquidText":::

Partner app - LiquidText icon.| LiquidText offers a fast, natural way to review, gather, and organize information across all your documents and webpages—then apply the results to writing reports, meeting prep, or simply studying. Pull out key facts and connect them together, squeeze a document to compare sections, draw a line to connect ideas in different documents, comment on multiple pages at once, build upon your thoughts, and much more.

**NOTE**: To use LiquidText with Intune, you need a LiquidText Enterprise account. Visit [LiquidText](https://liquidtext.net/enterprise) to learn more. | [App Store link (iOS)](https://apps.apple.com/us/app/liquidtext/id922765270) | | :::no-loc text="LumApps for Intune":::

Partner app - LumApps for Intune icon| LumApps for Intune allows Intune admins to organize and protect Bring Your Own Device (BYOD) environments. From Microsoft Intune admin center, admins can create policies to protect corporate data while keeping employees connected. The LumApps platform provides corporate news, business tools, essential documents, and social communities.

LumApps for Intune includes several features:

  • Browse listed content, including company news and targeted information streams
  • View detailed content and comments with attached files
  • React to content in real-time
  • Like and respond to posts and comments
  • View all communities at a glance and follow your favorites
  • Check your preferred communities’ activity
  • Create your own community post with attached files, links, and tags
  • Quick access to LumApps Help page

To use LumApps for Intune, your company’s active subscription plan to LumApps must include the mobile option, with valid login credentials. Additionally, LumApps for Intune requires a Microsoft managed environment. Please contact your company’s IT administrator if you have issues or questions about using LumApps for Intune. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.lumapps.android.intune),
[App Store link (iOS)](https://apps.apple.com/gb/app/lumapps-for-intune/id1542216268) | | :::no-loc text="M-Files for Intune":::

Partner app - M-Files for Intune icon| M-Files® is content management (ECM) and document management solution that helps to manages, find, track, and secure information for companies of all sizes.

The M-Files mobile application lets you access your M-Files documents anytime and anywhere – even when you’re on the go or not connected to your office network. The application enables you to find documents from your M-Files Vaults via search functions and various customizable views, as well as view and approve documents and workflows.

To be able to utilize the mobile application, you need to have an M-Files system set up and to possess the required access rights. To get started, you need an M-Files server address and login credentials. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.mfiles.mfms),
[App Store link (iOS)](https://apps.apple.com/app/m-files-for-intune/id1551120145) | -| :::no-loc text="MangoApps - Work from Anywhere":::

Partner app - MangoApps - Work from Anywhere icon| MangoApps - Work from Anywhere makes teamwork, file sharing, and collaboration easy. It is a comprehensive business collaboration tool for Mobile and offers advanced team and company communication, project management, and information sharing features that help companies and their employees stay organized while working together and sharing information. Collaboration features such as chat, company intranet, and wikis, among other convenient task management tools, can all be used from your phone while you're on the go or from your desktop computer while you're in the office. It's a cross-platform social collaboration app, so no matter where you are and which device you are using, you can use MangoApps - Work from Anywhere to access work-related information and stay in touch with colleagues and clients. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.ms.engage&hl=en_IN&gl=US),
[App Store link (iOS)](https://apps.apple.com/us/app/mangoapps-work-from-anywhere/id347307528?platform=iphone) | +| :::no-loc text="MangoApps - Work from Anywhere":::

Partner app - MangoApps - Work from Anywhere icon| MangoApps - Work from Anywhere makes teamwork, file sharing, and collaboration easy. It is a comprehensive business collaboration tool for Mobile and offers advanced team and company communication, project management, and information sharing features that help companies and their employees stay organized while working together and sharing information. Collaboration features such as chat, company intranet, and wikis, among other convenient task management tools, can all be used from your phone while you're on the go or from your desktop computer while you're in the office. It's a cross-platform social collaboration app, so no matter where you are and which device you're using, you can use MangoApps - Work from Anywhere to access work-related information and stay in touch with colleagues and clients. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.ms.engage&hl=en_IN&gl=US),
[App Store link (iOS)](https://apps.apple.com/us/app/mangoapps-work-from-anywhere/id347307528?platform=iphone) | | :::no-loc text="Meetings by Decisions":::

Partner app - Meetings by Decisions icon| Meetings by Decisions is a solution for Microsoft Teams and Microsoft 365 (Office). With Decisions, users improve collaboration, engagement, and productivity by using agenda builder, Teams in-meeting extensions, secure voting, minutes templates, task management, and more. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.meetingdecisions.androidApp),
[App Store link (iOS)](https://apps.apple.com/app/meetings-by-decisions/id1532239791) | | :::no-loc text="Meetio Enterprise":::

Partner app - Meetio Enterprise icon| Meetio's mobile app for organizations using Meetio room management solutions. Meetio Enterprise simplifies your workday by allowing you to schedule meetings and meeting rooms - all at once, while you're on the go. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.getmeetio.personal),
[App Store link (iOS)](https://apps.apple.com/app/meetio/id1340190306) | | :::no-loc text="Mobile Helix Link for Intune":::

Partner app - Mobile Helix Link for Intune icon| The Mobile Helix Link for Intune app uniquely integrates document management and Outlook email in a single, encrypted app. Quickly find files. Annotate, edit, compare, and email files seamlessly. Use Intune and the Microsoft Authentication Library to manage and secure the LINK app using Microsoft Intune and Entra ID. | [App Store link (iOS)](https://apps.apple.com/app/mobile-helix-link-for-intune/id6473648085) | @@ -236,6 +237,7 @@ The following apps support the core Intune App Protection Policy settings. Apps | :::no-loc text="PrinterOn for Microsoft":::

Partner app - PrinterOn for Microsoft icon | PrinterOn's wireless mobile printing solutions enable users to remotely print from anywhere at any time over a secure network.| [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.printeron.droid.phone),
[App Store link (iOS)](https://apps.apple.com/us/app/printeron/id406584999) | | :::no-loc text="Qlik Sense Mobile":::

Partner app - Qlik Sense Mobile icon | Qlik Sense is a market leading, next generation application for self-service oriented analytics. Qlik's patented associative technology allows people to easily combine data from many different sources and explore it freely, without the limitations of query-based tools. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.qlik.qliksense.mobile),
[App Store link (iOS)](https://apps.apple.com/app/qlik-sense-mobile/id1217049362) | | :::no-loc text="Re:Work Enterprise":::

Partner app - re:work enterprise icon | Re:Work Enterprise, an email client app using ActiveSync, is a secure, safe, and convenient email client. Features include a shared mailbox and calendars for collaboration with colleagues. Re:Work Enterprise supports Microsoft Exchange Server and Microsoft 365 (Office), as well Microsoft Exchange email, calendar, contacts, tasks, and notes. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=so.rework.app.enterprise),
[App Store link (iOS)](https://apps.apple.com/us/app/re-work-enterprise/id1528303033) | +| :::no-loc text="Recruitment.Exchange":::

Partner app - Recruitment.Exchange icon | Recruitment.Exchange (REX) is a Mobile AI Copilot for exponential recruitment. It is designed to:

  • Increase speed of sourcing, screening, and processing of candidates.
  • Automatically generate skill-based candidate inventory by expertise and proficiency levels.
  • Engage, communicate, and act on-the-go with candidates and colleagues.

REX mobile app takes recruitment to the next level by making the power of domain AI directly accessible anytime and anywhere in the comfort of your palm.

In addition to being available as an integrated app interface for highly scalable enterprise applications, powerful app features can also operate in standalone mode. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.recruitment.exchange), [App Store link (iOS)](https://apps.apple.com/us/app/recruitment-exchange/id6451382847) | | :::no-loc text="RICOH Spaces V2":::

Partner app - RICOH Spaces icon | RICOH Spaces V2 is a cloud hosted workplace enhancement platform designed to optimize your business with areas such as desk bookings, space bookings, wayfinding, workplace insights, and more. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.ricohspaces.app),
[App Store link (iOS)](https://apps.apple.com/app/ricoh-spaces-v2/id6444533360) | | :::no-loc text="RingCentral for Intune":::

Partner app - RingCentral for Intune icon | RingCentral for Intune gives users messaging, video, and phone services in one simple app, while allowing IT admins to enforce granular security controls to protect corporate data. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.ringcentral.intune),
[App Store link (iOS)](https://apps.apple.com/us/app/ringcentral-for-intune/id1610956051) | | :::no-loc text="Riskonnect Resilience":::

Partner app - Riskonnect Resilience icon | Stay connected with your response team, your critical plans, and your resources during a disruption. Riskonnect Resilience, the mobile application for Riskonnect Business Continuity and Resilience, lets you securely access recovery plans, launch an incident, collaborate with team members, and send emergency notifications. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.avalution.catalystportalmobile),
[App Store link (iOS)](https://apps.apple.com/us/app/riskonnect-resilience/id1499503288) | @@ -244,18 +246,23 @@ The following apps support the core Intune App Protection Policy settings. Apps | :::no-loc text="Seismic \| Intune":::

Partner app - Seismic \| Intune icon | Seismic \| Intune is for administrators to add security and protection policies to protect corporate data while enabling employees to sell. Seismic provides the following capabilities:

  • Find content fast with fast search results
  • Get buyer-specific recommendations when you need them, where you need them
  • Access sales content, training, and communications online and offline
  • Stay informed with a real-time newsfeed you dial in to your specific interests
  • Collaborate with your team and stay in the loop, wherever you are
  • Delight buyers with a modern, eloquent engagement experience
  • Gain insights by tracking buyer engagement, down to which pages and how long

Seismic solves the individual challenges of Sales, Marketing, and Sales Enablement teams by making all three teams more effective together. Your Marketing team builds useful content with brand protection and scalability, and mines data intelligence to continuously improve ROI over time. The Sales Enablement team distributes targeted sales content, news, and training in apps for mobile, CRM, email, and browsers. Sellers find, learn, connect, and close from any device, anywhere, and are more knowledgeable and productive than ever. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.seismic.doccenter),
[App Store link (iOS)](https://apps.apple.com/app/seismic-intune/id6444794878) | | :::no-loc text="Senses":::

Partner app - Senses icon | Senses is a cloud sales support tool. Senses helps manage sales and customer success, and proposes best practices based on accumulated customer information. | [App Store link (iOS)](https://apps.apple.com/app/senses-%E3%82%BB%E3%83%B3%E3%82%B7%E3%83%BC%E3%82%BA/id1210014628) | | :::no-loc text="ServiceNow Agent - Intune":::

Partner app - ServiceNow Agent icon | ServiceNow Mobile Agent app delivers out-of-the-box, mobile-first experiences for the most common service desk agent workflows, making it easy for agents to triage, act on and resolve requests on the go. The app enables service desk agents to promptly manage and resolve end user issues from their mobile devices. Agents use the app’s intuitive interface to accept and update work even without Internet connectivity. The app greatly simplifies work by leveraging native device capabilities for tasks like navigation, barcode scanning, or collecting a signature.

The app comes with out-of-the-box workflows for service desk agents in IT, Customer Service, HR, Field Services, Security Ops and IT Asset Management. Organizations can easily configure and extend the workflows to meet their own unique needs.

With Mobile Agent you can:

  • Manage the work assigned to your teams.
  • Triage incidents and cases.
  • Act on approvals with swipe gestures and quick actions.
  • Complete work while offline.
  • Access the full issue details, activity stream, and related lists of records.
  • Optimize workflows with location, camera, and touchscreen hardware
| [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.servicenow.fulfiller.mam.intune),
[App Store link (iOS)](https://apps.apple.com/app/servicenow-agent-intune/id1494183149) | +| :::no-loc text="Singletrack for Intune":::

Partner app - Singletrack for Intune icon | Singletrack for Intune lets users access their CRM data anywhere and at any time, while supporting the Mobile Application Management (MAM) policies offered by Microsoft Intune. Users can connect with contacts and send out research. They can also log new interactions, as well as view and update existing ones.

You can choose to receive local notifications of recently finished Interactions and log draft interactions to be completed on your desktop at a later date. You can also work offline to capture data when convenient. | [App Store link (iOS)](https://apps.apple.com/us/app/singletrack-for-intune/id6502955456) | | :::no-loc text="Slack for Intune":::

Partner app - Slack for Intune icon | Slack for Intune is for Slack customers that have enabled Microsoft Intune Mobile Application Management (MAM). | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.Slack.intune), [App Store link (iOS)](https://apps.apple.com/app/slack-for-intune/id1558736484) | -| :::no-loc text="PK Protect for Intune":::

Partner app - PK Protect for Intune icon | PK Protect for Intune is specifically designed for existing PKWARE customers operating in an Intune environment. PK Protect lets you get your work done on the go. It's fast, secure and simple to use so you can be productive from anywhere. If you are unsure if you have PK Protect, contact your company's IT administrator. With PK Protect, you can: Encrypt and decrypt files using Smartkeys, Decrypt archives with X.509 Digital Certificates, Create and manage Smartkeys, Perform digital signing and authentication of data with X.509 Digital Certificates, Encrypt and decrypt files with Strong Passphrase encryption, including AE2, Log in with existing Active Directory credentials, Create and view unencrypted zip archives. PK Protect armors data at its core, eliminating vulnerabilities everywhere data is used, shared or stored. For nearly three decades, PKWARE has provided encryption and compression software to more than 30,000 enterprise customers and over 200 government agencies. Available for iOS/iPadOS and Android. | [App Store link (iOS)](https://apps.apple.com/app/smartcrypt-for-intune/id1489232256) | +| :::no-loc text="PK Protect for Intune":::

Partner app - PK Protect for Intune icon | PK Protect for Intune is specifically designed for existing PKWARE customers operating in an Intune environment. PK Protect lets you get your work done on the go. It's fast, secure and simple to use so you can be productive from anywhere. If you're unsure if you have PK Protect, contact your company's IT administrator. With PK Protect, you can: Encrypt and decrypt files using Smartkeys, Decrypt archives with X.509 Digital Certificates, Create and manage Smartkeys, Perform digital signing and authentication of data with X.509 Digital Certificates, Encrypt and decrypt files with Strong Passphrase encryption, including AE2, Log in with existing Active Directory credentials, Create and view unencrypted zip archives. PK Protect armors data at its core, eliminating vulnerabilities everywhere data is used, shared or stored. For nearly three decades, PKWARE has provided encryption and compression software to more than 30,000 enterprise customers and over 200 government agencies. Available for iOS/iPadOS and Android. | [App Store link (iOS)](https://apps.apple.com/app/smartcrypt-for-intune/id1489232256) | +| :::no-loc text="ServiceNow Agent - Intune":::

Partner app - ServiceNow Agent icon | ServiceNow Mobile Agent app delivers out-of-the-box, mobile-first experiences for the most common service desk agent workflows, making it easy for agents to triage, act on and resolve requests on the go. The app enables service desk agents to promptly manage and resolve end user issues from their mobile devices. Agents use the app’s intuitive interface to accept and update work even without Internet connectivity. The app greatly simplifies work by using native device capabilities for tasks like navigation, barcode scanning, or collecting a signature.

The app comes with out-of-the-box workflows for service desk agents in IT, Customer Service, HR, Field Services, Security Ops and IT Asset Management. Organizations can easily configure and extend the workflows to meet their own unique needs.

With Mobile Agent you can:

  • Manage the work assigned to your teams.
  • Triage incidents and cases.
  • Act on approvals with swipe gestures and quick actions.
  • Complete work while offline.
  • Access the full issue details, activity stream, and related lists of records.
  • Optimize workflows with location, camera, and touchscreen hardware
| [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.servicenow.fulfiller.mam.intune),
[App Store link (iOS)](https://apps.apple.com/app/servicenow-agent-intune/id1494183149) | +| :::no-loc text="Slack for Intune":::

Partner app - Slack for Intune icon | Slack for Intune is for Slack customers that have enabled Microsoft Intune Mobile Application Management (MAM). | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.Slack.intune), [App Store link (iOS)](https://apps.apple.com/app/slack-for-intune/id1558736484) | +| :::no-loc text="PK Protect for Intune":::

Partner app - PK Protect for Intune icon | PK Protect for Intune is designed for existing PKWARE customers operating in an Intune environment. PK Protect lets you get your work done on the go. It's fast, secure and simple to use so you can be productive from anywhere. If you are unsure if you have PK Protect, contact your company's IT administrator. With PK Protect, you can: Encrypt and decrypt files using Smartkeys, Decrypt archives with X.509 Digital Certificates, Create and manage Smartkeys, Perform digital signing and authentication of data with X.509 Digital Certificates, Encrypt and decrypt files with Strong Passphrase encryption, including AE2, Log in with existing Active Directory credentials, Create and view unencrypted zip archives. PK Protect armors data at its core, eliminating vulnerabilities everywhere data is used, shared or stored. For nearly three decades, PKWARE has provided encryption and compression software to more than 30,000 enterprise customers and over 200 government agencies. Available for iOS/iPadOS and Android. | [App Store link (iOS)](https://apps.apple.com/app/smartcrypt-for-intune/id1489232256) | | :::no-loc text="Speaking Email":::

Partner app - Speaking Email icon | Get more time in your day by having your email read to you on the move. Voice commands and simple gestures designed to be safe to use while driving give you the ability to archive, flag or even reply on the move.

Smart content detection skips over disclaimers, reply headers, and email signatures to speak only the content without the clutter.

Employees can sign in via Intune to access Microsoft 365 Exchange email. | [App Store link (iOS)](https://apps.apple.com/app/apple-store/id991406423?ct=intune) | | :::no-loc text="Synchrotab for Intune":::

Partner app - Synchrotab for Intune icon | Synchrotab is an iOS app that allows a presenter to broadcast PDF documents from a tablet or iPhone to a group of up to 8 viewer tablets. The devices communicate via peer-to-peer Wi-Fi, thus eliminating the need for a common network access. Time stamped records of materials displayed and active participants is supplied as required, together with embedded meeting notes. The viewer sees a synchronized version of the presenter’s screen with zoom and on-screen mark-up capability. Multiple documents may be uploaded to the primary device memory via email or external file network, allowing immediate access to an entire library of presentations or reports. Synchrotab makes its own statement of sustainability while eliminating costly printing and freight charges. The system was designed in cooperation with a major global investment bank ensuring exacting standards of security and integration with corporate devices. | [App Store link (iOS)](https://apps.apple.com/app/synchrotab-for-intune/id1626123415) | | :::no-loc text="Synergi Life":::

Partner app - Synergi Life icon | Synergi Life Mobile App, an extension of Synergi Life, lets users easily create observations and incident reports anytime and from anywhere, using their phones to take a snapshot and make a voice recording.

Synergi Life (previously named Synergi) is a complete business solution for risk and QHSE management, managing all non-conformances, incidents, risk, risk analyses, audits, assessments and improvement suggestions.

The Synergi Life Mobile App requires you to be a licensed user of the Synergi Life risk and QHSE management system, and have the necessary back-end licensed software and services. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.dnv.mobilesolutions.synergimobile.uibase), [App Store link (iOS)](https://apps.apple.com/us/app/synergi-life/id641181737) | | :::no-loc text="Tableau Mobile for Intune":::

Partner app - Tableau Mobile for Intune icon | Tableau Mobile gives you the freedom to stay on top of your data, no matter where you are or when you need it. With a fast, intuitive, and interactive experience, explore your dashboards and find just what you’re looking for, all from the convenience of your mobile device.

The Tableau Mobile app requires a Tableau Server or Tableau Online account. Please note, it does not work with Tableau Public.

Features:

  • Interactive previews let you access your data even when you’re offline.
  • Mark your favorite dashboards or views to always have them at your fingertips.
  • Scroll, search, and browse your organization’s dashboards with a navigation experience that’s both intuitive and familiar.
  • Interact with your data to ask and answer questions on the go.
| [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.Tableau.TableauApp.Intune), [App Store link (iOS)](https://apps.apple.com/app/tableau-mobile-for-intune/id1500089067) | +| :::no-loc text="Talent.Exchange":::

Partner app - Talent.Exchange icon | Talent.Exchange (TALEX) is a Mobile AI Copilot for staffing and resource management professionals. It is designed to:

  • Increase speed of sourcing, screening, and processing of candidates and employees (based on use case).
  • Automatically generate skill-based supply inventory by expertise and proficiency levels.
  • Provide global market and competitor demand visibility to staffing professionals to increase their revenue and monetization.
  • Engage, communicate and act on-the-go with candidates and colleagues.

TALEX mobile app takes staffing and resource management to the next level by making the power of domain AI directly accessible anytime and anywhere in the comfort of your palm. In addition to being available as an integrated app interface for highly scalable enterprise applications, powerful app features can also operate in standalone mode. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.talent.exchange), [App Store link (iOS)](https://apps.apple.com/us/app/talent-exchange/id6468228155) | | :::no-loc text="Unique Moments":::

Partner app - Unique Moments icon | Unlock the power of data with Unique! Record your meetings anywhere and anytime you want - thanks to the Unique app. After a meeting, you can upload the recording into the Unique platform to add it to the deal room. No information will be missed anymore.

Increase your revenue by improving client interactions and automating routine tasks. With Unique Moments you can record conversations, assign those conversations to deal/coaching rooms, and view deal/coaching rooms. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=ch.unique.moments), [App Store link (iOS)](https://apps.apple.com/ro/app/unique-moments/id1619761948) | -| :::no-loc text="Varicent":::

Partner app - Varicent icon | Varicent helps sellers understand which activities provide the best results. Reports, dashboards, and workflows help sales to understand:

  • Achievement
  • Bonus
  • Commission
  • Credits
  • Disputes
  • Key Performance Indicators (KPIs)
  • Opportunity potential
  • Plan approval
  • Plan assignment
  • Quota
  • Ranking
  • Rewards
  • Territory
  • Transactional payout

If you’re an individual seller, manager, or leader, Varicent can help you understand the right information at the right time. Full views of charts, graphs, dashboards and workflow execution (including information input) are right at your fingertips. Realize a better time-to-value for your go-to-market strategy with Varicent Sales Performance Management.

NOTE:
This application requires that you are a client of Varicent to utilize all features and functionalities and maximize seller performance. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.varicent), [App Store link (iOS)](https://apps.apple.com/app/varicent/id1534176581) | +| :::no-loc text="Varicent":::

Partner app - Varicent icon | Varicent helps sellers understand which activities provide the best results. Reports, dashboards, and workflows help sales to understand:

  • Achievement
  • Bonus
  • Commission
  • Credits
  • Disputes
  • Key Performance Indicators (KPIs)
  • Opportunity potential
  • Plan approval
  • Plan assignment
  • Quota
  • Ranking
  • Rewards
  • Territory
  • Transactional payout

If you’re an individual seller, manager, or leader, Varicent can help you understand the right information at the right time. Full views of charts, graphs, dashboards and workflow execution (including information input) are right at your fingertips. Realize a better time-to-value for your go-to-market strategy with Varicent Sales Performance Management.

NOTE:
This application requires that you're a client of Varicent to utilize all features and functionalities and maximize seller performance. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.varicent), [App Store link (iOS)](https://apps.apple.com/app/varicent/id1534176581) | | :::no-loc text="Vbrick Mobile":::

Partner app - Vbrick Mobile icon | Customers using Vbrick Enterprise Video Platform (EVP) can upload and view on-demand videos using the Vbrick mobile app. Customers can use Microsoft Intune to manage access to the Vbrick mobile app. The Vbrick mobile app includes the following features:

  • View a carousel of featured videos
  • Browse feeds of recommended and most recent content
  • Search for videos
  • Scan categories and channels to find videos of interest
  • Approved that Media Contributors can upload videos captured on your mobile device

**NOTE**: The Vbrick app requires users to have an active account and email address in their company’s cloud-hosted Vbrick tenant. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.vbrick.rev), [App Store link (iOS)](https://apps.apple.com/us/app/vbrick-mobile/id1630811585) | | :::no-loc text="VerityRMS":::

Partner app - VerityRMS icon | VerityRMS for iOS offers Asset Managers and Investment Professionals a full-featured and modern mobile experience. Equipped with a full suite of consumption and authoring tools, users can harness their firm’s investment process from anywhere. | [App Store link (iOS)](https://apps.apple.com/app/verityrms/id589633211) | -| :::no-loc text="Voltage SecureMail":::

:::image type="icon" source="./media/apps-supported-intune-apps/icon-p-voltage-securemail.png"::: | Send and receive Voltage encrypted secure email and attachments in the Microsoft Intune managed environment with Voltage SecureMail Mobile. Any user can receive and read Voltage encrypted messages. However, replying to messages and composing new secure emails requires these features to be enabled by the sending organization. Users can also compose, send, reply to, forward, and print encrypted messages, according to the SecureMail Mobile policy for their organization or for the organization sending the secure message. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.voltage.mobile.securemail.ui), [App Store link (iOS)](https://apps.apple.com/us/app/voltage-mail/id516444730) | -| :::no-loc text="VPSX® Print for Intune":::

:::image type="icon" source="./media/apps-supported-intune-apps/icon-p-vpsxprint.png"::: | VPSX® Print is not a stand-alone application. It requires the use of Mobile Connector for VPSX.

VPSX Print utilizes the capabilities of LRS® output management software by providing an easy to use interface that allows users to do the following actions:

  • Print a document or web page within seconds
  • Select only authorized VPSX printers
  • Search for authorized printers by printer name, long name or printer location
  • Print multiple copies
  • Locate and print to nearby printer
| [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.lrs.vpsxprint.intune), [App Store link (iOS)](https://apps.apple.com/us/app/vpsx-print-for-intune/id1520029386) | +| :::no-loc text="Voltage SecureMail":::

Partner app - Voltage securemail icon | Send and receive Voltage encrypted secure email and attachments in the Microsoft Intune managed environment with Voltage SecureMail Mobile. Any user can receive and read Voltage encrypted messages. However, replying to messages and composing new secure emails requires these features to be enabled by the sending organization. Users can also compose, send, reply to, forward, and print encrypted messages, according to the SecureMail Mobile policy for their organization or for the organization sending the secure message. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.voltage.mobile.securemail.ui), [App Store link (iOS)](https://apps.apple.com/us/app/voltage-mail/id516444730) | +| :::no-loc text="VPSX® Print for Intune":::

Partner app - vpsxprint icon | VPSX® Print is not a stand-alone application. It requires the use of Mobile Connector for VPSX.

VPSX Print utilizes the capabilities of LRS® output management software by providing an easy to use interface that allows users to do the following actions:

  • Print a document or web page within seconds
  • Select only authorized VPSX printers
  • Search for authorized printers by printer name, long name or printer location
  • Print multiple copies
  • Locate and print to nearby printer
| [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.lrs.vpsxprint.intune), [App Store link (iOS)](https://apps.apple.com/us/app/vpsx-print-for-intune/id1520029386) | | :::no-loc text="Zero for Intune":::

Partner app - Zero for Intune icon | The ZERØ for Intune application is specifically designed for MDM deployment via Microsoft Intune. This app allows both ZERØ and Microsoft Intune customers to take advantage of a secure Intune MDM deployment, as well as organize and protect BYOD environments with mobile application management (MAM). | [App Store link (iOS)](https://apps.apple.com/app/zero-for-intune/id1508485761) | | :::no-loc text="Zoom for Intune":::

Partner app - Zoom for Intune icon | Zoom is your communications hub for meetings, webinars, chat and cloud phone. Start or join meetings with flawless video, crystal clear audio and instant screen sharing from desktop, mobile or conference rooms. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=us.zoom.videomeetings4intune),
[App Store link (iOS)](https://apps.apple.com/app/zoom-for-intune/id1462818858?mt=8) | diff --git a/memdocs/intune/apps/apps-win32-add.md b/memdocs/intune/apps/apps-win32-add.md index 52008898670..e2cb2c9d59c 100644 --- a/memdocs/intune/apps/apps-win32-add.md +++ b/memdocs/intune/apps/apps-win32-add.md @@ -6,7 +6,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 08/22/2023 +ms.date: 09/11/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: apps @@ -118,6 +118,9 @@ On the **Program** page, configure the app installation and removal commands for `msiexec /x "{12345A67-89B0-1234-5678-000001000000}"` + > [!NOTE] + > Environment variable expansion within the **Uninstall command** is not supported. If you require the use of environment variables, use a custom wrapper script within your Win32 package to wrap the appropriate command and use this script for the **Uninstall command**. + - **Installation time required**: The number of minutes the system will wait for install program to finish. Default value is 60 minutes. If the app takes longer to install than the set installation time, the system will fail the app install. Max timeout value is 1440 minutes (1 day). - **Allow available uninstall**: Select **Yes** to provide the uninstall option for this app for users from the Company Portal. Select **No** to prevent users from uninstalling the app from the Company Portal. @@ -244,7 +247,7 @@ On the **Detection rules** pane, configure the rules to detect the presence of t The Intune agent checks the results from the script. It reads the values written by the script to the STDOUT stream, the standard error (STDERR) stream, and the exit code. If the script exits with a nonzero value, the script fails and the application detection status isn't installed. If the exit code is zero and STDOUT has data, the application detection status is installed. > [!NOTE] - > We recommend encoding your script as UTF-8. When the script exits with the value of **0**, the script execution was successful. The second output channel indicates that the app was detected. STDOUT data indicates that the app was found on the client. We don't look for a particular string from STDOUT. + > We recommend encoding your script as UTF-8 BOM. When the script exits with the value of **0**, the script execution was successful. The second output channel indicates that the app was detected. STDOUT data indicates that the app was found on the client. We don't look for a particular string from STDOUT. The version of your Win32 app is displayed in the Microsoft Intune admin center. The app version is provided in the **All apps** list, where you can filter by Win32 apps and select the optional **version** column. In the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Apps** > **All apps** > **Columns** > **Version** to display the app version in the app list. diff --git a/memdocs/intune/apps/apps-win32-app-management.md b/memdocs/intune/apps/apps-win32-app-management.md index 332902f8ba6..84adfc784fc 100644 --- a/memdocs/intune/apps/apps-win32-app-management.md +++ b/memdocs/intune/apps/apps-win32-app-management.md @@ -5,7 +5,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 07/31/2024 +ms.date: 08/09/2024 ms.topic: overview ms.service: microsoft-intune ms.subservice: apps @@ -15,12 +15,12 @@ ms.assetid: efdc196b-38f3-4678-ae16-cdec4303f8d2 ms.reviewer: bryanke ms.suite: ems search.appverid: MET150 +ai-usage: ai-assisted ms.collection: - tier1 - M365-identity-device-management - highpri - FocusArea_Apps_Win32 -- AI-Assisted --- # Win32 app management in Microsoft Intune diff --git a/memdocs/intune/apps/apps-win32-s-mode.md b/memdocs/intune/apps/apps-win32-s-mode.md index 27a43f7d8be..4912126a02a 100644 --- a/memdocs/intune/apps/apps-win32-s-mode.md +++ b/memdocs/intune/apps/apps-win32-s-mode.md @@ -47,8 +47,6 @@ The steps to allow Win32 apps to run on a Windows 10 device in S mode are the fo - Intune applies the signed app catalog to install the Win32 app on the S mode device using the [Intune Management Extension](intune-management-extension.md). > [!NOTE] -> Line-of-business (LOB) `.appx` and `.appx` bundles on Windows 10 S mode will be supported via Microsoft Store for Business (MSFB) signing. -> > **S mode supplemental policy** for apps must be delivered via Intune Management Extension. > > S mode policies are enforced at the device level. Multiple targeted policies will be merged on the device. The merged policy will be enforced on the device. diff --git a/memdocs/intune/apps/apps-windows-10-app-deploy.md b/memdocs/intune/apps/apps-windows-10-app-deploy.md index 44538262323..4524b3a3e93 100644 --- a/memdocs/intune/apps/apps-windows-10-app-deploy.md +++ b/memdocs/intune/apps/apps-windows-10-app-deploy.md @@ -37,7 +37,7 @@ ms.collection: Microsoft Intune supports a variety of app types and deployment scenarios on Windows 10 devices. After you've added an app to Intune, you can assign the app to users and devices. This article provides more details on the supported Windows scenarios, and also covers key details to note when you're deploying apps to Windows. For information about deploying an app, also known as assigning an app, see [Assign an app](../apps/apps-deploy.md#assign-an-app) to a group. -Line-of-business (LOB) apps and Microsoft Store for Business apps are the app types supported on Windows 10 devices. The file extensions for Windows apps include .msi, .appx, and .appxbundle. +A Line-of-business (LOB) app is the app type supported on Windows 10 devices. The file extensions for Windows apps include .msi, .appx, and .appxbundle. > [!NOTE] > To deploy modern apps, you need at least: diff --git a/memdocs/intune/apps/intune-management-extension.md b/memdocs/intune/apps/intune-management-extension.md index 19d0f2a8343..26e0818fe4d 100644 --- a/memdocs/intune/apps/intune-management-extension.md +++ b/memdocs/intune/apps/intune-management-extension.md @@ -7,7 +7,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 02/14/2024 +ms.date: 08/21/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: apps @@ -83,19 +83,19 @@ The Intune management extension supplements the in-box Windows 10 MDM features. The Intune management extension has the following prerequisites. Once they're met, the Intune management extension installs automatically when a PowerShell script or Win32 app is assigned to the user or device. - Devices running Windows 10 version 1607 or later. If the device is enrolled using [bulk auto-enrollment](../enrollment/windows-bulk-enroll.md), devices must run Windows 10 version 1709 or later. The Intune management extension isn't supported on Windows 10 in S mode, as S mode doesn't allow running non-store apps. - -- Devices joined to Microsoft Entra ID, including: - + +- Devices joined to Microsoft Entra ID, including: + - Microsoft Entra hybrid joined: Devices joined to Microsoft Entra ID, and also joined to on-premises Active Directory (AD). See [Plan your Microsoft Entra hybrid join implementation](/azure/active-directory/devices/hybrid-azuread-join-plan) for guidance. - + - Microsoft Entra registered/Workplace joined (WPJ): Devices [registered](/azure/active-directory/user-help/user-help-register-device-on-network) in Microsoft Entra ID, see [Workplace Join as a seamless second factor authentication](/windows-server/identity/ad-fs/operations/join-to-workplace-from-any-device-for-sso-and-seamless-second-factor-authentication-across-company-applications#BKMK_DRS) for more information. Typically these are Bring Your Own Device (BYOD) devices which have had a work or school account added via Settings>Accounts>Access work or school. - Devices enrolled in Intune, including: - Devices enrolled in a group policy (GPO). See [Enroll a Windows 10 device automatically using Group Policy](/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy) for guidance. - + - Devices manually enrolled in Intune, which is when: - + - [Auto-enrollment to Intune](../enrollment/quickstart-setup-auto-enrollment.md) is enabled in Microsoft Entra ID. Users sign in to devices using a local user account, and manually join the device to Microsoft Entra ID. Then, they sign in to the device using their Microsoft Entra account. OR @@ -204,6 +204,8 @@ Agent logs on the client machine are typically in `C:\ProgramData\Microsoft\Intu ![Screenshot or sample cmtrace agent logs in Microsoft Intune](./media/apps-win32-app-management/apps-win32-app-10.png) +In addition, you can use the log file *AppWorkload.log* to help troubleshoot and analyze Win32 app management events on the client. This log file contains all logging information related to app deployment activities conducted by the IME. + ## Delete a script In **PowerShell scripts**, right-click the script, and select **Delete**. diff --git a/memdocs/intune/apps/lob-apps-windows.md b/memdocs/intune/apps/lob-apps-windows.md index a684e3448bd..db68631c585 100644 --- a/memdocs/intune/apps/lob-apps-windows.md +++ b/memdocs/intune/apps/lob-apps-windows.md @@ -121,7 +121,7 @@ Some MSI installer-based apps are automatically updated by the app developer or This capability is useful to avoid getting into a race condition. For instance, a race condition can occur when the app is automatically updated by the app developer and is updated by Intune. Both might try to enforce a version of the app on a Windows client, which creates a conflict. ## Add store-signed LOB apps for Surface Hub devices -You can add and deploy store-signed LOB apps (single file *.appx*, *.msix*, *.appxbundle*, and *.msixbundle*) to Surface Hub devices. The support for store-signed LOB apps enables offline store apps to be deployed to Surface Hub devices following the retirement of the Microsoft Store for Business. +You can add and deploy store-signed LOB apps (single file *.appx*, *.msix*, *.appxbundle*, and *.msixbundle*) to Surface Hub devices. The support for store-signed LOB apps enables offline store apps to be deployed to Surface Hub devices. ## Next steps diff --git a/memdocs/intune/apps/macos-shell-scripts.md b/memdocs/intune/apps/macos-shell-scripts.md index b9f0581004c..96f664b9fbf 100644 --- a/memdocs/intune/apps/macos-shell-scripts.md +++ b/memdocs/intune/apps/macos-shell-scripts.md @@ -7,7 +7,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 02/21/2024 +ms.date: 08/08/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: apps @@ -111,7 +111,7 @@ The following items are required to collect logs on a macOS device: #### Collect device logs 1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). -2. Navigate to **Devices** > **Scripts** and select a macOS shell script. +2. Navigate to **Devices** > **Manage devices** > **Scripts and remediations** > **Platform scripts** and select a macOS shell script. 3. In **Device status** or **User status** report, select a device. 4. Select **Collect logs**, provide folder paths of log files separated only by a semicolon (;) without spaces or newlines in between paths.
For example, multiple paths should be written as `/Path/to/logfile1.zip;/Path/to/logfile2.log`. diff --git a/memdocs/intune/apps/macos-unmanaged-pkg.md b/memdocs/intune/apps/macos-unmanaged-pkg.md index bf534a98ce5..7a1b75251ea 100644 --- a/memdocs/intune/apps/macos-unmanaged-pkg.md +++ b/memdocs/intune/apps/macos-unmanaged-pkg.md @@ -102,7 +102,7 @@ You can optionally configure a preinstall script and a post-install script to cu **Post-install script**: Provide a script that runs after the app installs successfully. If provided, the post-install script runs after a successful app installation. Irrespective of the post-install script run status, an installed app reports its installation status as "success". > [!NOTE] -> - Each pre-install or post-install script must be less than 5121 characters long. +> - Each pre-install or post-install script must be less than 15360 characters long. > - The Microsoft Intune management agent for macOS version 2309.007 or greater is required to configure pre-install and post-install scripts for macOS PKG apps. > - For more details on configuring pre-install and post-install scripts, refer to [Prerequisites of shell scripts](../apps/macos-shell-scripts.md#prerequisites). diff --git a/memdocs/intune/apps/manage-microsoft-edge-windows.md b/memdocs/intune/apps/manage-microsoft-edge-windows.md index 6776e6d2b5f..b62377897ea 100644 --- a/memdocs/intune/apps/manage-microsoft-edge-windows.md +++ b/memdocs/intune/apps/manage-microsoft-edge-windows.md @@ -8,7 +8,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 09/07/2023 +ms.date: 08/08/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: apps diff --git a/memdocs/intune/apps/manage-microsoft-edge.md b/memdocs/intune/apps/manage-microsoft-edge.md index 231e9b22080..60e22aa76da 100644 --- a/memdocs/intune/apps/manage-microsoft-edge.md +++ b/memdocs/intune/apps/manage-microsoft-edge.md @@ -49,22 +49,11 @@ The richest and broadest protection capabilities for Microsoft 365 data are avai > [!NOTE] > New web clips (pinned web apps) on iOS devices will open in Edge for iOS and Android instead of the Intune Managed Browser when required to open in a protected browser. For older iOS web clips, you must re-target these web clips to ensure they open in Edge for iOS and Android rather than the Managed Browser. -## Apply Conditional Access -Organizations can use Microsoft Entra Conditional Access policies to ensure that users can only access work or school content using Edge for iOS and Android. To do this, you'll need a conditional access policy that targets all potential users. These policies are described in [Conditional Access: Require approved client apps or app protection policy](/azure/active-directory/conditional-access/howto-policy-approved-app-or-app-protection). - -Follow the steps in [Require approved client apps or app protection policy with mobile devices](/azure/active-directory/conditional-access/howto-policy-approved-app-or-app-protection#require-approved-client-apps-or-app-protection-policy-with-mobile-devices), which allows Edge for iOS and Android, but blocks other mobile device web browsers from connecting to Microsoft 365 endpoints. - ->[!NOTE] -> This policy ensures mobile users can access all Microsoft 365 endpoints from within Edge for iOS and Android. This policy also prevents users from using InPrivate to access Microsoft 365 endpoints. - -With Conditional Access, you can also target on-premises sites that you have exposed to external users via the [Microsoft Entra application proxy](/azure/active-directory/active-directory-application-proxy-get-started). - -> [!NOTE] -> To leverage app-based conditional access policies, the Microsoft Authenticator app must be installed on iOS devices. For Android devices, the Intune Company Portal app is required. For more information, see [App-based Conditional Access with Intune](../protect/app-based-conditional-access-intune.md). - ## Create Intune app protection policies -App Protection Policies (APP) define which apps are allowed and the actions they can take with your organization's data. The choices available in APP enable organizations to tailor the protection to their specific needs. For some, it may not be obvious which policy settings are required to implement a complete scenario. To help organizations prioritize mobile client endpoint hardening, Microsoft has introduced taxonomy for its APP data protection framework for iOS and Android mobile app management. +As organizations increasingly adopt SaaS and web applications, browsers have become essential tools for businesses. Users often need to access these applications from mobile browsers while on the go. Ensuring that data accessed through mobile browsers is protected from intentional or unintentional leaks is crucial. For instance, users might inadvertently share organizations’ data with personal apps, leading to data leakage, or download it to local devices, which also poses a risk. + +Organizations can protect data from being leaked when users browse with Microsoft Edge for mobile by configuring App Protection Policies (APP), which define what apps are allowed and the actions they can take with your organizations' data. The choices available in APP enable organizations to tailor the protection to their specific needs. For some, it may not be obvious which policy settings are required to implement a complete scenario. To help organizations prioritize mobile client endpoint hardening, Microsoft has introduced taxonomy for its APP data protection framework for iOS and Android mobile app management. The APP data protection framework is organized into three distinct configuration levels, with each level building off the previous level: @@ -82,12 +71,28 @@ Regardless of whether the device is enrolled in a unified endpoint management (U - Determine which framework level meets your requirements. Most organizations should implement the settings defined in **Enterprise enhanced data protection** (Level 2) as that enables data protection and access requirements controls. -For more information on the available settings, see [Android app protection policy settings](app-protection-policy-settings-android.md) and [iOS app protection policy settings](app-protection-policy-settings-ios.md). +> [!NOTE] +> One of the settings related to browsers is 'Restrict web content transfer with other apps'. In **Enterprise enhanced data protection** (Level 2), the value of this setting is configured to Microsoft Edge. +> When Outlook and Microsoft Teams are protected by App Protection Policies (APP), Microsoft Edge will be used to open links from these apps, ensuring that the links are secure and protected. +> For more information on the available settings, see [Android app protection policy settings](app-protection-policy-settings-android.md) and [iOS app protection policy settings](app-protection-policy-settings-ios.md). > [!IMPORTANT] > To apply Intune app protection policies against apps on Android devices that are not enrolled in Intune, the user must also install the Intune Company Portal. - +## Apply Conditional Access +While it's important to protect Microsoft Edge with App Protection Policies (APP), it's also crucial to ensure Microsoft Edge is the mandatory browser for opening corporate applications. Users might otherwise use other unprotected browsers to access corporate applications, potentially leading to data leaks. + +Organizations can use Microsoft Entra Conditional Access policies to ensure that users can only access work or school content using Edge for iOS and Android. To do this, you'll need a conditional access policy that targets all potential users. These policies are described in [Conditional Access: Require approved client apps or app protection policy](/azure/active-directory/conditional-access/howto-policy-approved-app-or-app-protection). + +Follow the steps in [Require approved client apps or app protection policy with mobile devices](/azure/active-directory/conditional-access/howto-policy-approved-app-or-app-protection#require-approved-client-apps-or-app-protection-policy-with-mobile-devices), which allows Edge for iOS and Android, but blocks other mobile device web browsers from connecting to Microsoft 365 endpoints. + +>[!NOTE] +> This policy ensures mobile users can access all Microsoft 365 endpoints from within Edge for iOS and Android. This policy also prevents users from using InPrivate to access Microsoft 365 endpoints. + +With Conditional Access, you can also target on-premises sites that you have exposed to external users via the [Microsoft Entra application proxy](/azure/active-directory/active-directory-application-proxy-get-started). + +> [!NOTE] +> To leverage app-based conditional access policies, the Microsoft Authenticator app must be installed on iOS devices. For Android devices, the Intune Company Portal app is required. For more information, see [App-based Conditional Access with Intune](../protect/app-based-conditional-access-intune.md). ## Single sign-on to Microsoft Entra connected web apps in policy-protected browsers @@ -168,16 +173,7 @@ Edge for iOS and Android offers organizations several options for adjusting the #### Organization logo and brand color -These settings allow you to customize the New Tab Page for Edge for iOS and Android to display your organization's logo and brand color as the page background. - -To upload your organization's logo and color, first complete the following steps: -1. Within [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), navigate to **Tenant Administration** > **Customization**. Next to **Settings**, click **Edit**. -2. To set your brand's logo, next to **Show in header**, choose "Organization logo only". Transparent background logos are recommended. -3. To set your brand's background color, select a **Theme color**. Edge for iOS and Android applies a lighter shade of the color on the New Tab Page, which ensures the page has high readability. - -> [!NOTE] -> As Azure Active Directory (Azure AD) Graph is deprecated, it has entered its retire phase. See details on [Migrate Azure AD Graph Overview](/graph/migrate-azure-ad-graph-overview). As a result, organization logo and brand color maintained within Intune Admin center will be inaccessible when Azure Active Directory (Azure AD) Graph is completely retired. -> Therefore, starting version v116 of Edge for iOS and Android, organization logo and brand color will be retrieved from Microsoft Graph. You need to maintain your organization logo and brand color via [steps](/azure/active-directory/fundamentals/how-to-customize-branding). **Banner logo** will be used as your organization and **Page background color** will be used as brand color. +The organization logo and brand color settings allow you to customize the **New Tab Page** for Edge on iOS and Android devices. The **Banner logo** is used as your organization's logo and the **Page background color** is used as your organization's brand color. For more information, see [Configure your company branding](/entra/fundamentals/how-to-customize-branding). Next, use the following key/value pairs to pull your organization's branding into Edge for iOS and Android: @@ -284,7 +280,7 @@ Edge for iOS and Android allows organizations to disable certain features that a |Key |Value | |:-----------|:-------------| -|com.microsoft.intune.mam.managedbrowser.disabledFeatures|**password** disables prompts that offer to save passwords for the end user
**inprivate** disables InPrivate browsing
**autofill** disables "Save and Fill Addresses" and "Save and Fill Payment info". Autofill will be disabled even for previously saved information
**translator** disables translator
**readaloud** disables read aloud
**drop** disables drop
**coupons** disables coupons
**extensions** disables extensions (Edge for Android only)
**developertools** grays out the build version numbers to prevent users from accessing Developer options (Edge for Android only)
**UIRAlert** suppress re-verify account popups in new tab page screen and in account settings page

To disable multiple features, separate values with `|`. For example, `inprivate|password` disables both InPrivate and password storage. | +|com.microsoft.intune.mam.managedbrowser.disabledFeatures|**password** disables prompts that offer to save passwords for the end user
**inprivate** disables InPrivate browsing
**autofill** disables "Save and Fill Addresses" and "Save and Fill Payment info". Autofill will be disabled even for previously saved information
**translator** disables translator
**readaloud** disables read aloud
**drop** disables drop
**coupons** disables coupons
**extensions** disables extensions (Edge for Android only)
**developertools** grays out the build version numbers to prevent users from accessing Developer options (Edge for Android only)
**UIRAlert** suppress re-verify account popups in new tab page screen

To disable multiple features, separate values with `|`. For example, `inprivate|password` disables both InPrivate and password storage. | #### Disable import passwords feature @@ -500,7 +496,7 @@ When a web page requests to open an external app, users will see a pop-up asking ### Copilot > [!NOTE] -> Copilot is also known as Bing Chat Enterprise. Only Copilot eligible users can use Copilot. For more information, see [Frequently asked questions about Copilot](/copilot/faq) +> As of version 128, Copilot for work or school accounts has been deprecated. Therefore, the following policies will no longer be valid in version 128 Copilot is available on Microsoft Edge for iOS and Android. Users can start Copilot by clicking on Copilot button in bottom bar. diff --git a/memdocs/intune/apps/manage-without-gms.md b/memdocs/intune/apps/manage-without-gms.md index bc69b1a3506..909d0dba6fc 100644 --- a/memdocs/intune/apps/manage-without-gms.md +++ b/memdocs/intune/apps/manage-without-gms.md @@ -8,7 +8,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 02/23/2024 +ms.date: 08/20/2024 ms.topic: conceptual ms.service: microsoft-intune ms.subservice: apps @@ -75,7 +75,10 @@ In conditions where GMS isn't available: - If the device is enrolled with device administrator and running the Company Portal app version 5.0.5655.0 and newer, then Intune tries to check for new tasks and notifications approximately every 15 minutes. -- If the device is enrolled with Android (AOSP) management and running the Intune app version 24.02.4 and newer, then Intune tries to check for new tasks and notifications approximately every 15 minutes. +- If the device is enrolled with Android (AOSP) management and running the Intune app version 24.02.4 and newer, then Intune tries to check for new tasks and notifications normally every 15 minutes, however some tasks on AOSP devices may take up to 8 hours to complete. + + > [!IMPORTANT] + > From mid-August 2024 until October 2024, some tasks on AOSP devices may take up to 8 hours to complete. Previously, it typically was 15 minutes. During this period, devices will continue to check-in every 8 hours. On AOSP devices, you may notice a decrease in the frequency of task completion. After October 2024, the sync time will return to about 15 minutes. This frequency is also affected by the device manufacturer, device usage patterns, and whether battery optimization is enabled for the Company Portal or Intune apps. diff --git a/memdocs/intune/apps/media/app-configuration-policies-overview/device-install-status-2.png b/memdocs/intune/apps/media/app-configuration-policies-overview/device-install-status-2.png deleted file mode 100644 index 74e3a958efa..00000000000 Binary files a/memdocs/intune/apps/media/app-configuration-policies-overview/device-install-status-2.png and /dev/null differ diff --git a/memdocs/intune/apps/media/app-protection-policies-monitor/app-protection-report-csv-1.png b/memdocs/intune/apps/media/app-protection-policies-monitor/app-protection-report-csv-1.png deleted file mode 100644 index 82e8f9442a8..00000000000 Binary files a/memdocs/intune/apps/media/app-protection-policies-monitor/app-protection-report-csv-1.png and /dev/null differ diff --git a/memdocs/intune/apps/media/app-protection-policies-monitor/app-protection-report-csv-2.png b/memdocs/intune/apps/media/app-protection-policies-monitor/app-protection-report-csv-2.png deleted file mode 100644 index 0795ad25c75..00000000000 Binary files a/memdocs/intune/apps/media/app-protection-policies-monitor/app-protection-report-csv-2.png and /dev/null differ diff --git a/memdocs/intune/apps/media/app-protection-policies-monitor/mam-reporting-2.png b/memdocs/intune/apps/media/app-protection-policies-monitor/mam-reporting-2.png deleted file mode 100644 index 1ca1b8d5a3e..00000000000 Binary files a/memdocs/intune/apps/media/app-protection-policies-monitor/mam-reporting-2.png and /dev/null differ diff --git a/memdocs/intune/apps/media/app-protection-policies-monitor/mam-reporting-4.png b/memdocs/intune/apps/media/app-protection-policies-monitor/mam-reporting-4.png deleted file mode 100644 index 219e74ab5d6..00000000000 Binary files a/memdocs/intune/apps/media/app-protection-policies-monitor/mam-reporting-4.png and /dev/null differ diff --git a/memdocs/intune/apps/media/app-protection-policies-monitor/mam-reporting-6.png b/memdocs/intune/apps/media/app-protection-policies-monitor/mam-reporting-6.png deleted file mode 100644 index df95d5e0f1a..00000000000 Binary files a/memdocs/intune/apps/media/app-protection-policies-monitor/mam-reporting-6.png and /dev/null differ diff --git a/memdocs/intune/apps/media/app-sideload-windows/win10cp-dependencies-save.png b/memdocs/intune/apps/media/app-sideload-windows/win10cp-dependencies-save.png deleted file mode 100644 index 0cb2a6eaab2..00000000000 Binary files a/memdocs/intune/apps/media/app-sideload-windows/win10cp-dependencies-save.png and /dev/null differ diff --git a/memdocs/intune/apps/media/app-sideload-windows/win10cp-dependent-files.png b/memdocs/intune/apps/media/app-sideload-windows/win10cp-dependent-files.png deleted file mode 100644 index 996c09a0f4b..00000000000 Binary files a/memdocs/intune/apps/media/app-sideload-windows/win10cp-dependent-files.png and /dev/null differ diff --git a/memdocs/intune/apps/media/app-sideload-windows/win10cp-error-message.png b/memdocs/intune/apps/media/app-sideload-windows/win10cp-error-message.png deleted file mode 100644 index 214794892ec..00000000000 Binary files a/memdocs/intune/apps/media/app-sideload-windows/win10cp-error-message.png and /dev/null differ diff --git a/memdocs/intune/apps/media/apps-add-android-for-work/approve-app-permissions.png b/memdocs/intune/apps/media/apps-add-android-for-work/approve-app-permissions.png deleted file mode 100644 index 6498e8a381e..00000000000 Binary files a/memdocs/intune/apps/media/apps-add-android-for-work/approve-app-permissions.png and /dev/null differ diff --git a/memdocs/intune/apps/media/apps-add-android-for-work/approve-app-settings.png b/memdocs/intune/apps/media/apps-add-android-for-work/approve-app-settings.png deleted file mode 100644 index 21127f8948d..00000000000 Binary files a/memdocs/intune/apps/media/apps-add-android-for-work/approve-app-settings.png and /dev/null differ diff --git a/memdocs/intune/apps/media/apps-add-android-for-work/approve.png b/memdocs/intune/apps/media/apps-add-android-for-work/approve.png deleted file mode 100644 index 4158b47365e..00000000000 Binary files a/memdocs/intune/apps/media/apps-add-android-for-work/approve.png and /dev/null differ diff --git a/memdocs/intune/apps/media/apps-inc-exl-assignments/apps-inc-exl-01.png b/memdocs/intune/apps/media/apps-inc-exl-assignments/apps-inc-exl-01.png deleted file mode 100644 index 0b01e02c047..00000000000 Binary files a/memdocs/intune/apps/media/apps-inc-exl-assignments/apps-inc-exl-01.png and /dev/null differ diff --git a/memdocs/intune/apps/media/apps-inc-exl-assignments/apps-inc-exl-02.png b/memdocs/intune/apps/media/apps-inc-exl-assignments/apps-inc-exl-02.png deleted file mode 100644 index 74987524e09..00000000000 Binary files a/memdocs/intune/apps/media/apps-inc-exl-assignments/apps-inc-exl-02.png and /dev/null differ diff --git a/memdocs/intune/apps/media/apps-inc-exl-assignments/apps-inc-exl-03.png b/memdocs/intune/apps/media/apps-inc-exl-assignments/apps-inc-exl-03.png deleted file mode 100644 index ead8be1395f..00000000000 Binary files a/memdocs/intune/apps/media/apps-inc-exl-assignments/apps-inc-exl-03.png and /dev/null differ diff --git a/memdocs/intune/apps/media/apps-inc-exl-assignments/apps-inc-exl-04.png b/memdocs/intune/apps/media/apps-inc-exl-assignments/apps-inc-exl-04.png deleted file mode 100644 index 6b5005b7288..00000000000 Binary files a/memdocs/intune/apps/media/apps-inc-exl-assignments/apps-inc-exl-04.png and /dev/null differ diff --git a/memdocs/intune/apps/media/apps-inc-exl-assignments/apps-inc-exl-05.png b/memdocs/intune/apps/media/apps-inc-exl-assignments/apps-inc-exl-05.png deleted file mode 100644 index ae7c02e9747..00000000000 Binary files a/memdocs/intune/apps/media/apps-inc-exl-assignments/apps-inc-exl-05.png and /dev/null differ diff --git a/memdocs/intune/apps/media/apps-quiet-time-policies/apps-quiet-time-policies-03.png b/memdocs/intune/apps/media/apps-quiet-time-policies/apps-quiet-time-policies-03.png deleted file mode 100644 index 04f86ab819e..00000000000 Binary files a/memdocs/intune/apps/media/apps-quiet-time-policies/apps-quiet-time-policies-03.png and /dev/null differ diff --git a/memdocs/intune/apps/media/apps-supported-intune-apps/icon-p-365pay.png b/memdocs/intune/apps/media/apps-supported-intune-apps/icon-p-365pay.png new file mode 100644 index 00000000000..f5d1811fb70 Binary files /dev/null and b/memdocs/intune/apps/media/apps-supported-intune-apps/icon-p-365pay.png differ diff --git a/memdocs/intune/apps/media/apps-supported-intune-apps/icon-p-bluejeans.png b/memdocs/intune/apps/media/apps-supported-intune-apps/icon-p-bluejeans.png deleted file mode 100644 index 2d76c34112f..00000000000 Binary files a/memdocs/intune/apps/media/apps-supported-intune-apps/icon-p-bluejeans.png and /dev/null differ diff --git a/memdocs/intune/apps/media/apps-supported-intune-apps/icon-p-breezy.png b/memdocs/intune/apps/media/apps-supported-intune-apps/icon-p-breezy.png deleted file mode 100644 index e23452295b7..00000000000 Binary files a/memdocs/intune/apps/media/apps-supported-intune-apps/icon-p-breezy.png and /dev/null differ diff --git a/memdocs/intune/apps/media/apps-supported-intune-apps/icon-p-citrix-sharefile.png b/memdocs/intune/apps/media/apps-supported-intune-apps/icon-p-citrix-sharefile.png deleted file mode 100644 index f8502eda7e7..00000000000 Binary files a/memdocs/intune/apps/media/apps-supported-intune-apps/icon-p-citrix-sharefile.png and /dev/null differ diff --git a/memdocs/intune/apps/media/apps-supported-intune-apps/icon-p-islandbrowser.png b/memdocs/intune/apps/media/apps-supported-intune-apps/icon-p-islandbrowser.png new file mode 100644 index 00000000000..0e00485b156 Binary files /dev/null and b/memdocs/intune/apps/media/apps-supported-intune-apps/icon-p-islandbrowser.png differ diff --git a/memdocs/intune/apps/media/apps-supported-intune-apps/icon-p-lexmark-mobile-print.png b/memdocs/intune/apps/media/apps-supported-intune-apps/icon-p-lexmark-mobile-print.png deleted file mode 100644 index 3e8916d9384..00000000000 Binary files a/memdocs/intune/apps/media/apps-supported-intune-apps/icon-p-lexmark-mobile-print.png and /dev/null differ diff --git a/memdocs/intune/apps/media/apps-supported-intune-apps/icon-p-recruitment-exchange.png b/memdocs/intune/apps/media/apps-supported-intune-apps/icon-p-recruitment-exchange.png new file mode 100644 index 00000000000..d1848f7ff35 Binary files /dev/null and b/memdocs/intune/apps/media/apps-supported-intune-apps/icon-p-recruitment-exchange.png differ diff --git a/memdocs/intune/apps/media/apps-supported-intune-apps/icon-p-singletrack.png b/memdocs/intune/apps/media/apps-supported-intune-apps/icon-p-singletrack.png new file mode 100644 index 00000000000..b9533375e8c Binary files /dev/null and b/memdocs/intune/apps/media/apps-supported-intune-apps/icon-p-singletrack.png differ diff --git a/memdocs/intune/apps/media/apps-supported-intune-apps/icon-p-talentexchange.png b/memdocs/intune/apps/media/apps-supported-intune-apps/icon-p-talentexchange.png new file mode 100644 index 00000000000..2714056b6b2 Binary files /dev/null and b/memdocs/intune/apps/media/apps-supported-intune-apps/icon-p-talentexchange.png differ diff --git a/memdocs/intune/apps/media/apps-supported-intune-apps/icon-p-vera.png b/memdocs/intune/apps/media/apps-supported-intune-apps/icon-p-vera.png deleted file mode 100644 index 73803039e0c..00000000000 Binary files a/memdocs/intune/apps/media/apps-supported-intune-apps/icon-p-vera.png and /dev/null differ diff --git a/memdocs/intune/apps/media/enterprise-app-catalog/apps-add-enterprise-app-03.png b/memdocs/intune/apps/media/enterprise-app-catalog/apps-add-enterprise-app-03.png deleted file mode 100644 index da263bda7f2..00000000000 Binary files a/memdocs/intune/apps/media/enterprise-app-catalog/apps-add-enterprise-app-03.png and /dev/null differ diff --git a/memdocs/intune/apps/media/enterprise-app-catalog/apps-add-enterprise-app-04.png b/memdocs/intune/apps/media/enterprise-app-catalog/apps-add-enterprise-app-04.png deleted file mode 100644 index 79bbb9893f9..00000000000 Binary files a/memdocs/intune/apps/media/enterprise-app-catalog/apps-add-enterprise-app-04.png and /dev/null differ diff --git a/memdocs/intune/apps/media/enterprise-app-catalog/apps-add-enterprise-app-05.png b/memdocs/intune/apps/media/enterprise-app-catalog/apps-add-enterprise-app-05.png deleted file mode 100644 index 077a4953454..00000000000 Binary files a/memdocs/intune/apps/media/enterprise-app-catalog/apps-add-enterprise-app-05.png and /dev/null differ diff --git a/memdocs/intune/apps/media/enterprise-app-catalog/apps-add-enterprise-app-06.png b/memdocs/intune/apps/media/enterprise-app-catalog/apps-add-enterprise-app-06.png deleted file mode 100644 index d7cb640f23e..00000000000 Binary files a/memdocs/intune/apps/media/enterprise-app-catalog/apps-add-enterprise-app-06.png and /dev/null differ diff --git a/memdocs/intune/apps/media/enterprise-app-catalog/apps-add-enterprise-app-07.png b/memdocs/intune/apps/media/enterprise-app-catalog/apps-add-enterprise-app-07.png deleted file mode 100644 index 9e15caa9b1c..00000000000 Binary files a/memdocs/intune/apps/media/enterprise-app-catalog/apps-add-enterprise-app-07.png and /dev/null differ diff --git a/memdocs/intune/apps/media/securing-data-edge-for-business/securing-data-edge-for-business-steps-01.png b/memdocs/intune/apps/media/securing-data-edge-for-business/securing-data-edge-for-business-steps-01.png deleted file mode 100644 index b7ffc1d3de9..00000000000 Binary files a/memdocs/intune/apps/media/securing-data-edge-for-business/securing-data-edge-for-business-steps-01.png and /dev/null differ diff --git a/memdocs/intune/apps/media/securing-data-edge-for-business/securing-data-edge-for-business0.png b/memdocs/intune/apps/media/securing-data-edge-for-business/securing-data-edge-for-business0.png deleted file mode 100644 index 0039da9578b..00000000000 Binary files a/memdocs/intune/apps/media/securing-data-edge-for-business/securing-data-edge-for-business0.png and /dev/null differ diff --git a/memdocs/intune/apps/media/securing-data-edge-for-business/securing-data-edge-for-business34.png b/memdocs/intune/apps/media/securing-data-edge-for-business/securing-data-edge-for-business34.png deleted file mode 100644 index f894c4586a3..00000000000 Binary files a/memdocs/intune/apps/media/securing-data-edge-for-business/securing-data-edge-for-business34.png and /dev/null differ diff --git a/memdocs/intune/apps/media/securing-data-edge-for-business/securing-data-edge-for-business35.png b/memdocs/intune/apps/media/securing-data-edge-for-business/securing-data-edge-for-business35.png deleted file mode 100644 index ecc1348adf2..00000000000 Binary files a/memdocs/intune/apps/media/securing-data-edge-for-business/securing-data-edge-for-business35.png and /dev/null differ diff --git a/memdocs/intune/apps/media/securing-data-edge-for-business/securing-data-edge-for-business40.png b/memdocs/intune/apps/media/securing-data-edge-for-business/securing-data-edge-for-business40.png deleted file mode 100644 index 300b88177ef..00000000000 Binary files a/memdocs/intune/apps/media/securing-data-edge-for-business/securing-data-edge-for-business40.png and /dev/null differ diff --git a/memdocs/intune/apps/media/securing-data-edge-for-business/securing-data-edge-for-business41.png b/memdocs/intune/apps/media/securing-data-edge-for-business/securing-data-edge-for-business41.png deleted file mode 100644 index 053474ed3a5..00000000000 Binary files a/memdocs/intune/apps/media/securing-data-edge-for-business/securing-data-edge-for-business41.png and /dev/null differ diff --git a/memdocs/intune/apps/media/securing-data-edge-for-business/securing-data-edge-for-business42.png b/memdocs/intune/apps/media/securing-data-edge-for-business/securing-data-edge-for-business42.png deleted file mode 100644 index f4ca39aaee0..00000000000 Binary files a/memdocs/intune/apps/media/securing-data-edge-for-business/securing-data-edge-for-business42.png and /dev/null differ diff --git a/memdocs/intune/apps/media/securing-data-edge-for-business/securing-data-edge-for-business43.png b/memdocs/intune/apps/media/securing-data-edge-for-business/securing-data-edge-for-business43.png deleted file mode 100644 index 53fb7dcdf10..00000000000 Binary files a/memdocs/intune/apps/media/securing-data-edge-for-business/securing-data-edge-for-business43.png and /dev/null differ diff --git a/memdocs/intune/apps/media/securing-data-edge-for-business/securing-data-edge-for-business45.png b/memdocs/intune/apps/media/securing-data-edge-for-business/securing-data-edge-for-business45.png deleted file mode 100644 index 41f8966f2a5..00000000000 Binary files a/memdocs/intune/apps/media/securing-data-edge-for-business/securing-data-edge-for-business45.png and /dev/null differ diff --git a/memdocs/intune/apps/media/securing-data-edge-for-business/securing-data-edge-for-business51.png b/memdocs/intune/apps/media/securing-data-edge-for-business/securing-data-edge-for-business51.png deleted file mode 100644 index 013f7163691..00000000000 Binary files a/memdocs/intune/apps/media/securing-data-edge-for-business/securing-data-edge-for-business51.png and /dev/null differ diff --git a/memdocs/intune/apps/media/securing-data-edge-for-business/securing-data-edge-for-business61.png b/memdocs/intune/apps/media/securing-data-edge-for-business/securing-data-edge-for-business61.png deleted file mode 100644 index dcaed11a0ff..00000000000 Binary files a/memdocs/intune/apps/media/securing-data-edge-for-business/securing-data-edge-for-business61.png and /dev/null differ diff --git a/memdocs/intune/apps/media/securing-data-edge-for-business/securing-data-edge-for-business62.png b/memdocs/intune/apps/media/securing-data-edge-for-business/securing-data-edge-for-business62.png deleted file mode 100644 index 370ea76fc4c..00000000000 Binary files a/memdocs/intune/apps/media/securing-data-edge-for-business/securing-data-edge-for-business62.png and /dev/null differ diff --git a/memdocs/intune/apps/media/windows-store-for-business/microsoft-store-for-business-02.png b/memdocs/intune/apps/media/windows-store-for-business/microsoft-store-for-business-02.png deleted file mode 100644 index de663a64dd8..00000000000 Binary files a/memdocs/intune/apps/media/windows-store-for-business/microsoft-store-for-business-02.png and /dev/null differ diff --git a/memdocs/intune/apps/media/windows-store-for-business/microsoft-store-for-business-03.png b/memdocs/intune/apps/media/windows-store-for-business/microsoft-store-for-business-03.png deleted file mode 100644 index c1d804c3822..00000000000 Binary files a/memdocs/intune/apps/media/windows-store-for-business/microsoft-store-for-business-03.png and /dev/null differ diff --git a/memdocs/intune/apps/media/windows-store-for-business/microsoft-store-for-business-04.png b/memdocs/intune/apps/media/windows-store-for-business/microsoft-store-for-business-04.png deleted file mode 100644 index 3f536833f0e..00000000000 Binary files a/memdocs/intune/apps/media/windows-store-for-business/microsoft-store-for-business-04.png and /dev/null differ diff --git a/memdocs/intune/apps/protect-mam-windows.md b/memdocs/intune/apps/protect-mam-windows.md index 3e383215f38..667771bb9c6 100644 --- a/memdocs/intune/apps/protect-mam-windows.md +++ b/memdocs/intune/apps/protect-mam-windows.md @@ -8,7 +8,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 11/30/2023 +ms.date: 08/28/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: apps @@ -48,6 +48,9 @@ You can enable protected Mobile Application Management (MAM) access to org data > > For more information about MAM, see [Mobile Application Management (MAM) basics](../apps/app-management.md#mobile-application-management-mam-basics). +> [!NOTE] +> The Mobile Threat Defense (MTD) Connector for the Windows Security Center (WSC) component is only supported on Windows 11 version 22631 (23H2) or later. + Both end-users and organizations need to have protected organizational access from personal devices. Organizations need to ensure that corporate data is protected on personal, unmanaged devices. As an Intune admin, you have the responsibility to determine how members (end-users) of your organization access corporate resources in a protected way from an unmanaged device. You need to ensure when accessing organizational data, that the unmanaged devices are healthy, the applications adhere to your organization data's protection policies, and that the end-user’s unmanaged assets on their device aren't impacted by your organization's policies. As the Intune admin, you need to have the following app management functionality: diff --git a/memdocs/intune/apps/store-apps-company-portal-app.md b/memdocs/intune/apps/store-apps-company-portal-app.md index fb1047ad653..495885a8a28 100644 --- a/memdocs/intune/apps/store-apps-company-portal-app.md +++ b/memdocs/intune/apps/store-apps-company-portal-app.md @@ -8,7 +8,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 02/27/2024 +ms.date: 08/27/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: apps @@ -32,98 +32,45 @@ ms.collection: - highpri --- -# Add the Windows 10 Company Portal app by using Microsoft Intune +# Add the Windows Company Portal app by using Microsoft Intune [!INCLUDE [azure_portal](../includes/azure_portal.md)] -To manage devices and install apps, your users can install the Company Portal app themselves from the Microsoft Store or download it from the [Microsoft Intune Company Portal for Windows](../apps/store-apps-company-portal-app.md#download-the-offline-company-portal-app). If your business needs require that you assign the Company Portal app to them, however, you can assign the Windows 10 Company Portal app directly from Intune. You can do so even if you haven't integrated Intune with the Microsoft Store for Business. +To manage devices and install apps, your users can install the Company Portal app themselves from the Microsoft Store or download it from the [Microsoft Intune Company Portal for Windows](../apps/store-apps-company-portal-app.md#download-the-offline-company-portal-app). If your business needs require that you assign the Company Portal app to them, however, you can assign the Company Portal app for Windows directly from Intune. > [!IMPORTANT] - > If you download the Company Portal app, the option described in this article requires that you assign manual updates each time an app update is released. To deploy the Company Portal app for Windows 10 Autopilot provisioned devices, see [Add Windows 10 Company Portal app Autopilot devices](store-apps-company-portal-autopilot.md). + > To deploy the Company Portal app for Autopilot provisioned devices, see [Add Company Portal app for Autopilot devices](store-apps-company-portal-autopilot.md). > [!NOTE] > The Company Portal supports Configuration Manager applications. This feature allows end users to see both Configuration Manager and Intune deployed applications in the Company Portal for co-managed customers. This new version of the Company Portal will display Configuration Manager deployed apps for all co-managed customers. This support will help administrators consolidate their different end user portal experiences. For more information, see [Use the Company Portal app on co-managed devices](../../configmgr/comanage/company-portal.md). -## Configure settings to show offline apps - -1. Sign in to the [Microsoft Store for Business](https://www.microsoft.com/business-store) with your admin account. Ensure that you sign into the Microsoft Store for Business using the same tenant account you use to sign into Intune. Your Microsoft Store for Business account must be associated with Intune. For more information, see [Associate your Microsoft Store for Business account with Intune](../apps/windows-store-for-business.md#associate-your-microsoft-store-for-business-account-with-intune). -2. Select the **Manage** tab near the top of the window. -3. In the left pane, select **Settings**. -4. Select the **Shop** tab. Then,under **Shopping experience**, set **Show offline apps** to **On**. - ## Download the offline Company Portal app -1. Search for and then select the **Company Portal** app. -2. Set the **License type** to **Offline**. Offline apps are managed by Intune, whereas online apps are managed by the store. Use offline apps when you need to install and maintain a specific app version. -3. Select **Get the app** to acquire and add the offline Company Portal app to your inventory. If you already have the offline app, you can select the **Manage** option. -4. For **Platform**, select **Windows 10 all devices**, and then select the appropriate **Minimum version**, **Architecture**, and **Download app metadata** values. -5. Select **Download** to save the file to your local machine. - - ![Windows 10 devices, where architecture equals X86, is selected](./media/app-sideload-windows/Win10CP-all-devices.png) - -6. Download all the packages under "Required Frameworks" by selecting **Download**. - - This action must be completed for x86, x64, and ARM architectures:
- *There are 9 Required Framework Packages when selecting 1507 as the minimum OS Version, 12 packages when selecting 1511, and 15 packages when selecting 1607.* - -7. In Microsoft Intune in the portal, upload the Company Portal app as a new app. You add the application by selecting Line-of-business app as the **App type** in the **Select app type** pane. You then select the app package file (extension .AppxBundle). - -8. Under **Select dependency app files** select all the dependencies you downloaded in step 7 by using shift-click, and verify that the **Added** column displays **Yes** for the architectures you need. +1. Use the [Windows Package Manager](/windows/package-manager/winget) command-line tool, also known as *Winget.exe*, to download the Company Portal app for Windows with dependencies. Files are downloaded to the Downloads folder on your device by default. + +1. In the Microsoft Intune admin center, upload the Company Portal app as a new app. + 1. Go to **Apps** > **By platform** and select **Windows**. + 1. Select **Add**. + 1. For **App type**, choose **Other** > **Line-of-business app**. + 1. Choose **Select** to continue. + 1. On the **App information** page, choose **Select app package file**. + 1. In the new pane, select the **File** upload button, and then upload the app package file. The file you want to select has the app package (.appxbundle) extension. +1. Detected dependencies appear. Under **Select dependency app files**, select all dependencies you downloaded in step 1. + + 1. **Shift + click** to select all dependencies. + + 1. Under the **Added** column, verify that **Yes** appears for the architectures you need. > [!NOTE] - > If the dependencies are not added, the app might not install on the specified device types. - -9. Click **Ok**, enter any desired **App Information**, and click **Add**. + > If you don't add the dependencies, installation could fail for the selected device types. -10. Assign the Company Portal app as a required app to your selected set of user or device groups. +1. Select **Ok**. +1. Under **App information**, enter any information about the app. +1. Select **Add**. +1. Assign the Company Portal app as a required app to selected users or device groups. For more information about how Intune handles dependencies for Universal apps, see [Deploying an appxbundle with dependencies via Microsoft Intune MDM](/archive/blogs/configmgrdogs/deploying-an-appxbundle-with-dependencies-via-microsoft-intune-mdm). -## Frequently asked questions - - > [!NOTE] - > Microsoft Intune will be ending support on October 21, 2022 for devices running Windows 8.1. Intune will no longer support Windows 8.1 sideloading. - -### How do I update the Company Portal app on my users' devices if they have already installed the older apps from the store? - -If your users have already installed the Windows 8.1 Company Portal apps from the Microsoft Store, their apps should be automatically updated to the latest version with no action required from you or your users. If the update does not happen, ask your users to confirm that they have enabled auto-updates for Store apps on their devices. - -### How do I upgrade my sideloaded Windows 8.1 Company Portal app to the Windows 10 Company Portal app? - -Our recommended migration path is to delete the assignment for the Windows 8.1 Company Portal app by setting the assignment action to **Uninstall**. After you select this setting, you can assign the Windows 10 Company Portal app by using any of the previously discussed options. - -If you need to sideload the app and you assigned the Windows 8.1 Company Portal without signing it with the Symantec Certificate, complete the upgrade by completing the steps in the preceding sections of this article. - -If you need to sideload the app and you signed and assigned the Windows 8.1 Company Portal app with the Symantec code-signing certificate, follow the steps in the next section. - -### How do I upgrade my signed and sideloaded Windows 8.1 Company Portal app to the Windows 10 Company Portal app? - -Our recommended migration path is to delete the existing assignment for the Windows 8.1 Company Portal app by setting the assignment action to **Uninstall**. After you select this setting, you can assign the Windows 10 Company Portal app normally. - -Otherwise, the Windows 10 Company Portal app must be appropriately updated and signed to ensure that the upgrade path is respected. - -If you sign and assign the Windows 10 Company Portal app in this way, you will need to repeat this process for each new app update when it is available in the store. The app is not automatically updated when the store is updated. - -Here's how you sign and assign the app in this way: - -1. Download the [Microsoft Intune Windows 10 Company Portal App Signing Script](https://aka.ms/intunecpscript). - This script requires the Windows SDK for Windows 10 to be installed on the host computer. [Download the Windows SDK for Windows 10](https://go.microsoft.com/fwlink/?linkid=162443). -2. Download the Windows 10 Company Portal app from the Microsoft Store for Business, as discussed previously. -3. To sign the Windows 10 Company Portal app, run the script with the input parameters detailed in the script header, as shown in the following table. - Dependencies do not need to be passed into the script. They are required only when the app is being uploaded to the Microsoft Intune admin center. - -| Parameter | Description | -|---|---| -| InputWin10AppxBundle | The path to the source appxbundle file. | -| OutputWin10AppxBundle | The output path for the signed appxbundle file. -| Win81Appx | The path to the Windows 8.1 Company Portal (.APPX) file. | -| PfxFilePath | The path to the Symantec Enterprise Mobile Code Signing Certificate (.PFX) file. | -| PfxPassword | The password of the Symantec Enterprise Mobile Code Signing Certificate. | -| PublisherId | The Publisher ID of the enterprise. If it is absent, the Subject field of the Symantec Enterprise Mobile Code Signing Certificate is used. | -| SdkPath | The path to the root folder of the Windows SDK for Windows 10. This argument is optional and defaults to ${env:ProgramFiles(x86)}\Windows Kits\10. | - -When the script has finished running, it outputs the signed version of the Windows 10 Company Portal app. You can then assign the signed version of the app as a line-of-business (LOB) app via Intune, which upgrades the currently assigned versions to this new app. - ## Next steps - [Assign apps to groups](apps-deploy.md) diff --git a/memdocs/intune/apps/store-apps-microsoft.md b/memdocs/intune/apps/store-apps-microsoft.md index d61a1b79097..1179b58d2e3 100644 --- a/memdocs/intune/apps/store-apps-microsoft.md +++ b/memdocs/intune/apps/store-apps-microsoft.md @@ -93,7 +93,6 @@ The Microsoft Store provides a large variety of apps designed to work on your Mi > - The app is not available if there is an age restriction. > - The app is a paid app, which is not supported. > - The app is an Android app. - > - The app is a Microsoft Store for Business app that is not available publicly in the consumer store. 3. Choose the app that you want to deploy and choose **Select**. diff --git a/memdocs/intune/configuration/administrative-templates-restrict-usb.md b/memdocs/intune/configuration/administrative-templates-restrict-usb.md index 49376fb5acf..b30958ee843 100644 --- a/memdocs/intune/configuration/administrative-templates-restrict-usb.md +++ b/memdocs/intune/configuration/administrative-templates-restrict-usb.md @@ -38,7 +38,7 @@ This article shows you: - How to create an ADMX policy with USB settings in the Intune admin center - How to use a log file to troubleshoot devices that shouldn't be blocked -Applies to: +This article applies to: - Windows 11 - Windows 10 diff --git a/memdocs/intune/configuration/administrative-templates-update-office.md b/memdocs/intune/configuration/administrative-templates-update-office.md index cd52028a984..e66ccddb34b 100644 --- a/memdocs/intune/configuration/administrative-templates-update-office.md +++ b/memdocs/intune/configuration/administrative-templates-update-office.md @@ -7,7 +7,7 @@ keywords: author: MandiOhlinger ms.author: mandia manager: dougeby -ms.date: 11/06/2023 +ms.date: 08/20/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: configuration @@ -29,13 +29,13 @@ ms.collection: # Use Update Channel and Target Version settings to update Microsoft 365 with Microsoft Intune Administrative Templates -In Intune, you can use [Windows ADMX templates to configure group policy settings](administrative-templates-windows.md). This article shows you how to update Microsoft 365 using an administrative template in Intune. It also gives guidance on confirming your policies apply successfully. This information also helps when troubleshooting. +In Intune, you can use [Windows administrative (ADMX) templates to configure group policy settings](administrative-templates-windows.md). This article shows you how to update Microsoft 365 using an administrative template in Intune. It also gives guidance on confirming your policies apply successfully, which helps when troubleshooting. In this scenario, you create an administrative template in Intune that updates Microsoft 365 on your devices. For more information on administrative templates, go to [Windows ADMX templates to configure group policy settings](administrative-templates-windows.md). -Applies to: +This feature applies to: - Windows 11 - Windows 10 @@ -43,27 +43,34 @@ Applies to: ## Prerequisites -Be sure to [enable Microsoft 365 Apps Automatic Updates](/deployoffice/configure-update-settings-for-office-365-proplus) for your Office apps. You can do this using group policy, or the Intune Office 2016 ADMX template: +- Requires Microsoft Intune and a Microsoft 365 subscription. For information on Intune licensing, go to [Microsoft Intune licensing](../fundamentals/licenses.md). -:::image type="content" source="./media/administrative-templates-update-office/admx-enable-automatic-updates.png" alt-text="Screenshot that shows enabling Office automatic updates using an administrative template in Microsoft Intune."::: +- To configure the ADMX policy, at a minimum, sign into the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) with the **Policy and Profile manager** role. For information on the built-in roles in Intune, and what they can do, go to [Role-based access control (RBAC) with Microsoft Intune](../fundamentals/role-based-access-control.md). + +- [Enable Microsoft 365 Apps Automatic Updates](/deployoffice/configure-update-settings-for-office-365-proplus) for your Office apps. You can enable automatic updates using group policy, or the Intune Office 2016 ADMX template: + +:::image type="content" source="./media/administrative-templates-update-office/admx-enable-automatic-updates.png" alt-text="Screenshot that shows enabling Office automatic updates using an administrative template in Microsoft Intune." lightbox="./media/administrative-templates-update-office/admx-enable-automatic-updates.png"::: ## Set the Update Channel in the Intune administrative template -1. In your [Intune administrative template](administrative-templates-windows.md#create-the-template), go to the **Update Channel** setting, and enter the channel you want. For example, choose `Semi-Annual Channel`: +Use an Intune policy to set the update channel for Microsoft 365 apps. The update channel determines how frequently Office checks for updates. + +1. In your [Intune administrative template](administrative-templates-windows.md#create-the-template), go to the **Update Channel (2.0)** setting, and enter the channel you want. For example, select `Semi-Annual Enterprise Channel`: - :::image type="content" source="./media/administrative-templates-update-office/admx-enable-update-channel-setting.png" alt-text="In Microsoft Intune and Intune admin center, create an administrative ADMX template that sets the Update Channel setting for Office."::: + :::image type="content" source="./media/administrative-templates-update-office/admx-enable-update-channel-setting.png" alt-text="In Microsoft Intune and Intune admin center, create an administrative ADMX template that sets the Update Channel setting for Office." lightbox="./media/administrative-templates-update-office/admx-enable-update-channel-setting.png"::: - > [!NOTE] - > It's recommended to update more frequently. Semi-annually is only used as an example. + > [!TIP] + > - It's recommended to update more frequently. Semi-annually is only used as an example. + > - For information on the different update channels, go to [Overview of update channels for Microsoft 365 Apps](/microsoft-365-apps/updates/overview-update-channels). -2. Be sure to [assign the policy](device-profile-assign.md) to your Windows client devices. To test your policy sooner, you can also sync the policy: +2. When the policy is ready, [assign the policy](device-profile-assign.md) to your Windows client devices. To test your policy sooner, you can also sync the policy. - [Sync the policy in Intune](../remote-actions/device-sync.md) - [Manually sync the policy on the device](../user-help/sync-your-device-manually-windows.md#sync-from-settings-app-windows-10-or-later) ## Check the Intune registry keys -After you assign the policy and the device syncs, you can confirm the policy is applied: +After you assign the policy and the device syncs, you can confirm the Intune policy is applied. 1. On the device, open the **Registry Editor** app. 2. Go to the Intune policy path: `Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\Providers\\default\Device\office16~Policy~L_MicrosoftOfficemachine~L_Updates`. @@ -76,18 +83,19 @@ After you assign the policy and the device syncs, you can confirm the policy is - `L_UpdateBranch` - `L_UpdateTargetVersion` - Looking at the following example, you see `L_UpdateBranch` has a value similar to ``. This value means it's set to Semi-Annual Channel: + Looking at the following example, you see `L_UpdateBranch` has a value similar to ``. This value means the update channel is set to Semi-Annual Enterprise Channel: - :::image type="content" source="./media/administrative-templates-update-office/admx-update-branch-registry-key.png" alt-text="Administrative template L_Updatebranch registry key example for Microsoft Office"::: + :::image type="content" source="./media/administrative-templates-update-office/admx-update-branch-registry-key.png" alt-text="Administrative template L_Updatebranch registry key example for Microsoft Office" lightbox="./media/administrative-templates-update-office/admx-update-branch-registry-key.png"::: > [!TIP] > [Manage Microsoft 365 Apps with Configuration Manager](../../configmgr/sum/deploy-use/manage-office-365-proplus-updates.md#bkmk_channel) lists the values, and what they mean. The registry values are based on the distribution channel selected: > - >- Monthly Channel - value="Current" - >- Monthly Channel (Targeted) - value="Current" - >- Semi-Annual Channel - value="Current" - >- Semi-Annual Channel (Targeted) - value="FirstReleaseDeferred" - >- Insider Fast - value="InsiderFast" + >- Current Channel - value="Current" + >- Current Channel (preview) - value="FirstReleaseCurrent" + >- Monthly Enterprise Channel - value="MonthlyEnterprise" + >- Semi-Annual Enterprise Channel - value="Deferred" + >- Semi-Annual Enterprise Channel (preview) - value="FirstReleaseDeferred" + >- Beta - value="InsiderFast" At this point, the Intune policy is successfully applied to the device. @@ -105,9 +113,9 @@ At this point, the Intune policy is successfully applied to the device. Looking at the following example, you see `UpdateChannel` is set to `http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60`, which is the **Current Channel** (monthly): - :::image type="content" source="./media/administrative-templates-update-office/admx-update-channel-office-registry-key.png" alt-text="Administrative template Office UpdateChannel registry key example"::: + :::image type="content" source="./media/administrative-templates-update-office/admx-update-channel-office-registry-key.png" alt-text="Administrative template Office UpdateChannel registry key example" lightbox="./media/administrative-templates-update-office/admx-update-channel-office-registry-key.png"::: - This example means the policy isn't applied yet, as it's still set to **monthly**, instead of **semi-annual**. + This example means the policy isn't applied yet, as the registry setting is still set to **monthly**, instead of **semi-annual**. This registry key is updated when the **Task Scheduler** > **Office Automatic Updates 2.0** runs, or when a user signs into the device. To confirm, open the **Office Automatic Updates 2.0** task > **Triggers**. Depending on your triggers, it can take at least a day and more before the `UpdateChannel` registry key is updated. @@ -118,7 +126,7 @@ To test your policy, you can force the policy settings on the device. The follow 1. Clear the registry key: 1. Go to `Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Updates`. - 2. Double-select the `UpdateDetectionLastRunTime` key, delete the value data > **OK**. + 2. Double-select the `UpdateDetectionLastRunTime` key > delete the value data > **OK**. 2. Run the Office Automatic Updates task: @@ -126,7 +134,7 @@ To test your policy, you can force the policy settings on the device. The follow 2. Expand **Task Scheduler Library** > **Microsoft** > **Office**. 3. Select **Office Automatic Updates 2.0** > **Run**: - :::image type="content" source="./media/administrative-templates-update-office/admx-task-scheduler-office-automatic-updates.png" alt-text="Open Task Schedule, and run Office Automatic Updates using the task scheduler."::: + :::image type="content" source="./media/administrative-templates-update-office/admx-task-scheduler-office-automatic-updates.png" alt-text="Open Task Schedule, and run Office Automatic Updates using the task scheduler." lightbox="./media/administrative-templates-update-office/admx-task-scheduler-office-automatic-updates.png"::: Wait for the task to finish, which can take several minutes. @@ -148,7 +156,7 @@ If you want to do more, you can force Office to get the latest version update. T Your **Target version** setting looks similar to the following setting: - :::image type="content" source="./media/administrative-templates-update-office/admx-enable-target-version-setting.png" alt-text="In a Microsoft Intune ADMX administrative template, set the Target Version setting for Office."::: + :::image type="content" source="./media/administrative-templates-update-office/admx-enable-target-version-setting.png" alt-text="In a Microsoft Intune ADMX administrative template, set the Target Version setting for Office." lightbox="./media/administrative-templates-update-office/admx-enable-target-version-setting.png"::: > [!IMPORTANT] > @@ -166,21 +174,19 @@ Consider using the following steps to test your policy before deploying the poli At this point, the Intune policy is successfully applied to the device. -3. Next, you can force Office to update. Open an Office app, such as Excel. Choose to update now (possibly in the **Account** menu). +3. Next, you can force Office to update. Open an Office app, such as Excel. Select to update now (possibly in the **Account** menu). The update takes several minutes. You can confirm Office is trying to get the version you enter: 1. On the device, go to `C:\Program Files (x86)\Microsoft Office\Updates\Detection\Version`. 2. Open the `VersionDescriptor.xml` file, and go to the `` section. The available version should be the same version you entered in the Intune policy, such as: - :::image type="content" source="./media/administrative-templates-update-office/office-version-descriptor-xml-example.png" alt-text="Check the version section in the version descriptor Office XML file."::: + :::image type="content" source="./media/administrative-templates-update-office/office-version-descriptor-xml-example.png" alt-text="Check the version section in the version descriptor Office XML file." lightbox="./media/administrative-templates-update-office/office-version-descriptor-xml-example.png"::: 4. After the update is installed, the Office app should show the new version (for example, on the **Account** menu) -## Next steps - -[Update channel values for Microsoft 365 clients](../../configmgr/sum/deploy-use/manage-office-365-proplus-updates.md#bkmk_channel) - -[Overview of the Office cloud policy service for Microsoft 365 Apps](/deployoffice/overview-office-cloud-policy-service) +## Related articles -[Use Windows 10/11 templates to configure group policy settings (ADMX templates) in Microsoft Intune](administrative-templates-windows.md) +- [Update channel values for Microsoft 365 clients](../../configmgr/sum/deploy-use/manage-office-365-proplus-updates.md#bkmk_channel) +- [Overview of Cloud Policy service for Microsoft 365](/microsoft-365-apps/admin-center/overview-cloud-policy) +- [Use Windows 10/11 templates to configure group policy settings (ADMX templates) in Microsoft Intune](administrative-templates-windows.md) diff --git a/memdocs/intune/configuration/bios-configuration.md b/memdocs/intune/configuration/bios-configuration.md index f1bd16eb127..eb5598e0c3a 100644 --- a/memdocs/intune/configuration/bios-configuration.md +++ b/memdocs/intune/configuration/bios-configuration.md @@ -40,7 +40,8 @@ For example, you want to prevent end users from reimaging the device and getting This feature applies to: -- Windows 10 and later +- Windows 11 +- Windows 10 - Dell devices This article includes more information on the configuration file and Win32 app, and shows you how to create the **BIOS configuration and other settings** policy in Intune. diff --git a/memdocs/intune/configuration/custom-profile-hololens.md b/memdocs/intune/configuration/custom-profile-hololens.md index 8993ecdd5f0..6f607a0ad19 100644 --- a/memdocs/intune/configuration/custom-profile-hololens.md +++ b/memdocs/intune/configuration/custom-profile-hololens.md @@ -36,6 +36,7 @@ Using Windows PowerShell and Microsoft Intune, you can use the WDAC CSP to allow This feature applies to: - HoloLens 2 devices running Windows Holographic for Business +- Windows 10/11 The WDAC CSP is based on the [Windows Defender Application Control (WDAC) feature](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control). You can also [use multiple WDAC policies](/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies). @@ -186,7 +187,7 @@ This example uses Windows PowerShell to create a Windows Defender Application Co In this step, you create a custom device configuration profile in Intune. In the custom policy, you add the **compiledPolicy.bin** binary file you created in [Step 1 - Create the WDAC policy using Windows PowerShell](#step-1---create-the-wdac-policy-using-windows-powershell). Then, use Intune to deploy the policy to HoloLens 2 devices. -1. In the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), create a Windows 10/11 custom device configuration profile. +1. In the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), create a Windows custom device configuration profile. For the specific steps, go to [Create a custom profile using OMA-URI in Intune](custom-settings-configure.md). diff --git a/memdocs/intune/configuration/custom-settings-windows-10.md b/memdocs/intune/configuration/custom-settings-windows-10.md index 09c7c521a4d..c5a4b91c317 100644 --- a/memdocs/intune/configuration/custom-settings-windows-10.md +++ b/memdocs/intune/configuration/custom-settings-windows-10.md @@ -28,7 +28,7 @@ ms.collection: - highpri --- -# Use custom settings for Windows 10/11 client devices in Intune +# Use custom settings for Windows client devices in Intune > [!NOTE] > [!INCLUDE [not-all-settings-are-documented](../includes/not-all-settings-are-documented.md)] @@ -48,11 +48,11 @@ Windows client custom profiles use Open Mobile Alliance Uniform Resource Identif Windows client makes many Configuration Service Provider (CSP) settings available, such as [Policy Configuration Service Provider (Policy CSP)](/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers). -If you're looking for a specific setting, the [Windows 10/11 device restriction profile](device-restrictions-windows-10.md) and the [Settings catalog](settings-catalog.md) include many built-in settings. So, you may not need to enter custom values. +If you're looking for a specific setting, the [Windows device restriction profile](device-restrictions-windows-10.md) and the [Settings catalog](settings-catalog.md) include many built-in settings. So, you may not need to enter custom values. ## Before you begin -[Create a Windows 10/11 custom profile](custom-settings-configure.md#create-the-profile). +- [Create a Windows custom profile](custom-settings-configure.md#create-the-profile). ## OMA-URI settings diff --git a/memdocs/intune/configuration/custom-settings-windows-holographic.md b/memdocs/intune/configuration/custom-settings-windows-holographic.md index 0c1092ae599..d325281972f 100644 --- a/memdocs/intune/configuration/custom-settings-windows-holographic.md +++ b/memdocs/intune/configuration/custom-settings-windows-holographic.md @@ -31,6 +31,11 @@ ms.collection: Using Microsoft Intune, you can add or create custom settings for your Windows Holographic for Business devices using **custom profiles**. Custom profiles are a feature in Intune. They're designed to add device settings and features that aren't built in to Intune. +This article applies to: + +- Windows Holographic for Business +- Windows 10/11 + Windows Holographic for Business custom profiles use Open Mobile Alliance Uniform Resource Identifier (OMA-URI) settings to configure different features. These settings are typically used by mobile device manufacturers to control features on the device. Windows Holographic for Business makes many configuration service providers (CSPs) settings available. For a CSP overview, go to [Introduction to configuration service providers (CSPs) for IT pros](/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers). For specific CSPs supported by Windows Holographic, go to [CSPs supported in Windows Holographic](/windows/client-management/mdm/configuration-service-provider-reference#hololens). @@ -41,7 +46,7 @@ This article shows you how to create a custom profile for Windows Holographic fo ## Before you begin -- [Create a Windows 10/11 custom profile](custom-settings-configure.md#create-the-profile). +- [Create a Windows custom profile](custom-settings-configure.md#create-the-profile). ## Custom OMA-URI Settings @@ -167,8 +172,8 @@ Also, Intune doesn't support all of the settings listed in [CSPs supported in Wi ## Related articles -- [Assign the profile](device-profile-assign.md), and [monitor its status](device-profile-monitor.md). +- [Assign the profile](device-profile-assign.md) and [monitor its status](device-profile-monitor.md). -- Create a [custom profile on Windows 10/11 devices](custom-settings-windows-10.md). +- Create a [custom profile on Windows devices](custom-settings-windows-10.md). - Learn more about [custom profiles](custom-settings-configure.md) in Intune. diff --git a/memdocs/intune/configuration/delivery-optimization-settings.md b/memdocs/intune/configuration/delivery-optimization-settings.md index ded1a8e9159..72b875fcd94 100644 --- a/memdocs/intune/configuration/delivery-optimization-settings.md +++ b/memdocs/intune/configuration/delivery-optimization-settings.md @@ -1,9 +1,9 @@ --- # required metadata -title: Windows 10 Delivery Optimization settings for Intune +title: Windows 10/11 Delivery Optimization settings for Intune titleSuffix: Microsoft Intune -description: Delivery Optimization settings for Windows 10 devices that you can deploy using Intune. +description: Delivery Optimization settings for Windows 10/11 devices that you can deploy using Intune. keywords: author: brenduns ms.author: brenduns @@ -31,7 +31,7 @@ ms.collection: # Delivery Optimization settings for Windows devices in Intune -Applies to: +This feature applies to: - Windows 10 - Windows 11 @@ -39,7 +39,7 @@ Applies to: > [!NOTE] > [!INCLUDE [not-all-settings-are-documented](../includes/not-all-settings-are-documented.md)] -This article lists some of the settings for Delivery Optimization that Intune supports for devices that run Windows 10 or later. +This article lists some of the settings for Delivery Optimization that Intune supports for devices that run Windows. Most options in the Microsoft Intune admin center directly map to Delivery Optimization settings that are covered in-depth in the Windows documentation. These options include links to relevant content. Settings or options that are specific to Intune don't contain links to additional content. @@ -55,7 +55,7 @@ To configure Intune to use these settings, see [Deliver updates](delivery-optimi ## Before you begin -[Create a Windows Delivery Optimization profile](delivery-optimization-windows.md). +- [Create a Windows Delivery Optimization profile](delivery-optimization-windows.md). ## Delivery Optimization diff --git a/memdocs/intune/configuration/delivery-optimization-windows.md b/memdocs/intune/configuration/delivery-optimization-windows.md index 84b427801d1..bcd9a318280 100644 --- a/memdocs/intune/configuration/delivery-optimization-windows.md +++ b/memdocs/intune/configuration/delivery-optimization-windows.md @@ -33,7 +33,7 @@ With Intune, you can use Delivery Optimization settings for your Windows devices - View the list of the [Delivery Optimization settings](delivery-optimization-settings.md) that Intune supports. - Learn about [Delivery Optimization updates](/windows/deployment/update/waas-delivery-optimization) in the Windows documentation. -Applies to: +This feature applies to: - Windows 10 - Windows 11 diff --git a/memdocs/intune/configuration/device-firmware-configuration-interface-windows-settings.md b/memdocs/intune/configuration/device-firmware-configuration-interface-windows-settings.md index ead2c5bb41f..d6200aefdff 100644 --- a/memdocs/intune/configuration/device-firmware-configuration-interface-windows-settings.md +++ b/memdocs/intune/configuration/device-firmware-configuration-interface-windows-settings.md @@ -41,7 +41,7 @@ These settings are added to a device configuration profile in Intune, and then a ## Before you begin -- [Create the Windows 10/11 DFCI profile](device-firmware-configuration-interface-windows.md). There are more requirements to creating DFCI profiles. For more specific information, go to [Use DFCI profiles on Windows devices in Microsoft Intune](device-firmware-configuration-interface-windows.md). +- [Create the Windows DFCI profile](device-firmware-configuration-interface-windows.md). There are more requirements to creating DFCI profiles. For more specific information, go to [Use DFCI profiles on Windows devices in Microsoft Intune](device-firmware-configuration-interface-windows.md). - Some settings aren't available for all devices. To confirm if a setting is or isn't available on your device, contact your device manufacturer. - These settings use the [UEFI CSP](/windows/client-management/mdm/uefi-csp). diff --git a/memdocs/intune/configuration/device-firmware-configuration-interface-windows.md b/memdocs/intune/configuration/device-firmware-configuration-interface-windows.md index 1ca5645627e..0d87a85febc 100644 --- a/memdocs/intune/configuration/device-firmware-configuration-interface-windows.md +++ b/memdocs/intune/configuration/device-firmware-configuration-interface-windows.md @@ -99,7 +99,7 @@ This profile includes the DFCI settings you configure. 2. Select **Devices** > **Manage devices** > **Configuration** > **Create** > **New policy**. 3. Enter the following properties: - - **Platform**: Choose **Windows 10 and later**. + - **Platform**: Select **Windows 10 and later**. - **Profile type**: Select **Templates** > **Device Firmware Configuration Interface**. 4. Select **Create**. diff --git a/memdocs/intune/configuration/device-profile-assign.md b/memdocs/intune/configuration/device-profile-assign.md index 5f892cd50d9..84a8e9d7e68 100644 --- a/memdocs/intune/configuration/device-profile-assign.md +++ b/memdocs/intune/configuration/device-profile-assign.md @@ -46,6 +46,14 @@ In Intune, you can create and assign the following policies: This article shows you how to assign a policy, includes some information on using scope tags, describes when to assign policies to user groups or device groups, and more. +This feature applies to: + +- Android +- iOS/iPadOS +- macOS +- Linux +- Windows + ## Before you begin - Be sure you have the correct role that can assign policies and profiles. For more information, go to [Role-based access control (RBAC) with Microsoft Intune](../fundamentals/role-based-access-control.md). @@ -69,13 +77,13 @@ This article shows you how to assign a policy, includes some information on usin :::image type="content" source="./media/device-profile-assign/properties-select-assignments.png" alt-text="Screenshot that shows how to select assignments to deploy the profile to users and groups in Microsoft Intune."::: -3. Under **Included groups** or **Excluded groups**, choose **Add groups** to select one or more Microsoft Entra groups. If you intend to deploy the policy broadly to all applicable devices, select **Add all users** or **Add all devices**. +4. Under **Included groups** or **Excluded groups**, choose **Add groups** to select one or more Microsoft Entra groups. If you intend to deploy the policy broadly to all applicable devices, select **Add all users** or **Add all devices**. > [!NOTE] > If you select "All Devices" and "All Users", the option to add additional Microsoft Entra groups disables. -4. Select **Review + Save**. This step doesn't assign your policy. -5. Select **Save**. When you save, your policy is assigned. Your groups will receive your policy settings when the devices check in with the Intune service. +5. Select **Review + Save**. This step doesn't assign your policy. +6. Select **Save**. When you save, your policy is assigned. Your groups will receive your policy settings when the devices check in with the Intune service. ## Assignment features you should know and use @@ -98,7 +106,7 @@ This article shows you how to assign a policy, includes some information on usin - **[Scope tags](../fundamentals/scope-tags.md)** are a great way to filter policies to specific groups, such as `US-NC IT Team` or `JohnGlenn_ITDepartment`. For more information, go to [Use RBAC and scope tags for distributed IT](../fundamentals/scope-tags.md). -- On Windows 10/11 devices, you can add **[applicability rules](device-profile-create.md#applicability-rules)** so the policy only applies to a specific OS version or a specific Windows edition. For more information, go to [Applicability rules](device-profile-create.md#applicability-rules). +- On Windows devices, you can add **[applicability rules](device-profile-create.md#applicability-rules)** so the policy only applies to a specific OS version or a specific Windows edition. For more information, go to [Applicability rules](device-profile-create.md#applicability-rules). ## User groups vs. device groups @@ -196,7 +204,7 @@ When you assign your policies and policies, apply the following general principl Use the following matrix to understand support for excluding groups: -- ✔️: Supported +- ✅: Supported - ❌: Not supported - ❕ : Partially supported @@ -205,22 +213,22 @@ Use the following matrix to understand support for excluding groups: | Scenario | Support| | --- | --- | | 1 | ❕ Partially supported

Assigning policies to a dynamic device group while excluding another dynamic device group is supported. But, it's not recommended in scenarios that are sensitive to latency. Any delay in exclude group membership calculation can cause policies to be offered to devices. In this scenario, we recommend using [filters](../fundamentals/filters.md) instead of dynamic device groups for excluding devices.

For example, you have a device policy that's assigned to **All devices**. Later, you have a requirement that new marketing devices don't receive this policy. So, you create a dynamic device group called **Marketing devices** based on the `enrollmentProfilename` property (`device.enrollmentProfileName -eq "Marketing_devices"`). In the policy, you add the **Marketing devices** dynamic group as an excluded group.

A new marketing device enrolls in Intune for the first time, and a new Microsoft Entra device object is created. The dynamic grouping process puts the device into the **Marketing devices** group with a possible delayed calculation. At the same time, the device enrolls into Intune, and starts receiving all applicable policies. The Intune policy can be deployed before the device is put in the exclusion group. This behavior results in an unwanted policy (or app) being deployed to the **Marketing devices** group.

As a result, it's not recommended to use dynamic device groups for exclusions in latency sensitive scenarios. Instead, use [filters](../fundamentals/filters.md). | -| 2 | ✔️ Supported

Assigning a policy to a dynamic device group while excluding a static device group is supported. | +| 2 | ✅ Supported

Assigning a policy to a dynamic device group while excluding a static device group is supported. | | 3 | ❌ Not supported

Assigning a policy to a dynamic device group while excluding user groups (both dynamic and static) isn't supported. Intune doesn't evaluate user-to-device group relationships, and devices of the included users aren't excluded. | | 4 | ❌ Not supported

Assigning a policy to a dynamic device group and excluding user groups (both dynamic and static) isn't supported. Intune doesn't evaluate user-to-device group relationships, and devices of the included users aren't excluded. | | 5 | ❕ Partially supported

Assigning a policy to a static device group while excluding a dynamic device group is supported. But, it's not recommended in scenarios that are sensitive to latency. Any delay in exclude group membership calculation can cause policies to be offered to devices. In this scenario, we recommend using [filters](../fundamentals/filters.md) instead of dynamic device groups for excluding devices. | -| 6 | ✔️ Supported

Assigning a policy to a static device group and excluding a different static device group is supported. | +| 6 | ✅ Supported

Assigning a policy to a static device group and excluding a different static device group is supported. | | 7 | ❌ Not supported

Assigning a policy to a static device group and excluding user groups (both dynamic and static) isn't supported. Intune doesn't evaluate user-to-device group relationships, and devices of the included users aren't excluded. | | 8 | ❌ Not supported

Assigning a policy to a static device group and excluding user groups (both dynamic and static) isn't supported. Intune doesn't evaluate user-to-device group relationships, and devices of the included users aren't excluded. | | 9 | ❌ Not supported

Assigning a policy to a dynamic user group and excluding device groups (both dynamic and static) isn't supported. | | 10 | ❌ Not supported

Assigning a policy to a dynamic user group and excluding device groups (both dynamic and static) isn't supported. | -| 11 | ✔️ Supported

Assigning a policy to a dynamic user group while excluding other user groups (both dynamic and static) is supported. | -| 12 | ✔️ Supported

Assigning a policy to a dynamic user group while excluding other user groups (both dynamic and static) is supported. | +| 11 | ✅ Supported

Assigning a policy to a dynamic user group while excluding other user groups (both dynamic and static) is supported. | +| 12 | ✅ Supported

Assigning a policy to a dynamic user group while excluding other user groups (both dynamic and static) is supported. | | 13 | ❌ Not supported

Assigning a policy to a static user group while excluding device groups (both dynamic and static) isn't supported. | | 14 | ❌ Not supported

Assigning a policy to a static user group while excluding device groups (both dynamic and static) isn't supported. | -| 15 | ✔️ Supported

Assigning a policy to a static user group while excluding other user groups (both dynamic and static) is supported. | -| 16 | ✔️ Supported

Assigning a policy to a static user group while excluding other user groups (both dynamic and static) is supported. | +| 15 | ✅ Supported

Assigning a policy to a static user group while excluding other user groups (both dynamic and static) is supported. | +| 16 | ✅ Supported

Assigning a policy to a static user group while excluding other user groups (both dynamic and static) is supported. | -## Next steps +## Related articles See [monitor device profiles](device-profile-monitor.md) for guidance on monitoring your policies, and the devices running your policies. diff --git a/memdocs/intune/configuration/device-profile-create.md b/memdocs/intune/configuration/device-profile-create.md index c4dc1f55cf7..ecf63eeadd6 100644 --- a/memdocs/intune/configuration/device-profile-create.md +++ b/memdocs/intune/configuration/device-profile-create.md @@ -58,6 +58,13 @@ This article: - Describes applicability rules on Windows client devices, and shows you how to create a rule. - Has more information on the check-in refresh cycle times when devices receive profiles and any profile updates. +This feature applies to: + +- Android +- iOS/iPadOS +- macOS +- Windows + ## Create the profile Profiles are created in the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). In this admin center, select **Devices**. You have the following options: @@ -66,10 +73,10 @@ Profiles are created in the [Microsoft Intune admin center](https://go.microsoft - **Overview**: Lists the status of your profiles, and provides more details on the profiles you assigned to users and devices. - **Monitor**: Check the status of your profiles for success or failure, and also view logs on your profiles. -- **By platform**: Create and view policies and profiles by your platform. This view can also show features specific to the platform. For example, select **Windows**. You see Windows-specific features, such as **Windows Update Rings** and **PowerShell scripts**. +- **By platform**: Create and view policies and profiles by your platform. This view can also show features specific to the platform. For example, select **Windows 10 and later**. You see Windows-specific features, such as **Windows Update Rings** and **PowerShell scripts**. - **Manage devices**: Create device profiles, upload custom [PowerShell scripts](../apps/intune-management-extension.md) to run on devices, and add data plans to devices using [eSIM](esim-device-configuration.md). -When you create a profile (**Configuration** > **Create**), choose your platform: +When you create a profile (**Devices** > **Manage devices** > **Configuration** > **Create**), choose your platform: - **Android device administrator** - **Android Enterprise** diff --git a/memdocs/intune/configuration/device-profile-monitor.md b/memdocs/intune/configuration/device-profile-monitor.md index 50779af1473..baf7fda7978 100644 --- a/memdocs/intune/configuration/device-profile-monitor.md +++ b/memdocs/intune/configuration/device-profile-monitor.md @@ -38,6 +38,13 @@ You can also use [Microsoft Copilot in Intune](../copilot/copilot-intune-overvie This article shows you how to check the assignment status of existing device configuration policies, make changes, troubleshoot conflicts, and how to use Copilot for some of these features. +This feature applies to: + +- Android +- iOS/iPadOS +- macOS +- Windows + ## View existing policies 1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). diff --git a/memdocs/intune/configuration/device-profile-troubleshoot.md b/memdocs/intune/configuration/device-profile-troubleshoot.md index b1d79b0b6e9..6cd6514893f 100644 --- a/memdocs/intune/configuration/device-profile-troubleshoot.md +++ b/memdocs/intune/configuration/device-profile-troubleshoot.md @@ -46,7 +46,7 @@ This article applies to the following policies: ## Policy refresh intervals -Intune notifies the device to check in with the Intune service. The notification times vary, including immediately up to a few hours. These notification times also vary between platforms. On Android devices, [Googe Mobile Services (GMS) can affect policy refresh intervals](../apps/manage-without-gms.md#some-tasks-can-be-delayed). +Intune notifies the device to check in with the Intune service. The notification times vary, including immediately up to a few hours. These notification times also vary between platforms. On Android devices, [Google Mobile Services (GMS) can affect policy refresh intervals](../apps/manage-without-gms.md#some-tasks-can-be-delayed). If a device doesn't check in to get the policy or profile after the first notification, Intune makes three more attempts. An offline device, such as turned off, or not connected to a network, might not receive the notifications. In this case, the device gets the policy or profile on its next scheduled check-in with the Intune service. The same applies to checks for noncompliance, including devices that move from a compliant to a noncompliant state. @@ -104,7 +104,7 @@ A policy is deployed to the app and takes effect. A second policy is deployed. I When two or more policies are assigned to the same user or device, then the setting that applies happens at the individual setting level: -- If you use custom compliance policies to set device settings, then the settings within the custom compliance policy take precedence over the same setting within device configuration policies. Compliance policy settings always have precedence over configuration profile settings. +- If you use compliance policies to evaluate device settings, then the settings within the compliance policy take precedence over the same setting within device configuration policies. Compliance policy settings always have precedence over configuration profile settings. - If a compliance policy evaluates against the same setting in another compliance policy, then the most restrictive compliance policy setting applies. diff --git a/memdocs/intune/configuration/device-restrictions-android-for-work.md b/memdocs/intune/configuration/device-restrictions-android-for-work.md index 32c0a0eef47..17ce9a929b3 100644 --- a/memdocs/intune/configuration/device-restrictions-android-for-work.md +++ b/memdocs/intune/configuration/device-restrictions-android-for-work.md @@ -137,7 +137,7 @@ For corporate-owned devices with a work profile, some settings only apply in the - **Locate device**: **Allow** lets admins locate lost or stolen devices using a remote action. When set to **Allow**, end users receive a one-time notification stating that Intune has location permissions. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the OS might allow locating devices using geolocation. -### Dedicated devices +### Fully managed and Dedicated devices (kiosk mode only) - **Power button menu**: **Block** hides the power options when users hold down the power button when in kiosk mode. Hiding these options prevents users from accidentally or intentionally shutting down devices. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, when users hold down the power button on a device, they're shown power options, such as Restart and Power off. @@ -179,6 +179,8 @@ For corporate-owned devices with a work profile, some settings only apply in the - Android 9.0 and newer +### Dedicated devices + - **Locate device**: **Block** prevents admins from locating lost or stolen devices using a remote action. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the OS might allow locating devices using geolocation. ### Corporate-owned work profile devices @@ -232,12 +234,12 @@ For corporate-owned devices with a work profile, some settings only apply in the ## Device experience -Use these settings to configure a kiosk-style experience on your dedicated devices, or to customize the home screen experiences on your fully managed devices. +Use these settings to configure a kiosk-style experience on your dedicated or fully managed devices, or to customize the home screen experiences on your fully managed devices. If you’re not sure which experience to configure, the diagram below can help you decide on the right option for your devices. If you’re still uncertain, see [Selecting a home screen experience for your Android Enterprise corporate-owned devices](https://techcommunity.microsoft.com/t5/intune-customer-success/bg-p/IntuneCustomerSuccess). -**Enrollment profile type**: Select an enrollment profile type to start configuring Microsoft Launcher or the Microsoft Managed Home Screen on your devices. Your options: +**Device experience type**: Select a device experience type to start configuring Microsoft Launcher or the Microsoft Managed Home Screen on your devices. Your options: - **Not configured**: Intune doesn't change or update this setting. By default, users might see the device's default home screen experience. -- **Dedicated device**: Configure a kiosk-style experience on your dedicated devices. You can configure devices to run one app, or run many apps. When a device is set with kiosk mode, only the apps you add are available. Before you configure these settings, be sure to [add](../apps/apps-add-android-for-work.md), and [assign](../apps/apps-deploy.md) the apps you want on the devices. +- **Kiosk mode (dedicated and fully managed)**: Configure a kiosk-style experience on your dedicated and fully managed devices. You can configure devices to run one app, or run many apps. When a device is set with kiosk mode, only the apps you add are available. Before you configure these settings, be sure to [add](../apps/apps-add-android-for-work.md), and [assign](../apps/apps-deploy.md) the apps you want on the devices. - **Kiosk mode**: Choose if the device runs one app or runs multiple apps. @@ -247,7 +249,7 @@ Use these settings to configure a kiosk-style experience on your dedicated devic > - Device navigation buttons, like the home and overview buttons, are disabled and removed from view. > - The device's lock screen, like the keyguard, is disabled. > - > To use dialer & phone applications, or for your users to receive push notifications in kiosk mode, use the [Dedicated devices](#dedicated-devices) > **Enabled system navigation features** (with **Home button** options) and **System notifications and information** settings (in this article). These features are available on Android devices running 9.0 and newer. + > To use dialer & phone applications, or for your users to receive push notifications in kiosk mode, use the [Fully managed and Dedicated devices (kiosk mode only](#dedicated-devices) > **Enabled system navigation features** (with **Home button** options) and **System notifications and information** settings (in this article). These features are available on Android devices running 9.0 and newer. > > On OS 9 and newer, the [Device password](#device-password) > **Disable lock screen** (in this article) setting manages the device's lock screen behavior. @@ -259,26 +261,29 @@ Use these settings to configure a kiosk-style experience on your dedicated devic - **Not configured**: Intune doesn't change or update this setting. - **Single app**: When users are on the devices, they can only access the app you selected. When the device starts, only the specific app starts. Users are restricted from changing the running app. - **Select an app to use for kiosk mode**: Select the Managed Google Play or Android Enterprise system app from the list. For single-app dedicated devices, the app you select **must be**: + **Select an app to use for kiosk mode**: Select the Managed Google Play or Android Enterprise system app from the list. For single-app dedicated and fully managed devices, the app you select **must be**: - [Added in Intune](../apps/apps-add-android-for-work.md). - - [Assigned to the device group](../apps/apps-deploy.md) created for your dedicated devices. + - [Assigned to the device group](../apps/apps-deploy.md) created for your dedicated or fully managed devices. + + > [!NOTE] + > On fully managed devices, the only selected app that will apply is Managed Home Screen. All other apps will be treated as a required app instead. - **Multi-app**: Users can access a limited set of apps on the device. When the device starts, only the apps you add start. You can also add some web links that users can open. When the policy is applied, users see icons for the allowed apps on the home screen. - For multi-app dedicated devices, the **Managed Home Screen** app isn't required to be in the configuration profile, but the [Managed Home Screen app](https://play.google.com/work/apps/details?id=com.microsoft.launcher.enterprise) from Google Play **must be**: + For multi-app dedicated and fully managed devices, the **Managed Home Screen** app isn't required to be in the configuration profile, but the [Managed Home Screen app](https://play.google.com/work/apps/details?id=com.microsoft.launcher.enterprise) from Google Play **must be**: - [Added in Intune](../apps/apps-add-android-for-work.md). - - [Assigned to the device group](../apps/apps-deploy.md) created for your dedicated devices. + - [Assigned to the device group](../apps/apps-deploy.md) created for your dedicated or fully managed devices. Also, any packages you want launchable from Managed Home Screen **must be**: - [Added in Intune](../apps/apps-add-android-for-work.md). - - [Assigned to the device group](../apps/apps-deploy.md) created for your dedicated devices. + - [Assigned to the device group](../apps/apps-deploy.md) created for your dedicated or fully managed devices. When the **Managed Home Screen** app is added, any other installed apps you add in the configuration profile are shown as icons on the **Managed Home Screen** app. - For more information on the Managed Home screen, see [setup Microsoft Managed Home Screen on Dedicated devices in multi-app kiosk mode](https://techcommunity.microsoft.com/t5/intune-customer-success/how-to-setup-microsoft-managed-home-screen-on-dedicated-devices/ba-p/1388060). + For more information on the Managed Home screen, see [Setup Microsoft Managed Home Screen on dedicated and fully managed devices in multi-app kiosk mode](https://techcommunity.microsoft.com/t5/intune-customer-success/how-to-setup-microsoft-managed-home-screen-on-dedicated-devices/ba-p/1388060). > [!NOTE] > Not all **Managed Home Screen** settings are available from the device restrictions page. To view all settings available for **Managed Home Screen**, see [Configure the Microsoft Managed Home Screen app](../apps/app-configuration-managed-home-screen-app.md). @@ -294,9 +299,9 @@ Use these settings to configure a kiosk-style experience on your dedicated devic - **Add**: Select your apps from the list. - If the **Managed Home Screen** app isn't listed, then [add it from Google Play](https://play.google.com/work/apps/details?id=com.microsoft.launcher.enterprise). Be sure to [assign the app](../apps/apps-deploy.md) to the device group created for your dedicated devices. + If the **Managed Home Screen** app isn't listed, then [add it from Google Play](https://play.google.com/work/apps/details?id=com.microsoft.launcher.enterprise). Be sure to [assign the app](../apps/apps-deploy.md) to the device group created for your dedicated or fully managed devices. - You can also add other [Android apps](../apps/apps-add-android-for-work.md) and [web apps](../apps/web-app.md) created by your organization to the device. Be sure to [assign the app to the device group created for your dedicated devices](../apps/apps-deploy.md). + You can also add other [Android apps](../apps/apps-add-android-for-work.md) and [web apps](../apps/web-app.md) created by your organization to the device. Be sure to [assign the app to the device group created for your dedicated or fully managed devices](../apps/apps-deploy.md). > [!IMPORTANT] > When using multi-app mode, every app in the policy must be a required app, and must be assigned to the devices. If an app isn't required, or isn't assigned, then the devices can lock out users, and show a `Contact your IT admin. This phone will be erased.` message. @@ -343,7 +348,7 @@ Use these settings to configure a kiosk-style experience on your dedicated devic - **Leave kiosk mode code**: Enter a 4-6 digit numeric PIN. The administrator uses this PIN to temporarily pause kiosk mode. - - **Set custom URL background**: Enter a URL to customize the background screen on the dedicated device. For example, enter `http://contoso.com/backgroundimage.jpg`. + - **Set custom URL background**: Enter a URL to customize the background screen on the dedicated or fully managed device. For example, enter `http://contoso.com/backgroundimage.jpg`. > [!NOTE] > For most cases, we recommend starting with images of at least the following sizes: @@ -355,11 +360,11 @@ Use these settings to configure a kiosk-style experience on your dedicated devic > > Modern displays have higher pixel densities and can display equivalent 2K/4K definition images. - - **Shortcut to settings menu**: **Disable** hides the Managed Settings shortcut on the Managed Home Screen. Users can still swipe down to access the settings. On the updated Managed Home Screen workflow, the **Managed Settings** menu is available from the top bar. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the Managed Settings shortcut is shown on devices. Users can also swipe down to access these settings. On the updated Managed Home Screen workflow, users can select the settings icon to access settings. + - **Shortcut to settings menu**: **Disable** hides the Managed Settings shortcut on the Managed Home Screen. Users can still access the **Managed Settings** menu from the top bar. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the Managed Settings shortcut is shown on devices. Users can select the settings icon to access settings. - **Quick access to debug menu**: This setting controls how users access the debug menu. Your options: - - **Enable**: Users can access the debug menu easier. Specifically, they can swipe down, or use the Managed Settings shortcut or Managed Settings menu on the updated Managed Home Screen workflow. As always, they can continue to select the back button 15 times. + - **Enable**: Users can access the debug menu easier. Specifically, they can access it from the Managed Settings menu. As always, they can continue to select the back button 15 times. - **Not configured** (default): Intune doesn't change or update this setting. By default, easy access to the debug menu is turned off. Users must select the back button 15 times to open the debug menu. In the debug menu, users can: @@ -392,7 +397,7 @@ Use these settings to configure a kiosk-style experience on your dedicated devic > > - On Android 11 devices, when users connect to a network using the Managed Home Screen, they're prompted to consent. This prompt comes from Android, and isn't specific to the Managed Home Screen. > - > - On Android 10 devices, when users connect to a network using the Managed Home Screen, a notification prompts them to consent. So, users need access to the status bar and notifications to consent. To enable system notifications, see [General settings for dedicated devices](#dedicated-devices) (in this article). + > - On Android 10 devices, when users connect to a network using the Managed Home Screen, a notification prompts them to consent. So, users need access to the status bar and notifications to consent. To enable system notifications, see [General settings for fully managed and dedicated devices](#fully-managed-and-dedicated-devices) (in this article). > > - On Android 10 devices, when users connect to a password protected Wi-Fi network using the Managed Home Screen, they're prompted for the password. If the device is connected to an unstable network, then the Wi-Fi network changes. This behavaior happens even when users enter the correct password. @@ -437,7 +442,7 @@ Use these settings to configure a kiosk-style experience on your dedicated devic > - If the system's lock screen timeout is longer than the number of seconds for device to show the screensaver, then the screensaver shows until the lock screen appears. > - If the system's lock screen timeout is shorter than the number of seconds the device is inactive, then the screensaver shows as soon as the device's lock screen appears. - - **MHS Sign-in screen**: **Enable** shows a sign-in screen on the Managed Home Screen. When set to **Not configured** (default), Intune doesn't change or update this setting. This sign-in screen and related settings are intended for use on dedicated devices enrolled with Microsoft Entra shared device mode. + - **MHS Sign-in screen** (*Dedicated devices only*): **Enable** shows a sign-in screen on the Managed Home Screen. When set to **Not configured** (default), Intune doesn't change or update this setting. This sign-in screen and related settings are intended for use on dedicated devices enrolled with Microsoft Entra shared device mode. When enabled, also configure: @@ -456,7 +461,7 @@ Use these settings to configure a kiosk-style experience on your dedicated devic - **Number of seconds device is inactive before automatically signing user out​**: Define the period of inactivity, in seconds, before user is automatically signed out from Managed Home Screen. By default, this value is set to 300 seconds. - **Number of seconds to give user notice before automatically signing them out**: Define the amount of time, in seconds, for user to have option to resume their session before getting automatically signed out from Managed Home Screen. By default, this value is set to 60 seconds. -- **Fully managed**: Configures the Microsoft Launcher app on fully managed devices. +- **Microsoft launcher (fully managed only)**: Configures the Microsoft Launcher app on fully managed devices. This option is best suited for devices which should provide the end user access to all applications and settings on the device. - **Make Microsoft Launcher the default launcher**: **Enable** sets Microsoft Launcher as the default launcher on the home screen. If you make Launcher the default, users can't use another launcher. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the Microsoft Launcher isn't forced as the default launcher. - **Configure custom wallpaper**: In the Microsoft Launcher app, **Enable** lets you apply your own image as the home screen wallpaper, and choose if users can change the image. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the device keeps its current wallpaper. diff --git a/memdocs/intune/configuration/device-restrictions-android.md b/memdocs/intune/configuration/device-restrictions-android.md index 68c37621d23..95beb899c40 100644 --- a/memdocs/intune/configuration/device-restrictions-android.md +++ b/memdocs/intune/configuration/device-restrictions-android.md @@ -243,4 +243,4 @@ Kiosk settings apply only to Samsung Knox Standard devices running Android 10 or [Assign the profile](device-profile-assign.md) and [monitor its status](device-profile-monitor.md). -You can also create kiosk profiles for [Android Enterprise](device-restrictions-android-for-work.md#device-experience) and [Windows 10](kiosk-settings.md) devices. +You can also create kiosk profiles for [Android Enterprise](device-restrictions-android-for-work.md#device-experience) and [Windows](kiosk-settings.md) devices. diff --git a/memdocs/intune/configuration/device-restrictions-configure.md b/memdocs/intune/configuration/device-restrictions-configure.md index 5a04b4acedb..196442d6dae 100644 --- a/memdocs/intune/configuration/device-restrictions-configure.md +++ b/memdocs/intune/configuration/device-restrictions-configure.md @@ -7,7 +7,7 @@ keywords: author: MandiOhlinger ms.author: mandia manager: dougeby -ms.date: 11/09/2023 +ms.date: 08/19/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: configuration @@ -32,10 +32,9 @@ ms.collection: [!INCLUDE [windows-phone-81-windows-10-mobile-support](../includes/windows-phone-81-windows-10-mobile-support.md)] +[!INCLUDE [android_device_administrator_support](../includes/android-device-administrator-support.md)] - [!INCLUDE [android_device_administrator_support](../includes/android-device-administrator-support.md)] - -Intune includes device restriction policies that help administrators control Android, iOS/iPadOS, macOS, and Windows devices. These restrictions let you control a wide range of settings and features to protect your organization's resources. For example, administrators can: +Intune includes device restriction policies that help administrators control Android, iOS/iPadOS, macOS, and Windows devices. These restrictions let you control a wide range of settings and features to protect your organization's resources. For example, admins can: - Allow or block the device camera. - Control access to Google Play, app stores, viewing documents, and gaming. @@ -43,7 +42,7 @@ Intune includes device restriction policies that help administrators control And - Allow or prevent backing up files to cloud and storage accounts. - Set a minimum password length, and block simple passwords. -These features are available in Intune, and are configurable by the administrator. Intune uses "configuration profiles" to create and customize these settings for your organization's needs. After you add these features in a profile, you can then push or deploy the profile to devices in your organization. +These features are available in Intune, and are configurable by the administrator. Intune uses **configuration profiles** to create and customize these settings for your organization's needs. After you add these features in a profile, you then assign the profile to devices in your organization. This feature applies to: @@ -64,7 +63,7 @@ This article shows you how to create a device restrictions profile. You can also 2. Select **Devices** > **Manage devices** > **Configuration** > **Create** > **New policy**. 3. Enter the following properties: - - **Platform**: Choose the platform of your devices. Your options: + - **Platform**: Select the platform of your devices. Your options: - **Android device administrator** - **Android (AOSP)** @@ -76,7 +75,7 @@ This article shows you how to create a device restrictions profile. You can also - **Profile type**: Select **Device restrictions**. Or, select **Templates** > **Device restrictions**. - To create a device restrictions profile for Windows 10 Team devices, such as Surface Hub, then choose **Device restrictions (Windows 10 Team)**. + To create a device restrictions profile for Windows 10 Team devices, like Surface Hub, then select **Device restrictions (Windows 10 Team)**. 4. Select **Create**. 5. In **Basics**, enter the following properties: @@ -86,7 +85,7 @@ This article shows you how to create a device restrictions profile. You can also 6. Select **Next**. -7. In **Configuration settings**, depending on the platform you chose, the settings you can configure are different. Choose your platform for detailed settings: +7. In **Configuration settings**, depending on the platform you chose, the settings you can configure are different. Select your platform for detailed settings: - [Android device administrator](device-restrictions-android.md) - [Android (AOSP)](device-restrictions-android-aosp.md) @@ -99,26 +98,17 @@ This article shows you how to create a device restrictions profile. You can also - [Windows Holographic for Business](device-restrictions-windows-holographic.md) 8. Select **Next**. -9. In **Scope tags** (optional), assign a tag to filter the profile to specific IT groups, such as `US-NC IT Team` or `JohnGlenn_ITDepartment`. For more information about scope tags, go to [Use RBAC and scope tags for distributed IT](../fundamentals/scope-tags.md). +9. In **Scope tags** (optional), assign a tag to filter the profile to specific IT groups, like `US-NC IT Team` or `JohnGlenn_ITDepartment`. For information about scope tags, go to [Use RBAC and scope tags for distributed IT](../fundamentals/scope-tags.md). Select **Next**. -10. In **Assignments**, select the users or groups that will receive your profile. For more information on assigning profiles, go to [Assign user and device profiles](device-profile-assign.md). +10. In **Assignments**, select the users or groups that will receive your profile. For information on assigning profiles, go to [Assign user and device profiles](device-profile-assign.md). Select **Next**. 11. In **Review + create**, review your settings. When you select **Create**, your changes are saved, and the profile is assigned. The policy is also shown in the profiles list. -## Next steps - -After the profile is created, it's ready to be assigned. Be sure to [assign the profile](device-profile-assign.md) and [monitor its status](device-profile-monitor.md). - - +- [Assign the profile](device-profile-assign.md). +- [Monitor the profile status](device-profile-monitor.md). diff --git a/memdocs/intune/configuration/kiosk-settings-holographic.md b/memdocs/intune/configuration/kiosk-settings-holographic.md index b40e1de4dca..5f745e92cf5 100644 --- a/memdocs/intune/configuration/kiosk-settings-holographic.md +++ b/memdocs/intune/configuration/kiosk-settings-holographic.md @@ -40,7 +40,7 @@ To learn more about the Windows kiosk feature in Intune, go to [configure kiosk ## Before you begin -- [Create a Windows 10/11 kiosk device configuration profile](kiosk-settings.md#create-the-profile). +- [Create a Windows kiosk device configuration profile](kiosk-settings.md#create-the-profile). When you create a Windows client kiosk device configuration profile, there are more settings than what's listed in this article. The settings in this article are supported on Windows Holographic for Business devices. @@ -119,4 +119,4 @@ Apps in this mode are available on the start menu. These apps are the only apps - [Assign the profile](device-profile-assign.md) and [monitor its status](device-profile-monitor.md). -- Create kiosk profiles for [Android](device-restrictions-android.md#kiosk), [Android Enterprise](device-restrictions-android-for-work.md#device-experience), and [Windows 10/11](kiosk-settings-windows.md) devices. +- Create kiosk profiles for [Android](device-restrictions-android.md#kiosk), [Android Enterprise](device-restrictions-android-for-work.md#device-experience), and [Windows](kiosk-settings-windows.md) devices. diff --git a/memdocs/intune/configuration/kiosk-settings-windows.md b/memdocs/intune/configuration/kiosk-settings-windows.md index d703f77daa9..ab12dbee5b8 100644 --- a/memdocs/intune/configuration/kiosk-settings-windows.md +++ b/memdocs/intune/configuration/kiosk-settings-windows.md @@ -44,7 +44,7 @@ To learn more about the Windows kiosk feature in Intune, see [configure kiosk se ## Before you begin -- Create a [Windows 10/11 kiosk device configuration profile](kiosk-settings.md#create-the-profile). +- Create a [Windows kiosk device configuration profile](kiosk-settings.md#create-the-profile). - This kiosk profile is directly related to the device restrictions profile you create using the [Microsoft Edge kiosk settings](device-restrictions-windows-10.md#microsoft-edge-legacy-version-45-and-older). To summarize: diff --git a/memdocs/intune/configuration/media/administrative-templates-update-office/admx-enable-update-channel-setting.png b/memdocs/intune/configuration/media/administrative-templates-update-office/admx-enable-update-channel-setting.png index 0d9e9fb480b..e6d4b69830f 100644 Binary files a/memdocs/intune/configuration/media/administrative-templates-update-office/admx-enable-update-channel-setting.png and b/memdocs/intune/configuration/media/administrative-templates-update-office/admx-enable-update-channel-setting.png differ diff --git a/memdocs/intune/configuration/media/device-restrictions-android-for-work/decision-process-for-enroll-and-launcher.png b/memdocs/intune/configuration/media/device-restrictions-android-for-work/decision-process-for-enroll-and-launcher.png new file mode 100644 index 00000000000..534f5384ffb Binary files /dev/null and b/memdocs/intune/configuration/media/device-restrictions-android-for-work/decision-process-for-enroll-and-launcher.png differ diff --git a/memdocs/intune/configuration/media/edition-upgrade-configure-windows-10/check_grn.png b/memdocs/intune/configuration/media/edition-upgrade-configure-windows-10/check_grn.png deleted file mode 100644 index f9f04cd6bd9..00000000000 Binary files a/memdocs/intune/configuration/media/edition-upgrade-configure-windows-10/check_grn.png and /dev/null differ diff --git a/memdocs/intune/configuration/media/edition-upgrade-configure-windows-10/x_blk.png b/memdocs/intune/configuration/media/edition-upgrade-configure-windows-10/x_blk.png deleted file mode 100644 index 69432ff71cf..00000000000 Binary files a/memdocs/intune/configuration/media/edition-upgrade-configure-windows-10/x_blk.png and /dev/null differ diff --git a/memdocs/intune/configuration/media/ios-device-features-settings/find-friends-settings-apps-ios-pages.png b/memdocs/intune/configuration/media/ios-device-features-settings/find-friends-settings-apps-ios-pages.png deleted file mode 100644 index b146bf4898d..00000000000 Binary files a/memdocs/intune/configuration/media/ios-device-features-settings/find-friends-settings-apps-ios-pages.png and /dev/null differ diff --git a/memdocs/intune/configuration/media/ios-device-features-settings/page-find-friends-settings-apps.png b/memdocs/intune/configuration/media/ios-device-features-settings/page-find-friends-settings-apps.png deleted file mode 100644 index d5f7bab6109..00000000000 Binary files a/memdocs/intune/configuration/media/ios-device-features-settings/page-find-friends-settings-apps.png and /dev/null differ diff --git a/memdocs/intune/configuration/media/ios-device-features-settings/page-settings-app-properties.png b/memdocs/intune/configuration/media/ios-device-features-settings/page-settings-app-properties.png deleted file mode 100644 index 5197aa2eb3d..00000000000 Binary files a/memdocs/intune/configuration/media/ios-device-features-settings/page-settings-app-properties.png and /dev/null differ diff --git a/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/knox-service-plugin-add-settings.png b/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/knox-service-plugin-add-settings.png deleted file mode 100644 index 21fd83fff49..00000000000 Binary files a/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/knox-service-plugin-add-settings.png and /dev/null differ diff --git a/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/knox-service-plugin-all-configured-nodes.png b/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/knox-service-plugin-all-configured-nodes.png deleted file mode 100644 index 55424179aca..00000000000 Binary files a/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/knox-service-plugin-all-configured-nodes.png and /dev/null differ diff --git a/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/knox-service-plugin-permission-controls-node.png b/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/knox-service-plugin-permission-controls-node.png deleted file mode 100644 index ad4c3b8b922..00000000000 Binary files a/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/knox-service-plugin-permission-controls-node.png and /dev/null differ diff --git a/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/knox-service-plugin-top-node.png b/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/knox-service-plugin-top-node.png deleted file mode 100644 index 90817a506fd..00000000000 Binary files a/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/knox-service-plugin-top-node.png and /dev/null differ diff --git a/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/zebra-legacy-add-setting.png b/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/zebra-legacy-add-setting.png deleted file mode 100644 index e637b95524d..00000000000 Binary files a/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/zebra-legacy-add-setting.png and /dev/null differ diff --git a/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/zebra-legacy-all-configured-nodes.png b/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/zebra-legacy-all-configured-nodes.png deleted file mode 100644 index 5aae569653f..00000000000 Binary files a/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/zebra-legacy-all-configured-nodes.png and /dev/null differ diff --git a/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/zebra-legacy-permission-access-configuration.png b/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/zebra-legacy-permission-access-configuration.png deleted file mode 100644 index 8c79c876ce9..00000000000 Binary files a/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/zebra-legacy-permission-access-configuration.png and /dev/null differ diff --git a/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/zebra-legacy-transaction-steps-node-add-setting.png b/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/zebra-legacy-transaction-steps-node-add-setting.png deleted file mode 100644 index 4bb21c7426a..00000000000 Binary files a/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/zebra-legacy-transaction-steps-node-add-setting.png and /dev/null differ diff --git a/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/zebra-legacy-transaction-steps-node.png b/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/zebra-legacy-transaction-steps-node.png deleted file mode 100644 index 0fe188d37b8..00000000000 Binary files a/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/zebra-legacy-transaction-steps-node.png and /dev/null differ diff --git a/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/zebra-mx-add-setting.png b/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/zebra-mx-add-setting.png deleted file mode 100644 index 01dba425831..00000000000 Binary files a/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/zebra-mx-add-setting.png and /dev/null differ diff --git a/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/zebra-mx-all-configured-nodes.png b/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/zebra-mx-all-configured-nodes.png deleted file mode 100644 index 07264666e47..00000000000 Binary files a/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/zebra-mx-all-configured-nodes.png and /dev/null differ diff --git a/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/zebra-mx-package-configuration-node.png b/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/zebra-mx-package-configuration-node.png deleted file mode 100644 index eefbfc31c27..00000000000 Binary files a/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/zebra-mx-package-configuration-node.png and /dev/null differ diff --git a/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/zebra-mx-permissions-node-add-setting.png b/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/zebra-mx-permissions-node-add-setting.png deleted file mode 100644 index f9a6803e93c..00000000000 Binary files a/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/zebra-mx-permissions-node-add-setting.png and /dev/null differ diff --git a/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/zebra-mx-permissions-node.png b/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/zebra-mx-permissions-node.png deleted file mode 100644 index 412831e4fa2..00000000000 Binary files a/memdocs/intune/configuration/media/oemconfig-managed-home-screen-permissions-android/zebra-mx-permissions-node.png and /dev/null differ diff --git a/memdocs/intune/configuration/media/platform-sso-macos/Extension-Data-AppPrefixAllowList.png b/memdocs/intune/configuration/media/platform-sso-macos/Extension-Data-AppPrefixAllowList.png new file mode 100644 index 00000000000..6edb136962b Binary files /dev/null and b/memdocs/intune/configuration/media/platform-sso-macos/Extension-Data-AppPrefixAllowList.png differ diff --git a/memdocs/intune/configuration/media/platform-sso-macos/settings-picker-authentication-extensible-sso-extension-data.png b/memdocs/intune/configuration/media/platform-sso-macos/settings-picker-authentication-extensible-sso-extension-data.png new file mode 100644 index 00000000000..49296a5ef33 Binary files /dev/null and b/memdocs/intune/configuration/media/platform-sso-macos/settings-picker-authentication-extensible-sso-extension-data.png differ diff --git a/memdocs/intune/configuration/oemconfig-managed-home-screen-permissions-android.md b/memdocs/intune/configuration/oemconfig-managed-home-screen-permissions-android.md index b4965514670..f8dbf6f4974 100644 --- a/memdocs/intune/configuration/oemconfig-managed-home-screen-permissions-android.md +++ b/memdocs/intune/configuration/oemconfig-managed-home-screen-permissions-android.md @@ -33,7 +33,7 @@ ms.collection: The Managed Home Screen (MHS) is an Intune app that allows you to configure the home screen on the device. It only shows the apps that your users access and the device settings that admins need to manage. -The MHS is used for kiosk devices, including frontline worker (FLW) devices. It replaces the default launcher on your Android Enterprise dedicated devices. To learn more about the MHS app, go to [Configure the Microsoft MHS app for Android Enterprise](../apps/app-configuration-managed-home-screen-app.md). +The MHS is used for kiosk devices, including frontline worker (FLW) devices. It replaces the default launcher on your Android Enterprise dedicated and fully managed devices. To learn more about the MHS app, go to [Configure the Microsoft MHS app for Android Enterprise](../apps/app-configuration-managed-home-screen-app.md). Typically, when you configure the MHS on a device, end users need to manually accept certain permissions that MHS needs. These permissions allow the MHS to access device features and settings. @@ -42,6 +42,7 @@ Instead of relying on end users to accept the permissions, you can use an [OEMCo This feature applies to: - Android Enterprise devices enrolled as [dedicated devices](../enrollment/android-kiosk-enroll.md) +- Android Enterprise devices enrolled as [fully managed devices](../enrollment/android-fully-managed-enroll.md) Supported OEMs include: @@ -76,7 +77,7 @@ For information on when to use Zebra vs. Legacy Zebra, go to [OEMConfig apps for ## Before you begin - This article creates OEMConfig configuration profiles in Intune. Before you create OEMConfig profiles, review the [OEMConfig profiles in Microsoft Intune - Before you begin](android-oem-configuration-overview.md#before-you-begin) section for important information, as there's a 500-KB file size limit and other important information. -- Devices must be MDM enrolled in Intune as dedicated devices. For more information on the available Intune enrollment options for Android Enterprise devices, go to [Enrollment guide: Enroll Android devices in Microsoft Intune](../fundamentals/deployment-guide-enrollment-android.md). +- Devices must be MDM enrolled in Intune as dedicated devices or fully managed devices. For more information on the available Intune enrollment options for Android Enterprise devices, go to [Enrollment guide: Enroll Android devices in Microsoft Intune](../fundamentals/deployment-guide-enrollment-android.md). - To configure this policy, at a minimum, sign into the Intune admin center with the **Policy and Profile manager** role. For more information on the built-in roles in Intune, go to [Role-based access control with Microsoft Intune](../fundamentals/role-based-access-control.md). ## Step 1 - Get the app from the Managed Google Play Store diff --git a/memdocs/intune/configuration/oemconfig-zebra-android-devices.md b/memdocs/intune/configuration/oemconfig-zebra-android-devices.md index b8e06b24811..817c069bb16 100644 --- a/memdocs/intune/configuration/oemconfig-zebra-android-devices.md +++ b/memdocs/intune/configuration/oemconfig-zebra-android-devices.md @@ -55,7 +55,7 @@ To manage Zebra devices, there are two versions of the OEMConfig app: | OEMConfig app | Supported Android versions | Multiple profile support | | --- | --- | --- | | **Zebra OEMConfig Powered by MX** (new app) | - Android 13 and later
- Android 11 | ❌ This new app aligns closely with Google's standards. It's suggested to deploy one profile with all the required configuration settings.

If you use multiple OEMConfig profiles, then don't configure the same top parent group or bundle in multiple profiles. It can cause conflicts. For more important information, go to [OEMConfig overview - Before you begin](android-oem-configuration-overview.md#before-you-begin)

For more information on the new **Zebra OEMConfig Powered by MX** app, go to [New Zebra OEMConfig app for Android](https://techcommunity.microsoft.com/t5/intune-customer-success/new-zebra-oemconfig-app-for-android-11-and-later/ba-p/3846730). | -| **Legacy Zebra OEMConfig** | - Android 11 and earlier | ✔️ You can split your Zebra OEMConfig settings into smaller profiles. For example, create a baseline profile that affects all devices. Then, create more profiles that configure settings specific to a device. | +| **Legacy Zebra OEMConfig** | - Android 11 and earlier | ✅ You can split your Zebra OEMConfig settings into smaller profiles. For example, create a baseline profile that affects all devices. Then, create more profiles that configure settings specific to a device. | ## Multiple profiles using the Legacy Zebra OEMConfig app diff --git a/memdocs/intune/configuration/platform-sso-macos.md b/memdocs/intune/configuration/platform-sso-macos.md index df9ef54b538..1c4ce1c4a08 100644 --- a/memdocs/intune/configuration/platform-sso-macos.md +++ b/memdocs/intune/configuration/platform-sso-macos.md @@ -7,7 +7,7 @@ keywords: author: MandiOhlinger ms.author: mandia manager: dougeby -ms.date: 06/06/2024 +ms.date: 09/03/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: configuration @@ -34,11 +34,11 @@ ms.collection: On your macOS devices, you can configure Platform SSO to enable single sign-on (SSO) using passwordless authentication, Microsoft Entra ID user accounts, or smart cards. Platform SSO is an enhancement to the [Microsoft Enterprise SSO plug-in](/entra/identity-platform/apple-sso-plugin) and the [SSO app extension](use-enterprise-sso-plug-in-macos-with-intune.md). Platform SSO can sign users into their managed Mac devices using their Microsoft Entra ID credentials and Touch ID. -This article applies to: +This feature applies to: - macOS -The [Microsoft Enterprise SSO plug-in](/entra/identity-platform/apple-sso-plugin) in Microsoft Entra ID includes two SSO features - **Platform SSO** and the **SSO app extension**. This article focuses on configuring [Platform SSO with Entra ID](/entra/identity/devices/macos-psso) for macOS devices which is in preview. +The [Microsoft Enterprise SSO plug-in](/entra/identity-platform/apple-sso-plugin) in Microsoft Entra ID includes two SSO features - **Platform SSO** and the **SSO app extension**. This article focuses on configuring [Platform SSO with Microsoft Entra ID](/entra/identity/devices/macos-psso) for macOS devices (public preview). Some benefits of Platform SSO include: @@ -59,16 +59,31 @@ This article shows you how to configure Platform SSO for macOS devices in Intune ## Prerequisites - Devices must be running macOS 13.0 and newer. -- Microsoft Intune [Company Portal app](../apps/apps-company-portal-macos.md) version **5.2404.0** and newer is required. This version includes Platform SSO. -- Supported web browsers include: + +- Microsoft Intune [Company Portal app](../apps/apps-company-portal-macos.md) version **5.2404.0** and newer is required on the devices. This version includes Platform SSO. + +- The following web browsers support Platform SSO: + - Microsoft Edge - - Google Chrome with the [Microsoft Single Sign On extension](https://chromewebstore.google.com/detail/windows-accounts/ppnbnpeolgkicgegkbkbjmhlideopiji). You can deploy this extension using [Chrome Enterprise policy - ExtensionInstallForcelist](https://chromeenterprise.google/policies/?policy=ExtensionInstallForcelist) (opens Google's web site) in the settings catalog. + - Google Chrome with the [Microsoft Single Sign On extension](https://chromewebstore.google.com/detail/windows-accounts/ppnbnpeolgkicgegkbkbjmhlideopiji) + + Using an [Intune preference file (.plist) policy](preference-file-settings-macos.md), you can force this extension to install. In your `.plist` file, you need some of the information at [Chrome Enterprise policy - ExtensionInstallForcelist](https://chromeenterprise.google/policies/?policy=ExtensionInstallForcelist) (opens Google's web site). + + > [!WARNING] + > There are sample `.plist` files at [ManagedPreferencesApplications examples on GitHub](https://github.com/ProfileCreator/ProfileManifests/tree/master/Manifests/ManagedPreferencesApplications). This GitHub repository is not owned, not maintained, and not created by Microsoft. Use the information at your own risk. + - Safari -- To create the Intune policy, at a minimum, sign in with an account that has the following Intune permissions: + + You can use Intune to add web browser apps, including [package (`.pkg`)](../apps/lob-apps-macos.md) and [disk image (`.dmg`)](../apps/lob-apps-macos-dmg.md) files, and deploy the app to your macOS devices. To get started, go to [Add apps to Microsoft Intune](../apps/apps-add.md). + +- Platform SSO uses the Intune settings catalog to configure the required settings. To create the settings catalog policy, at a minimum, sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) with an account that has the following Intune permissions: + - Device Configuration **Read**, **Create**, **Update**, and **Assign** permissions There are some built-in roles that have these permissions, including the **Policy and Profile Manager** Intune RBAC role. For more information on RBAC roles in Intune, go to [Role-based access control (RBAC) with Microsoft Intune](../fundamentals/role-based-access-control.md). +- In [Step 5 - Register the device](#step-5---register-the-device) (this article), users register their devices. These users must be allowed to join devices to Entra ID. For more information, go to [Configure your device settings](/entra/identity/devices/device-join-plan#configure-your-device-settings). + ## Step 1 - Decide the authentication method When you create the platform SSO policy in Intune, you need to decide the authentication method you want to use. @@ -149,9 +164,12 @@ For more information, go to [Microsoft Entra certificate-based authentication on ## Step 2 - Create the Platform SSO policy in Intune -To configure the Platform SSO policy, use the following steps to create an [Intune settings catalog](settings-catalog.md) policy. These settings are required by the Microsoft Enterprise SSO plug-in. For more information, go to [Microsoft Enterprise SSO plug-in for Apple devices](/entra/identity-platform/apple-sso-plugin). +To configure the Platform SSO policy, use the following steps to create an [Intune settings catalog](settings-catalog.md) policy. The Microsoft Enterprise SSO plug-in requires the settings listed. + +- To learn more about the plug-in, go to [Microsoft Enterprise SSO plug-in for Apple devices](/entra/identity-platform/apple-sso-plugin). +- For details about the payload settings for the Extensible Single Sign-on extension, go to [Extensible Single Sign-on MDM payload settings for Apple devices](https://support.apple.com/guide/deployment/depfd9cdf845/web) (opens Apple's web site). -For details about the payload settings for the Extensible Single Sign-on extension, go to [Extensible Single Sign-on MDM payload settings for Apple devices](https://support.apple.com/guide/deployment/depfd9cdf845/web) (opens Apple's web site). +**Create the policy**: 1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). 2. Select **Devices** > **Manage devices** > **Configuration** > **Create** > **New policy**. @@ -188,23 +206,26 @@ For details about the payload settings for the Extensible Single Sign-on extensi Close the settings picker. > [!TIP] - > There are more optional Platform SSO settings you can configure in the policy. For a list, go to [More Platform SSO settings you can configure](#more-platform-sso-settings-you-can-configure) (in this article). + > There are more Platform SSO settings you can configure in the policy: + > + > - [Non-Microsoft apps and Microsoft Enterprise SSO Extension settings](#non-microsoft-apps-and-microsoft-enterprise-sso-extension-settings) (in this article) + > - [End user experience settings](#end-user-experience-settings) (in this article) 8. Configure the following required settings: | Name | Configuration value | Description | |---|---|---| | **Authentication Method (Deprecated)**
(macOS 13 only) | **Password** or **UserSecureEnclave** | Select the Platform SSO authentication method that you chose in [Step 1 - Decide the authentication method](#step-1---decide-the-authentication-method) (in this article).

This setting applies to macOS 13 only. For macOS 14.0 and later, use the **Platform SSO** > **Authentication Method** setting.| - | **Extension Identifier** | `com.microsoft.CompanyPortalMac.ssoextension` | This ID is the SSO app extension that the profile needs for SSO to work.

The **Extension Identifier** and **Team Identifier** values work together. | - | **Platform SSO** > **Authentication Method**
(macOS 14+) | **Password**, **UserSecureEnclave** or **SmartCard** | Select the Platform SSO authentication method that you chose in [Step 1 - Decide the authentication method](#step-1---decide-the-authentication-method) (in this article).

This setting applies to macOS 14 and later. For macOS 13, use the **Authentication Method (Deprecated)** setting. | + | **Extension Identifier** | `com.microsoft.CompanyPortalMac.ssoextension` | Copy and paste this value in the setting.

This ID is the SSO app extension that the profile needs for SSO to work.

The **Extension Identifier** and **Team Identifier** values work together. | + | **Platform SSO** > **Authentication Method**
(macOS 14+) | **Password**, **UserSecureEnclave**, or **SmartCard** | Select the Platform SSO authentication method that you chose in [Step 1 - Decide the authentication method](#step-1---decide-the-authentication-method) (in this article).

This setting applies to macOS 14 and later. For macOS 13, use the **Authentication Method (Deprecated)** setting. | | **Platform SSO** > **Use Shared Device Keys**
(macOS 14+) | **Enabled** | When enabled, Platform SSO uses the same signing and encryption keys for all users on the same device.

Users upgrading from macOS 13.x to 14.x are prompted to register again. | - | **Registration token** | `{{DEVICEREGISTRATION}}` | You must include the curly braces. For more information on this registration token, go to [Configure Microsoft Entra device registration](/entra/identity-platform/apple-sso-plugin#configure-microsoft-entra-device-registration).

This setting requires that you also configure the `AuthenticationMethod` setting.

- If you use only macOS 13 devices, then configure the **Authentication Method (Deprecated)** setting.
- If you use only macOS 14+ devices, then configure the **Platform SSO** > **Authentication Method** setting.
- If you have a mix of macOS 13 and macOS 14+ devices, then configure both authentication settings in the same profile. | + | **Registration token** | `{{DEVICEREGISTRATION}}` | Copy and paste this value in the setting. You must include the curly braces.

To learn more about this registration token, go to [Configure Microsoft Entra device registration](/entra/identity-platform/apple-sso-plugin#configure-microsoft-entra-device-registration).

This setting requires that you also configure the `AuthenticationMethod` setting.

- If you use only macOS 13 devices, then configure the **Authentication Method (Deprecated)** setting.
- If you use only macOS 14+ devices, then configure the **Platform SSO** > **Authentication Method** setting.
- If you have a mix of macOS 13 and macOS 14+ devices, then configure both authentication settings in the same profile. | | **Screen Locked Behavior** | **Do Not Handle** | When set to **Do Not Handle**, the request continues without SSO. | - | **Token To User Mapping** > **Account Name** | `preferred_username` | This token specifies that the Entra [`preferred_username`](/entra/identity-platform/id-token-claims-reference#payload-claims) attribute value is used for the macOS account's Account Name value. | - | **Token To User Mapping** > **Full Name** | `name` | This token specifies that the Entra [`name`](/entra/identity-platform/id-token-claims-reference#payload-claims) claim is used for the macOS account's Full Name value. | - | **Team Identifier** | `UBF8T346G9` | This identifier is the team identifier of the Enterprise SSO plug-in app extension. | + | **Token To User Mapping** > **Account Name** | `preferred_username` | Copy and paste this value in the setting.

This token specifies that the Entra [`preferred_username`](/entra/identity-platform/id-token-claims-reference#payload-claims) attribute value is used for the macOS account's Account Name value. | + | **Token To User Mapping** > **Full Name** | `name` | Copy and paste this value in the setting.

This token specifies that the Entra [`name`](/entra/identity-platform/id-token-claims-reference#payload-claims) claim is used for the macOS account's Full Name value. | + | **Team Identifier** | `UBF8T346G9` | Copy and paste this value in the setting.

This identifier is the team identifier of the Enterprise SSO plug-in app extension. | | **Type** | Redirect | | - | **URLs** | Enter all the following URLs:

`https://login.microsoftonline.com`
`https://login.microsoft.com`
`https://sts.windows.net`

If your environment needs to allow sovereign cloud domains, then also add the following URLs:

`https://login.partner.microsoftonline.cn`
`https://login.chinacloudapi.cn`
`https://login.microsoftonline.us`
`https://login-us.microsoftonline.com` | These URL prefixes are the identity providers that do SSO app extensions. The URLs are required for **redirect** payloads and are ignored for **credential** payloads.

For more information on these URLs, go to [Microsoft Enterprise SSO plug-in for Apple devices](/entra/identity-platform/apple-sso-plugin). | + | **URLs** | Copy and paste all the following URLs:

`https://login.microsoftonline.com`
`https://login.microsoft.com`
`https://sts.windows.net`

If your environment needs to allow sovereign cloud domains, like Azure Government or Azure China 21Vianet, then also add the following URLs:

`https://login.partner.microsoftonline.cn`
`https://login.chinacloudapi.cn`
`https://login.microsoftonline.us`
`https://login-us.microsoftonline.com` | These URL prefixes are the identity providers that do SSO app extensions. The URLs are required for **redirect** payloads and are ignored for **credential** payloads.

For more information on these URLs, go to [Microsoft Enterprise SSO plug-in for Apple devices](/entra/identity-platform/apple-sso-plugin). | > [!IMPORTANT] > If you have a mix of macOS 13 and macOS 14+ devices in your environment, then configure the **Platform SSO** > **Authentication Method** and the **Authentication Method (Deprecated)** authentication settings in the same profile. @@ -234,12 +255,12 @@ The Company Portal app for macOS deploys and installs the Microsoft Enterprise S Using Intune, you can add the Company Portal app and deploy it as a required app to your macOS devices: -- For the steps, go to [Add the Company Portal app for macOS](../apps/apps-company-portal-macos.md). -- Optional. Configure the Company Portal app to include your organization information. For the steps, go to [How to configure the Intune Company Portal apps, Company Portal website, and Intune app](../apps/company-portal-app.md). +- [Add the Company Portal app for macOS](../apps/apps-company-portal-macos.md) lists the steps. +- Configure the Company Portal app to include your organization information (Optional). For the steps, go to [How to configure the Intune Company Portal apps, Company Portal website, and Intune app](../apps/company-portal-app.md). There aren't any specific steps to configure the app for Platform SSO. Just make sure the latest Company Portal app is added to Intune and deployed to your macOS devices. -If you have an older version of the Company Portal app installed, then Platform SSO won't work. +If you have an older version of the Company Portal app installed, then Platform SSO fails. ## Step 4 - Enroll the devices and apply the policies @@ -262,7 +283,7 @@ When the device receives the policy, there's a **Registration required** notific :::image type="content" border="false" source="./media/platform-sso-macos/platform-sso-macos-registration-required.png" alt-text="Screenshot that shows the registration required prompt on end user devices when you configure Platform SSO in Microsoft Intune."::: -- End users select this notification, sign in to the Microsoft Entra ID plug-in with their organization account, and complete multifactor authentication (MFA) if required. +- End users select this notification, sign in to the Microsoft Entra ID plug-in with their organization account, and complete multifactor authentication (MFA), if required. > [!NOTE] > MFA is a feature of Microsoft Entra. Make sure MFA is enabled in your tenant. For more information, including any other app requirements, go to [Microsoft Entra multifactor authentication](/entra/identity/authentication/concept-mfa-howitworks). @@ -288,7 +309,50 @@ After you confirm that your settings catalog policy is working, unassign any exi If you keep both policies, conflicts can occur. -## More Platform SSO settings you can configure +## Non-Microsoft apps and Microsoft Enterprise SSO Extension settings + +If you previously used the Microsoft Enterprise SSO Extension, and/or want to enable SSO on non-Microsoft apps, then add the **Extension Data** setting to your existing Platform SSO settings catalog policy. + +The **Extension Data** setting is a similar concept to an open text field; you can configure any values you need. + +In this section, we use the **Extension Data** setting to: + +- Configure settings you used in your previous Microsoft Enterprise SSO Extension Intune policy. +- Configure settings that allow non-Microsoft apps to use SSO. + +This section lists the minimum recommended settings you should add. In your previous Microsoft Enterprise SSO Extension policy, you might have configured more settings. We recommend you add any other key & value pair settings you configured in your previous Microsoft Enterprise SSO Extension policy. + +Remember, there should only be one SSO policy assigned to your groups. So, if you're using Platform SSO, then you must configure the Platform SSO settings **and** the Microsoft Enterprise SSO Extension settings in the Platform SSO settings catalog policy you created in [Step 2 - Create the Platform SSO policy in Intune](#step-2---create-the-platform-sso-policy-in-intune) (in this article). + +The following settings are commonly recommended for configuring SSO settings, including configuring SSO support for non-Microsoft applications. + +1. In your existing Platform SSO settings catalog policy, add **Extension Data**: + + 1. In the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) (**Devices** > **Manage devices** > **Configuration**), select your existing Platform SSO settings catalog policy. + 2. In **Properties** > **Configuration settings**, select **Edit** > **Add settings**. + 3. In the settings picker, expand **Authentication**, and select **Extensible Single Sign On (SSO)**: + + :::image type="content" source="./media/platform-sso-macos/settings-picker-authentication-extensible-sso.png" alt-text="Screenshot that shows the Settings Catalog settings picker, and selecting authentication and extensible SSO category in Microsoft Intune."::: + + 4. In the list, select **Extension Data** and close the settings picker: + + :::image type="content" source="./media/platform-sso-macos/settings-picker-authentication-extensible-sso-extension-data.png" alt-text="Screenshot that shows the Settings Catalog settings picker, and selecting authentication and Extension Data in Microsoft Intune."::: + +2. In **Extension Data**, **Add** the following keys and values: + + | Key | Type | Value | Description | + | --- | --- | --- | --- | + | **AppPrefixAllowList** | String | `com.microsoft.,com.apple.` | Copy and paste this value in the setting.

**AppPrefixAllowList** lets you create a list of app vendors with apps that can use SSO. You can add more app vendors to this list as needed. | + | **browser_sso_interaction_enabled** | Integer | `1` | Configures a recommended broker setting. | + | **disable_explicit_app_prompt** | Integer | `1` | Configures a recommended broker setting. | + + The following example shows the recommended configuration: + + :::image type="content" source="./media/platform-sso-macos/extension-data-AppPrefixAllowList.png" alt-text="Screenshot that shows how to configure Extension Data settings, such as AppPrefixAllowList."::: + +3. Select **Next** to save your changes, and complete the policy. If the policy is already assigned to users or groups, then these groups receive the policy changes the next time they [sync with the Intune service](device-profile-troubleshoot.md#policy-refresh-intervals). + +## End user experience settings When you create the settings catalog profile in [Step 2 - Create the Platform SSO policy in Intune](#step-2---create-the-platform-sso-policy-in-intune), there are more optional settings that you can configure. @@ -297,10 +361,22 @@ The following settings let you customize the end-user experience and give more g | Platform SSO settings | Possible values | Usage | | --- | --- | --- | | **Account Display Name** | Any string value. | Customize the organization name end users see in the Platform SSO notifications. | -| **Enable Create User At Login** | **Enable** or **Disable**. | Allow any organizational user to sign in to the device using their Microsoft Entra credentials. When creating new local accounts, the provided username and password must be the same as the user's Entra ID UPN (e.g., `user@contoso.com`) and password.| +| **Enable Create User At Login** | **Enable** or **Disable**. | Allow any organizational user to sign in to the device using their Microsoft Entra credentials. When you create new local accounts, the provided username and password must be the same as the user's Microsoft Entra ID UPN (`user@contoso.com`) and password.| | **New User Authorization Mode** | **Standard**, **Admin**, or **Groups** | One-time permissions the user has at sign-in when the account is created using Platform SSO. Currently, **Standard** and **Admin** values are supported. At least one **Admin** user is required on the device before **Standard** mode can be used.| | **User Authorization Mode** | **Standard**, **Admin**, or **Groups** | Persistent permissions the user has at sign-in each time the user authenticates using Platform SSO. Currently, **Standard** and **Admin** values are supported. At least one **Admin** user is required on the device before **Standard** mode can be used.| +## Other MDMs + +You can configure Platform SSO with other mobile device management services (MDMs), if that MDM supports Platform SSO. When using another MDM service, use the following guidance: + +- The settings listed in this article are the Microsoft-recommended settings you should configure. You can copy/paste the setting values from this article in your MDM service policy. + + The configuration steps in your MDM service can be different. We recommend you work with your MDM service vendor to correctly configure and deploy these Platform SSO settings. + +- Device registration with Platform SSO is more secure and uses hardware-bound device certificates. These changes can affect some MDM flows, like integration with [device compliance partners](../protect/device-compliance-partners.md). + + You should talk to your MDM service vendor to understand if the MDM tested Platform SSO, certified that their software works properly with Platform SSO, and is ready to support customers using Platform SSO. + ## Common errors When you configure Platform SSO, you might see the following errors: diff --git a/memdocs/intune/configuration/preference-file-settings-macos.md b/memdocs/intune/configuration/preference-file-settings-macos.md index 7ce27f74787..a94a569f899 100644 --- a/memdocs/intune/configuration/preference-file-settings-macos.md +++ b/memdocs/intune/configuration/preference-file-settings-macos.md @@ -8,7 +8,7 @@ keywords: preference file, property list file, plist, macOS, microsoft intune, e author: MandiOhlinger ms.author: mandia manager: dougeby -ms.date: 01/16/2024 +ms.date: 08/22/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: configuration @@ -37,7 +37,10 @@ This feature applies to: Property list files, also called preference files, include information about your macOS apps. You define app properties or settings that you want to preconfigure. When the file is ready, you can use Intune to deploy the file to your devices and configure the app settings in your file. -Property list files are typically used for web browsers, [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint-mac), and custom apps. +Property list files are typically used for web browsers, like Google Chrome, [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint-mac), and custom apps. + +> [!WARNING] +> There are sample `.plist` files at [ManagedPreferencesApplications examples on GitHub](https://github.com/ProfileCreator/ProfileManifests/tree/master/Manifests/ManagedPreferencesApplications). This GitHub repository is not owned, not maintained, and not created by Microsoft. Use the information at your own risk. > [!TIP] > For Microsoft Edge version 77 and newer, you can use the settings catalog. You don't have to use a preference file. For more information, go to [Settings catalog](settings-catalog.md). @@ -55,16 +58,16 @@ These settings are added to a device configuration profile in Intune, and then a ## What you need to know -- These settings aren't validated. Test your changes before assigning the profile to your devices. -- If you're not sure how to enter an app key, change the setting within the app. Then, review the app's preference file using [Xcode](https://developer.apple.com/xcode/) to see how the setting is configured. +- Test your changes before assigning the profile to your devices. Intune doesn't validate the settings in the property list file. +- Review the app's preference file using [Xcode](https://developer.apple.com/xcode/) to see how the setting is configured. If you're not sure how to enter an app key, change the setting within the app. Then, review the app's preference file using [Xcode](https://developer.apple.com/xcode/). Apple recommends removing nonmanageable settings using Xcode before importing the file. - Only some apps work with managed preferences, and might not allow you to manage all settings. - Be sure you upload property list files that target device channel settings, not user channel settings. Property list files target the entire device. -- If you're configuring the Microsoft Edge version 77 and newer app, then use the [Settings catalog](settings-catalog.md). For a list of the settings you can configure, go to [Microsoft Edge - Policies](/DeployEdge/microsoft-edge-policies) (opens another Microsoft website). +- Use the [Settings catalog](settings-catalog.md) to configure Microsoft Edge version 77 and newer. For a list of the settings you can configure, go to [Microsoft Edge - Policies](/DeployEdge/microsoft-edge-policies) (opens another Microsoft website). - Be sure macOS is listed as a supported platform. If some settings aren't available in the settings catalog, then it's recommended to continue using the preference file. + Be sure macOS is listed as a supported platform. If some settings aren't available in the settings catalog, then use the preference file. ## Create the profile diff --git a/memdocs/intune/configuration/quickstart-email-profile.md b/memdocs/intune/configuration/quickstart-email-profile.md index 0be3acbc914..2b26cd2f000 100644 --- a/memdocs/intune/configuration/quickstart-email-profile.md +++ b/memdocs/intune/configuration/quickstart-email-profile.md @@ -7,7 +7,7 @@ keywords: author: MandiOhlinger ms.author: mandia manager: dougeby -ms.date: 11/09/2023 +ms.date: 08/14/2024 ms.topic: conceptual ms.service: microsoft-intune ms.subservice: configuration @@ -62,7 +62,7 @@ For more information on the different roles in Intune, go to [Role-based access 3. Enter the following properties: - **Platform**: Select **iOS/iPadOS**. - - **Profile type**: Select **Temmplates** > **Email**. + - **Profile type**: Select **Templates** > **Email**. 4. Select **Create**. @@ -87,7 +87,7 @@ For more information on the different roles in Intune, go to [Role-based access 9. In **Scope tags** (optional), select **Next**. In this example, we don't use scope tags. -10. In **Assignments**, use the drop-down for **Assign to** and select **All users and all devices**. Then, select **Next**. +10. In **Assignments**, use the drop-down for **Assign to** and select **All users and all devices**. Then, select **Next**. 11. In **Review + create**, review your settings. When you select **Create**, your changes are saved, and the profile is assigned. diff --git a/memdocs/intune/configuration/settings-catalog-common-features.md b/memdocs/intune/configuration/settings-catalog-common-features.md index 47988859fe2..cb552936d10 100644 --- a/memdocs/intune/configuration/settings-catalog-common-features.md +++ b/memdocs/intune/configuration/settings-catalog-common-features.md @@ -65,7 +65,7 @@ Previously, to configure Google Chrome settings on Windows devices, you created This feature applies to: - Windows 11 -- Windows 10 and later +- Windows 10 You can create a universal print policy, add printers, and then deploy this printer list to your managed users. When the policy is deployed, it automatically installs the printers you added. Users can see these printers, and select a printer from your list. diff --git a/memdocs/intune/configuration/settings-catalog.md b/memdocs/intune/configuration/settings-catalog.md index b6605adffa4..42a54ae1526 100644 --- a/memdocs/intune/configuration/settings-catalog.md +++ b/memdocs/intune/configuration/settings-catalog.md @@ -217,7 +217,8 @@ After you give the new profile a name, you can edit the profile to adjust the se This feature applies to: -- Windows 10 and later +- Windows 11 +- Windows 10 When you create a settings catalog policy, you can export the policy to a `.json` file. You can then import this file to create a new policy. This feature is useful if you want to create a policy that's similar to an existing policy. For example, you export a policy, import it to create a new policy, and then make changes to the new policy. diff --git a/memdocs/intune/configuration/shared-user-device-settings-windows-holographic.md b/memdocs/intune/configuration/shared-user-device-settings-windows-holographic.md index d7b63fbceaa..eae6a90af92 100644 --- a/memdocs/intune/configuration/shared-user-device-settings-windows-holographic.md +++ b/memdocs/intune/configuration/shared-user-device-settings-windows-holographic.md @@ -38,9 +38,9 @@ For more information on this feature in Intune, see [Control access, accounts, a ## Before your begin -- [Create a Windows 10/11 shared multi-user device configuration profile](shared-user-device-settings.md). +- [Create a Windows shared multi-user device configuration profile](shared-user-device-settings.md). -- When you create a Windows 10/11 shared user device configuration profile, there are more settings than what's listed in this article. The settings in this article are supported on Windows Holographic for Business devices. +- When you create a Windows shared user device configuration profile, there are more settings than what's listed in this article. The settings in this article are supported on Windows Holographic for Business devices. ## Shared multi-user device settings diff --git a/memdocs/intune/configuration/shared-user-device-settings-windows.md b/memdocs/intune/configuration/shared-user-device-settings-windows.md index 2a7a6c4635f..fce3c383ddb 100644 --- a/memdocs/intune/configuration/shared-user-device-settings-windows.md +++ b/memdocs/intune/configuration/shared-user-device-settings-windows.md @@ -26,12 +26,12 @@ ms.collection: - M365-identity-device-management --- -# Windows 10/11 and newer settings to manage shared devices using Intune +# Windows 10/11 settings to manage shared devices using Intune > [!NOTE] > [!INCLUDE [not-all-settings-are-documented](../includes/not-all-settings-are-documented.md)] -Windows 10/11 client devices, like the Microsoft Surface, can be used by many users. Devices that have multiple users are called shared devices, and are a part of mobile device management (MDM) solutions. +Windows client devices, like the Microsoft Surface, can be used by many users. Devices that have multiple users are called shared devices, and are a part of mobile device management (MDM) solutions. End users can sign in to these shared devices with a guest account. As they use the device, they only get access to features you allow. As the Intune administrator, you configure access, choose when accounts are deleted, control power management settings, and more for your shared Windows client devices. @@ -41,7 +41,7 @@ For more information on this feature in Intune, go to [Control access, accounts, ## Before your begin -- Create a [Windows 10/11 shared multi-user device configuration profile](shared-user-device-settings.md). +- Create a [Windows shared multi-user device configuration profile](shared-user-device-settings.md). ## Shared multi-user device settings @@ -97,7 +97,7 @@ These settings use the [SharedPC CSP](/windows/client-management/mdm/sharedpc-cs - **Enabled**: Uses the recommended settings for devices used in schools, which are more restrictive. - **Disabled**: The default and recommended education policies aren't used. - For more information on what the education policies do, go to [Windows 10 configuration recommendations for education customers](/education/windows/configure-windows-for-education). + For more information on what the education policies do, go to [Windows configuration recommendations for education customers](/education/windows/configure-windows-for-education). > [!TIP] > [Set up a shared or guest PC](/windows/configuration/set-up-shared-or-guest-pc) (opens another docs web site) is a great resource on this Windows client feature, including concepts and group policies that can be set in shared mode. diff --git a/memdocs/intune/configuration/shared-user-device-settings.md b/memdocs/intune/configuration/shared-user-device-settings.md index 626a63b41bd..78f4dc3b641 100644 --- a/memdocs/intune/configuration/shared-user-device-settings.md +++ b/memdocs/intune/configuration/shared-user-device-settings.md @@ -26,14 +26,7 @@ ms.collection: # Control access, accounts, and power features on shared PC or multi-user Windows devices using Intune -Devices that have multiple users are called shared devices, and are a common part of mobile device management (MDM) solutions. Using Microsoft Intune, you can create and configure shared devices on the following platforms: - -- Windows 10/11 Professional -- Windows 10/11 Enterprise -- Windows Holographic for Business, such as the HoloLens - -> [!TIP] -> For iOS/iPadOS shared devices, go to [shared device solutions for iOS/iPadOS](../enrollment/device-enrollment-shared-ios.md). +Devices that have multiple users are called shared devices, and are a common part of mobile device management (MDM) solutions. Using Microsoft Intune, you can create and configure shared devices. For example, schools have devices that are typically used by many students. School Intune admins can turn on the Shared PC feature to allow one user at a time. Students can't switch between different signed-in accounts on the device. When the student signs out, you also choose to remove all user-specific settings. @@ -55,6 +48,15 @@ This article shows you how to create a shared multi-user device configuration pr When you create the profile in Intune, you deploy or assign the profile to device groups in your organization. You can also assign this profile to device groups with mixed device types and operating system (OS) versions. +This feature applies to: + +- Windows 10/11 Professional +- Windows 10/11 Enterprise +- Windows Holographic for Business, such as the HoloLens + +> [!TIP] +> For iOS/iPadOS shared devices, go to [shared device solutions for iOS/iPadOS](../enrollment/device-enrollment-shared-ios.md). + ## Prerequisites - To create the policy, at a minimum, sign in with an account that has the **Policy and Profile Manager** Intune role. For more information, go to [Role-based access control (RBAC) with Microsoft Intune](../fundamentals/role-based-access-control.md). diff --git a/memdocs/intune/configuration/tutorial-walkthrough-administrative-templates.md b/memdocs/intune/configuration/tutorial-walkthrough-administrative-templates.md index 83ba88e20d9..d83515a4c24 100644 --- a/memdocs/intune/configuration/tutorial-walkthrough-administrative-templates.md +++ b/memdocs/intune/configuration/tutorial-walkthrough-administrative-templates.md @@ -32,7 +32,7 @@ ms.collection: #Customer intent: As an administrator, I want learn and use ADMX templates in the cloud so that I can control and manage Office, Windows, and Microsoft Edge settings on Windows 10/11 devices. --- -# Walkthrough: Use the cloud to configure group policy on Windows 10/11 devices with ADMX templates and Microsoft Intune +# Walkthrough: Use the cloud to configure group policy on Windows client devices with ADMX templates and Microsoft Intune > [!NOTE] > This walkthrough was created as a technical workshop for Microsoft Ignite. It has more prerequisites than typical walkthroughs, as it compares using and configuring ADMX policies in Intune and on-premises. @@ -40,7 +40,7 @@ ms.collection: Group policy administrative templates, also known as ADMX templates, include settings you can configure on Windows client devices, including PCs. The ADMX template settings are available by different services. These settings are used by Mobile Device Management (MDM) providers, including Microsoft Intune. For example, you can turn on Design Ideas in PowerPoint, set a home page in Microsoft Edge, and more. > [!TIP] -> For an overview of ADMX templates in Intune, including the ADMX templates built-in to Intune, go to [Use Windows 10/11 ADMX templates in Microsoft Intune](administrative-templates-windows.md). +> For an overview of ADMX templates in Intune, including the ADMX templates built-in to Intune, go to [Use Windows ADMX templates in Microsoft Intune](administrative-templates-windows.md). For more information on ADMX policies, go to [Understanding ADMX-backed policies](/windows/client-management/mdm/understanding-admx-backed-policies). diff --git a/memdocs/intune/configuration/use-enterprise-sso-plug-in-ios-ipados-macos.md b/memdocs/intune/configuration/use-enterprise-sso-plug-in-ios-ipados-macos.md index f29f466c2fa..6cac8938c85 100644 --- a/memdocs/intune/configuration/use-enterprise-sso-plug-in-ios-ipados-macos.md +++ b/memdocs/intune/configuration/use-enterprise-sso-plug-in-ios-ipados-macos.md @@ -32,7 +32,7 @@ zone_pivot_groups: apple-enterprise-sso Apple devices can use single sign-on (SSO) to access devices, apps, and websites using their Microsoft Entra ID. SSO lets users sign in and get access without entering their credentials each time. -This article applies to: +This feature applies to: - iOS/iPadOS - macOS diff --git a/memdocs/intune/configuration/use-enterprise-sso-plug-in-ios-ipados-with-intune.md b/memdocs/intune/configuration/use-enterprise-sso-plug-in-ios-ipados-with-intune.md index 65ed11126b6..ee1ba6e7981 100644 --- a/memdocs/intune/configuration/use-enterprise-sso-plug-in-ios-ipados-with-intune.md +++ b/memdocs/intune/configuration/use-enterprise-sso-plug-in-ios-ipados-with-intune.md @@ -31,7 +31,7 @@ ms.collection: [!INCLUDE [Apple SSO Boilerplate](../includes/apple-enterprise-sso-intro-boilerplate.md)] -This article applies to: +This feature applies to: - iOS/iPadOS diff --git a/memdocs/intune/configuration/use-enterprise-sso-plug-in-macos-with-intune.md b/memdocs/intune/configuration/use-enterprise-sso-plug-in-macos-with-intune.md index 297b3b20aa1..094ba841f79 100644 --- a/memdocs/intune/configuration/use-enterprise-sso-plug-in-macos-with-intune.md +++ b/memdocs/intune/configuration/use-enterprise-sso-plug-in-macos-with-intune.md @@ -31,11 +31,11 @@ ms.collection: [!INCLUDE [Apple SSO Boilerplate](../includes/apple-enterprise-sso-intro-boilerplate.md)] -This article applies to: +This feature applies to: - macOS - For iOS/iPadOS, go to [Use the Microsoft Enterprise SSO plug-in on iOS/iPadOS devices](use-enterprise-sso-plug-in-ios-ipados-with-intune.md). + For iOS/iPadOS, go to [Use the Microsoft Enterprise SSO plug-in on iOS/iPadOS devices](use-enterprise-sso-plug-in-ios-ipados-with-intune.md). On macOS devices, you can configure SSO app extension settings in two places in Intune: diff --git a/memdocs/intune/configuration/vpn-settings-android-enterprise.md b/memdocs/intune/configuration/vpn-settings-android-enterprise.md index 971bd3b6a22..493e5b6ee74 100644 --- a/memdocs/intune/configuration/vpn-settings-android-enterprise.md +++ b/memdocs/intune/configuration/vpn-settings-android-enterprise.md @@ -170,6 +170,6 @@ For more information, see [Use a VPN and per-app VPN policy on Android Enterpris - [Assign the profile](device-profile-assign.md) and [monitor its status](device-profile-monitor.md). -- Create VPN profiles for [Android device administrator](vpn-settings-android.md), [iOS/iPadOS](vpn-settings-ios.md), [macOS](vpn-settings-macos.md), and [Windows 10 and later](vpn-settings-windows-10.md). +- Create VPN profiles for [Android device administrator](vpn-settings-android.md), [iOS/iPadOS](vpn-settings-ios.md), [macOS](vpn-settings-macos.md), and [Windows](vpn-settings-windows-10.md). - Learn how to [Troubleshoot VPN profile issues in Microsoft Intune](/troubleshoot/mem/intune/device-configuration/troubleshoot-vpn-profiles). diff --git a/memdocs/intune/configuration/vpn-settings-android.md b/memdocs/intune/configuration/vpn-settings-android.md index d0ed199ad02..8cf5c8871bc 100644 --- a/memdocs/intune/configuration/vpn-settings-android.md +++ b/memdocs/intune/configuration/vpn-settings-android.md @@ -74,4 +74,4 @@ As an Intune administrator, you can create and assign VPN settings to Android de - [Assign the profile](device-profile-assign.md) and [monitor its status](device-profile-monitor.md). -- Create VPN profiles for [Android Enterprise](vpn-settings-android-enterprise.md), [iOS/iPadOS](vpn-settings-ios.md), [macOS](vpn-settings-macos.md), and [Windows 10 and later](vpn-settings-windows-10.md). +- Create VPN profiles for [Android Enterprise](vpn-settings-android-enterprise.md), [iOS/iPadOS](vpn-settings-ios.md), [macOS](vpn-settings-macos.md), and [Windows](vpn-settings-windows-10.md). diff --git a/memdocs/intune/configuration/vpn-settings-ios.md b/memdocs/intune/configuration/vpn-settings-ios.md index 21f34c8628e..62153272f31 100644 --- a/memdocs/intune/configuration/vpn-settings-ios.md +++ b/memdocs/intune/configuration/vpn-settings-ios.md @@ -414,4 +414,4 @@ If you use a proxy, then configure the following settings. The profile is created, but may not be doing anything yet. Be sure to [assign the profile](device-profile-assign.md) and [monitor its status](device-profile-monitor.md). -Configure VPN settings on [Android](vpn-settings-android.md), [Android Enterprise](vpn-settings-android-enterprise.md), [macOS](vpn-settings-macos.md), and [Windows 10](vpn-settings-windows-10.md) devices. +Configure VPN settings on [Android](vpn-settings-android.md), [Android Enterprise](vpn-settings-android-enterprise.md), [macOS](vpn-settings-macos.md), and [Windows](vpn-settings-windows-10.md) devices. diff --git a/memdocs/intune/configuration/vpn-settings-macos.md b/memdocs/intune/configuration/vpn-settings-macos.md index 14f6e2c7879..f2391ab5732 100644 --- a/memdocs/intune/configuration/vpn-settings-macos.md +++ b/memdocs/intune/configuration/vpn-settings-macos.md @@ -134,4 +134,4 @@ Select the **type of automatic VPN** you want. Your options: - [Assign the profile](device-profile-assign.md) and [monitor its status](device-profile-monitor.md). -- Configure VPN settings on [Android](vpn-settings-android.md), [Android Enterprise](vpn-settings-android-enterprise.md), [iOS/iPadOS](vpn-settings-ios.md), and [Windows 10](vpn-settings-windows-10.md) devices. +- Configure VPN settings on [Android](vpn-settings-android.md), [Android Enterprise](vpn-settings-android-enterprise.md), [iOS/iPadOS](vpn-settings-ios.md), and [Windows](vpn-settings-windows-10.md) devices. diff --git a/memdocs/intune/configuration/vpn-settings-windows-8-1.md b/memdocs/intune/configuration/vpn-settings-windows-8-1.md index fe59b5568f0..32ba5dd1d64 100644 --- a/memdocs/intune/configuration/vpn-settings-windows-8-1.md +++ b/memdocs/intune/configuration/vpn-settings-windows-8-1.md @@ -109,4 +109,4 @@ Depending on the settings you choose, not all values in the following list are c - [Assign the profile](device-profile-assign.md), and [monitor its status](device-profile-monitor.md). -- Configure VPN settings on [Android](vpn-settings-android.md), [Android Enterprise](vpn-settings-android-enterprise.md), [macOS](vpn-settings-macos.md), and [Windows 10/11](vpn-settings-windows-10.md) devices. +- Configure VPN settings on [Android](vpn-settings-android.md), [Android Enterprise](vpn-settings-android-enterprise.md), [macOS](vpn-settings-macos.md), and [Windows](vpn-settings-windows-10.md) devices. diff --git a/memdocs/intune/configuration/wi-fi-settings-android-aosp.md b/memdocs/intune/configuration/wi-fi-settings-android-aosp.md index e6eca6cf507..34822016269 100644 --- a/memdocs/intune/configuration/wi-fi-settings-android-aosp.md +++ b/memdocs/intune/configuration/wi-fi-settings-android-aosp.md @@ -43,7 +43,7 @@ For more information on AOSP, go to [Android Open Source Project](https://source ## Before you begin -Create an [Android (AOSP) device configuration profile](wi-fi-settings-configure.md). +- Create an [Android (AOSP) device configuration profile](wi-fi-settings-configure.md). ## Basic @@ -173,6 +173,6 @@ Create an [Android (AOSP) device configuration profile](wi-fi-settings-configure The profile is created, but might not be doing anything. Be sure to [assign this profile](device-profile-assign.md) and [monitor its status.](device-profile-monitor.md). -You can also create Wi-Fi profiles for [Android Enterprise](wi-fi-settings-android-enterprise.md), [iOS/iPadOS](wi-fi-settings-ios.md), [macOS](wi-fi-settings-macos.md), and [Windows 10/11](wi-fi-settings-windows.md). +You can also create Wi-Fi profiles for [Android Enterprise](wi-fi-settings-android-enterprise.md), [iOS/iPadOS](wi-fi-settings-ios.md), [macOS](wi-fi-settings-macos.md), and [Windows](wi-fi-settings-windows.md). [Troubleshoot common issues with Wi-Fi profiles](/troubleshoot/mem/intune/troubleshoot-wi-fi-profiles#common-issues). diff --git a/memdocs/intune/configuration/wi-fi-settings-android-enterprise.md b/memdocs/intune/configuration/wi-fi-settings-android-enterprise.md index 7099467be13..c4fd01fe79d 100644 --- a/memdocs/intune/configuration/wi-fi-settings-android-enterprise.md +++ b/memdocs/intune/configuration/wi-fi-settings-android-enterprise.md @@ -320,6 +320,6 @@ Select this option if you're deploying to an Android Enterprise dedicated, corpo - The profile is created, but might not be doing anything. Be sure to [assign this profile](device-profile-assign.md) and [monitor its status](device-profile-monitor.md). -- You can also create Wi-Fi profiles for [Android](wi-fi-settings-android.md), [iOS/iPadOS](wi-fi-settings-ios.md), [macOS](wi-fi-settings-macos.md), and [Windows 10](wi-fi-settings-windows.md). +- You can also create Wi-Fi profiles for [Android](wi-fi-settings-android.md), [iOS/iPadOS](wi-fi-settings-ios.md), [macOS](wi-fi-settings-macos.md), and [Windows](wi-fi-settings-windows.md). - [Troubleshoot common issues with Wi-Fi profiles](/troubleshoot/mem/intune/troubleshoot-wi-fi-profiles#common-issues). diff --git a/memdocs/intune/configuration/wi-fi-settings-android.md b/memdocs/intune/configuration/wi-fi-settings-android.md index f43e2e9fef8..43e4c4d31d9 100644 --- a/memdocs/intune/configuration/wi-fi-settings-android.md +++ b/memdocs/intune/configuration/wi-fi-settings-android.md @@ -39,12 +39,11 @@ This feature applies to: These Wi-Fi settings are separated in to two categories: Basic settings and Enterprise-level settings. This article describes these settings. - - [!INCLUDE [android_device_administrator_support](../includes/android-device-administrator-support.md)] +[!INCLUDE [android_device_administrator_support](../includes/android-device-administrator-support.md)] ## Before you begin -Create an [Android device administrator Wi-Fi device configuration profile](wi-fi-settings-configure.md). +- Create an [Android device administrator Wi-Fi device configuration profile](wi-fi-settings-configure.md). ## Basic diff --git a/memdocs/intune/configuration/wi-fi-settings-ios.md b/memdocs/intune/configuration/wi-fi-settings-ios.md index 46c074dd0ef..5bfa05bcde7 100644 --- a/memdocs/intune/configuration/wi-fi-settings-ios.md +++ b/memdocs/intune/configuration/wi-fi-settings-ios.md @@ -175,4 +175,4 @@ This article describes the settings you can configure. - Be sure to [assign this profile](device-profile-assign.md) and [monitor its status](device-profile-monitor.md). -- Configure Wi-Fi settings on [Android](wi-fi-settings-android.md), [Android Enterprise](wi-fi-settings-android-enterprise.md), [macOS](wi-fi-settings-macos.md), and [Windows 10](wi-fi-settings-windows.md) devices. +- Configure Wi-Fi settings on [Android](wi-fi-settings-android.md), [Android Enterprise](wi-fi-settings-android-enterprise.md), [macOS](wi-fi-settings-macos.md), and [Windows](wi-fi-settings-windows.md) devices. diff --git a/memdocs/intune/configuration/wi-fi-settings-macos.md b/memdocs/intune/configuration/wi-fi-settings-macos.md index 926aa8e81ff..03de0653506 100644 --- a/memdocs/intune/configuration/wi-fi-settings-macos.md +++ b/memdocs/intune/configuration/wi-fi-settings-macos.md @@ -138,4 +138,4 @@ Enterprise profiles use Extensible Authentication Protocol (EAP) to authenticate ## Related articles - Be sure to [assign the profile](device-profile-assign.md) and [monitor its status](device-profile-monitor.md). -- Configure Wi-Fi settings on [Android](wi-fi-settings-android.md), [Android Enterprise](wi-fi-settings-android-enterprise.md), [iOS/iPadOS](wi-fi-settings-ios.md), and [Windows 10](wi-fi-settings-windows.md) devices. +- Configure Wi-Fi settings on [Android](wi-fi-settings-android.md), [Android Enterprise](wi-fi-settings-android-enterprise.md), [iOS/iPadOS](wi-fi-settings-ios.md), and [Windows](wi-fi-settings-windows.md) devices. diff --git a/memdocs/intune/configuration/windows-health-monitoring.md b/memdocs/intune/configuration/windows-health-monitoring.md index 5bf1b534761..472c4c9fd90 100644 --- a/memdocs/intune/configuration/windows-health-monitoring.md +++ b/memdocs/intune/configuration/windows-health-monitoring.md @@ -53,7 +53,7 @@ This article shows you how to create the profile, and enable the monitoring. 2. Select **Devices** > **Manage devices** > **Configuration** > **Create** > **New policy**. 3. Enter the following properties: - - **Platform**: Choose **Windows 10 and later**. + - **Platform**: Select **Windows 10 and later**. - **Profile type**: Select **Templates** > **Windows health monitoring**. > [!NOTE] diff --git a/memdocs/intune/configuration/wired-network-settings-windows.md b/memdocs/intune/configuration/wired-network-settings-windows.md index 0bf84b35dbf..f7eefd27989 100644 --- a/memdocs/intune/configuration/wired-network-settings-windows.md +++ b/memdocs/intune/configuration/wired-network-settings-windows.md @@ -34,6 +34,11 @@ You can create a profile with specific wired network settings, and then deploy t This article describes the settings you can configure. +This feature applies to: + +- Windows 11 +- Windows 10 + ## Before you begin - Create a [wired network device configuration profile](wired-networks-configure.md). diff --git a/memdocs/intune/copilot/media/security-copilot/security-copilot-prompts-icon.png b/memdocs/intune/copilot/media/security-copilot/security-copilot-prompts-icon.png deleted file mode 100644 index ecc10add959..00000000000 Binary files a/memdocs/intune/copilot/media/security-copilot/security-copilot-prompts-icon.png and /dev/null differ diff --git a/memdocs/intune/developer/app-sdk-android-appendix.md b/memdocs/intune/developer/app-sdk-android-appendix.md index ae60029ee7d..f98cc8d9d2e 100644 --- a/memdocs/intune/developer/app-sdk-android-appendix.md +++ b/memdocs/intune/developer/app-sdk-android-appendix.md @@ -7,7 +7,7 @@ keywords: SDK author: Erikre ms.author: erikre manager: dougeby -ms.date: 09/29/2023 +ms.date: 08/08/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: developer diff --git a/memdocs/intune/developer/app-sdk-android-phase6.md b/memdocs/intune/developer/app-sdk-android-phase6.md index 81908a30b33..e734b7b0b64 100644 --- a/memdocs/intune/developer/app-sdk-android-phase6.md +++ b/memdocs/intune/developer/app-sdk-android-phase6.md @@ -7,7 +7,7 @@ keywords: SDK author: Erikre ms.author: erikre manager: dougeby -ms.date: 10/06/2023 +ms.date: 08/08/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: developer diff --git a/memdocs/intune/developer/app-sdk-xamarin.md b/memdocs/intune/developer/app-sdk-xamarin.md index 28a1c03289b..4375c08aaa2 100644 --- a/memdocs/intune/developer/app-sdk-xamarin.md +++ b/memdocs/intune/developer/app-sdk-xamarin.md @@ -117,11 +117,6 @@ for more information. ```csharp string enrolledAccount = IntuneMAMEnrollmentManager.Instance.EnrolledAccount; ``` -### Sample Applications -Sample applications highlighting MAM functionality in Xamarin.iOS apps are available on [GitHub](https://github.com/msintuneappsdk/sample-intune-xamarin-ios). - -> [!NOTE] -> There is no remapper for iOS/iPadOS. Integrating into a Xamarin.Forms app should be the same as for a regular Xamarin.iOS project. ## Enabling Intune app protection policies in your Android mobile app 1. Add the [Microsoft.Intune.MAM.Xamarin.Android NuGet package](https://www.nuget.org/packages/Microsoft.Intune.MAM.Xamarin.Android) to your Xamarin.Android project. @@ -245,8 +240,5 @@ The Intune SDK Xamarin Bindings rely on the presence of the [Company Portal](htt For app protection without device enrollment, the user is _**not**_ required to enroll the device by using the Company Portal app. -### Sample Applications -Sample applications highlighting MAM functionality in Xamarin.Android and Xamarin.Forms apps are available on [GitHub](https://github.com/msintuneappsdk/Taskr-Sample-Intune-Xamarin-Android-Apps). - ## Support If your organization is an existing Intune customer, please work with your Microsoft support representative to open a support ticket and create an issue on the GitHub issues page. We will help as soon as we can. diff --git a/memdocs/intune/developer/app-wrapper-prepare-ios.md b/memdocs/intune/developer/app-wrapper-prepare-ios.md index 09038191129..6245ecaa6bd 100644 --- a/memdocs/intune/developer/app-wrapper-prepare-ios.md +++ b/memdocs/intune/developer/app-wrapper-prepare-ios.md @@ -7,7 +7,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 08/22/2023 +ms.date: 08/08/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: developer diff --git a/memdocs/intune/developer/intune-graph-apis.md b/memdocs/intune/developer/intune-graph-apis.md index 97f3c1d25e2..8afd18874ac 100644 --- a/memdocs/intune/developer/intune-graph-apis.md +++ b/memdocs/intune/developer/intune-graph-apis.md @@ -497,13 +497,13 @@ To invite the user to be a guest of your tenant: This sends an invite to the user. - A sample guest invitation + A sample guest invitation The user needs to choose the **Get Started** link to accept your invitation. When the relationship is established (or your invitation has been accepted), add the user account to the **Directory role**. -Remember to add the user to other roles as needed. For example, to allow the user to manage Intune settings, they need to be either a **Global Administrator** or an **Intune Service administrator**. +Remember to add the user to other roles as needed. For example, to allow the user to manage Intune settings, they need to be at least an **Intune Service administrator**. Also: diff --git a/memdocs/intune/developer/media/app-sdk-ios/intune-app-sdk-ios-copy-bundle-resources.png b/memdocs/intune/developer/media/app-sdk-ios/intune-app-sdk-ios-copy-bundle-resources.png deleted file mode 100644 index cff5d7e8d4e..00000000000 Binary files a/memdocs/intune/developer/media/app-sdk-ios/intune-app-sdk-ios-copy-bundle-resources.png and /dev/null differ diff --git a/memdocs/intune/developer/media/app-sdk-ios/intune-app-sdk-ios-weak-link-apple-archive.png.png b/memdocs/intune/developer/media/app-sdk-ios/intune-app-sdk-ios-weak-link-apple-archive.png.png deleted file mode 100644 index 516376691a2..00000000000 Binary files a/memdocs/intune/developer/media/app-sdk-ios/intune-app-sdk-ios-weak-link-apple-archive.png.png and /dev/null differ diff --git a/memdocs/intune/enrollment/android-aosp-corporate-owned-user-associated-enroll.md b/memdocs/intune/enrollment/android-aosp-corporate-owned-user-associated-enroll.md index 36ca6cb5e43..f3004c1b6a4 100644 --- a/memdocs/intune/enrollment/android-aosp-corporate-owned-user-associated-enroll.md +++ b/memdocs/intune/enrollment/android-aosp-corporate-owned-user-associated-enroll.md @@ -88,8 +88,10 @@ To view the token as a QR code, select your enrollment profile from the enrollme You can also export the enrollment profile JSON file. To create a JSON file, select Export**. > [!IMPORTANT] ->- The QR code will contain any credentials provided in the profile in plain text to allow the device to successfully authenticate with the network. This is required as the user will not be able to join a network from the device. ->- On RealWear devices, you should skip the first time setup. The Intune QR codes is the only thing you need to set up the device. +>- The QR code will contain any credentials provided in the profile in plain text to allow the device to successfully authenticate with the network. This is required as the user will not be able to join a network from the device. +>- Consider using a staging network with limited permissions for provisioning devices and completing the enrollment process. For example, you could use an internet-connected network with limited permissions and no corporate access to do the initial set up. +>- On RealWear devices, you should skip the first time setup. The Intune QR code is the only thing you need to set up the device. + ### Replace a token You can generate a new token to replace one that's nearing its expiration date. The replacement token doesn't affect devices that are already enrolled. diff --git a/memdocs/intune/enrollment/android-aosp-corporate-owned-userless-enroll.md b/memdocs/intune/enrollment/android-aosp-corporate-owned-userless-enroll.md index 6c279af929c..e8b7e943aac 100644 --- a/memdocs/intune/enrollment/android-aosp-corporate-owned-userless-enroll.md +++ b/memdocs/intune/enrollment/android-aosp-corporate-owned-userless-enroll.md @@ -116,6 +116,7 @@ You can also export the enrollment profile JSON file. To create a JSON file: > [!IMPORTANT] >- The QR code will contain any credentials provided in the profile in plain text to allow the device to successfully authenticate with the network. This is required as the user will not be able to join a network from the device. +>- Consider using a staging network with limited permissions for provisioning devices and completing the enrollment process. For example, you could use an internet-connected network with limited permissions and no corporate access to do the initial set up. >- Since you're managing the device via Intune, you should skip the RealWear first time setup. The Intune QR codes is the only thing you need to set up the device. ### Replace token diff --git a/memdocs/intune/enrollment/android-dedicated-devices-fully-managed-enroll.md b/memdocs/intune/enrollment/android-dedicated-devices-fully-managed-enroll.md index 78c3d7f2f74..2be5a0094cb 100644 --- a/memdocs/intune/enrollment/android-dedicated-devices-fully-managed-enroll.md +++ b/memdocs/intune/enrollment/android-dedicated-devices-fully-managed-enroll.md @@ -91,7 +91,7 @@ admin. 3. Select your role from the list. 4. Select **Properties**. 5. Go to **Permissions** and then select **Edit**. -6. Select **Android for Work**. +6. Select **Android Enterprise**. 7. Next to **Update app sync**, select **Yes**. 8. Select **Review + save** to review your changes. 9. Select **Save**. @@ -108,11 +108,11 @@ Verify that enrollment is enabled for corporate-owned, fully managed devices. Link a zero-touch account with your Microsoft Intune account. 1. In the [admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Devices** > **By platform** > **Android**. -2. Select **Android enrollment**. +2. Select **Device onboarding** > **Enrollment**. 3. Under **Bulk enrollment methods**, choose **Zero-touch enrollment**. 4. The iframe opens. Select **Next** to begin setup. 5. Sign in with the Google account you provided to your reseller. -6 Select the zero-touch account you want to link, and then select **Link**. +6. Select the zero-touch account you want to link, and then select **Link**. 7. A default configuration is created. A screen appears with basic information about the configuration. Intune will automatically apply the default configuration to any zero-touch enabled device that's without an existing configuration. > [!CAUTION] @@ -160,9 +160,12 @@ For corporate-owned work profile (COPE) devices, the NFC enrollment method is on ## Enroll by using a token We recommend this method for new or factory-reset devices, in scenarios where the QR code or NFC method aren't available. It requires the person provisioning the device to type in the enrollment token string (example: `12345`) that they're provided. When you're ready for enrollment, share the token directly with targeted users or post it to your organization's support site for easy retrieval. The token works for all Intune-licensed users and doesn't expire. -This method is supported on corporate-owned devices running Android 8.0 and later. It isn't supported with device enrollment manager accounts. +This method is supported on corporate-owned devices running Android 8.0 and later. It isn't supported on: -You can use this method in conjunction with the Microsoft Intune DPC identifier to set up fully managed devices. The DPC identifier method isn't supported on corporate-owned, personally enabled (COPE) devices running Android 11 and later. +* Corporate-owned, personally enabled (COPE) devices running Android 11 and later. +* Devices enrolled via device enrollment manager accounts. + +You can use this method in conjunction with the Microsoft Intune DPC identifier to set up fully managed devices. 1. Turn on the device. 2. On the **Welcome** screen, select your language. diff --git a/memdocs/intune/enrollment/apple-account-driven-user-enrollment.md b/memdocs/intune/enrollment/apple-account-driven-user-enrollment.md index f3f1649505d..90e0bf05376 100644 --- a/memdocs/intune/enrollment/apple-account-driven-user-enrollment.md +++ b/memdocs/intune/enrollment/apple-account-driven-user-enrollment.md @@ -8,7 +8,7 @@ keywords: author: Lenewsad ms.author: lanewsad manager: dougeby -ms.date: 07/18/2024 +ms.date: 09/09/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: enrollment @@ -32,9 +32,6 @@ ms.collection: # Set up account driven Apple User Enrollment -> [!IMPORTANT] -> This feature is in public preview. For more information, see [Public preview in Microsoft Intune](../fundamentals/public-preview.md). - Set up account driven Apple User Enrollment for personal devices enrolling in Microsoft Intune. Account driven user enrollment provides a faster and more user-friendly enrollment experience than [user enrollment with Company Portal](apple-user-enrollment-with-company-portal.md). The device user initiates enrollment by signing into their work account in the Settings app. After the user approves device management, the enrollment profile silently installs and Intune policies are applied. Intune uses just-in-time registration and the Microsoft Authenticator app for authentication to reduce the number of times users have to sign in during enrollment and when accessing work apps. This article describes how to set up account driven Apple User Enrollment in Microsoft Intune. You will: @@ -87,8 +84,6 @@ Deploy the web app version of the Intune Company Portal website so that users ha Apple User Enrollment requires you to create and provide managed Apple IDs to enrolling users. If you enable federated authentication, which consists of linking Apple Business Manager with Microsoft Entra ID, you don't have to create and provide unique Apple IDs to each user. Instead, a device user can sign in to their apps with the same credentials they use for their work account. For more information, see [Intro to federated authentication with Apple Business Manager](https://support.apple.com/guide/apple-business-manager/intro-to-federated-authentication-axmb19317543/1/web/1) in the Apple Business Manager User Guide. ## Step 1: Set up just in time registration and assign Microsoft Authenticator -> [!IMPORTANT] -> This feature is in public preview. For more information, see [Public preview in Microsoft Intune](../fundamentals/public-preview.md). Configure just-in-time registration and assign Microsoft Authenticator as a required app. For steps, see [Set up JIT registration in Intune](set-up-just-in-time-registration.md). Return to this article when you're done so you can continue to the next step. diff --git a/memdocs/intune/enrollment/apple-school-manager-set-up-ios.md b/memdocs/intune/enrollment/apple-school-manager-set-up-ios.md index 3834c0971a3..812b2fd0bcd 100644 --- a/memdocs/intune/enrollment/apple-school-manager-set-up-ios.md +++ b/memdocs/intune/enrollment/apple-school-manager-set-up-ios.md @@ -180,3 +180,6 @@ Apple School Manager devices managed by Intune must be assigned an enrollment pr ## Distribute devices to users You have enabled management and syncing between Apple and Intune, and assigned a profile to let your Apple School devices enroll. You can now distribute devices to users. When an iOS/iPadOS Apple School Manager device is turned on, it's enrolled for management by Intune. Profiles can't be applied to activated devices currently in use until the device is wiped. + +## Connect School Data Sync +Microsoft Education is transitioning to a new School Data Sync (SDS) experience with enhanced features, starting August 2024 for the Northern Hemisphere and January 2025 for the Southern Hemisphere. The current Apple School Manager support will be retired by December 31, 2024. This new experience offers various enhancements over SDS (Classic) including decoupled data ingestion, faster syncs with fewer errors, support for larger organizations, and a modern user interface. If you have further questions, please contact Microsoft Education support with questions regarding the transition to the new School Data Sync experience. diff --git a/memdocs/intune/enrollment/apple-user-enrollment-with-company-portal.md b/memdocs/intune/enrollment/apple-user-enrollment-with-company-portal.md index 9e3856840f0..2ceb990673d 100644 --- a/memdocs/intune/enrollment/apple-user-enrollment-with-company-portal.md +++ b/memdocs/intune/enrollment/apple-user-enrollment-with-company-portal.md @@ -32,6 +32,9 @@ ms.collection: # Set up user enrollment with Company Portal +>[!NOTE] +> Microsoft Intune doesn't support this enrollment profile type for newly enrolled devices. This article is only applicable to existing devices with this profile type. We recommend [account-driven user enrollment](apple-account-driven-user-enrollment.md) for new enrollments. + Set up user enrollment with Company Portal for iOS/iPadOS personal devices enrolling in Microsoft Intune. This Apple User Enrollment method gives you access to a limited but appropriate set of device management settings and actions, so you can protect work data without affecting the device user's personal data or apps. When the device owner attempts to sign into an app with their work or school account, Intune prompts them to enroll their device and provides instructions for next steps. The device user authenticates and initiates enrollment by signing into the Intune Company Portal app. From there, they're redirected to Safari and the device settings app, where they download and install the enrollment profile. diff --git a/memdocs/intune/enrollment/backup-restore-ios.md b/memdocs/intune/enrollment/backup-restore-ios.md index 2f9dff1fb95..636ddfe631c 100644 --- a/memdocs/intune/enrollment/backup-restore-ios.md +++ b/memdocs/intune/enrollment/backup-restore-ios.md @@ -8,7 +8,7 @@ keywords: author: Lenewsad ms.author: lanewsad manager: dougeby -ms.date: 01/12/2024 +ms.date: 08/28/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: enrollment @@ -99,6 +99,9 @@ Other details to consider when migrating a device without wiping it: * The Apple Activation Lock bypass code is only generated when the device is erased, so Activation Lock can't be managed on these devices once they migrate MDM vendors. * The new Intune management profile can't be *locked*, meaning the user must be able to remove the management profile via device settings. +>[!NOTE] +> After a device completes the Setup Assistant phase of the automated device enrollment process, we don't recommend restoring a backup on the device if the backup is from a time when the device was unmanaged. Doing so could affect the current management state of the device. + ### Corporate identifiers Devices enroll into Intune as personal devices, rather than corporate-owned devices. This condition has an impact on the device details, such as app inventory and phone number, gathered from the device. For more information that you can share with end users about what's visible on enrolled devices, see [What can my organization see on my enrolled device?](../user-help/what-info-can-your-company-see-when-you-enroll-your-device-in-intune.md) diff --git a/memdocs/intune/enrollment/connect-intune-android-enterprise.md b/memdocs/intune/enrollment/connect-intune-android-enterprise.md index 7760a78b779..d65a9f4aad8 100644 --- a/memdocs/intune/enrollment/connect-intune-android-enterprise.md +++ b/memdocs/intune/enrollment/connect-intune-android-enterprise.md @@ -1,14 +1,14 @@ --- # required metadata -title: Connect Intune account to Managed Google Play account +title: Connect Intune account to managed Google Play account titleSuffix: Microsoft Intune description: Learn how to connect your Intune account to your Managed Google Play account. keywords: author: Lenewsad ms.author: lanewsad manager: dougeby -ms.date: 07/24/2024 +ms.date: 08/21/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: enrollment @@ -31,7 +31,7 @@ ms.collection: - highpri --- -# Connect your Intune account to your Managed Google Play account +# Connect your Intune account to your managed Google Play account To manage Intune-enrolled devices with any of the supported Android Enterprise management options, you must connect your Microsoft Intune tenant to your managed Google Play account. Available management options include: @@ -51,46 +51,46 @@ This article describes how to link your accounts in the Microsoft Intune admin c ## Before you begin >[!IMPORTANT] -> Beginning July 2024, we recommend using your Microsoft Entra account to connect to Google Play. As a result of recent changes made by Google, you can now link your Microsoft Entra identity account to a Google account, instead of using a personal Gmail account. For more information about these changes, see [Google blog: How we’re making Android Enterprise signup and access to Google services better](https://blog.google/products/android-enterprise/android-enterprise-signup-google-services/). Current Microsoft Intune tenants who have already associated a personal Gmail account with Intune will continue to be supported. +> As of August 2024, you can link your Microsoft Entra identity account to a Google account, instead of using an enterprise Gmail account. We recommend using your Microsoft Entra account to connect to Google Play. For more information about this change, see [Google blog: How we’re making Android Enterprise signup and access to Google services better](https://blog.google/products/android-enterprise/android-enterprise-signup-google-services/). Current Microsoft Intune tenants who have already associated a Gmail account with Intune will continue to be supported. -- Confirm Android Enterprise availability in your country or region. For more information, see [Is Android Enterprise available in my country?](https://support.google.com/work/android/answer/6270910) -- Confirm the Microsoft Entra account you want to use. This account is used to manage the Google Admin account and associated subscriptions, and will be associated with all Android Enterprise management tasks under your Microsoft Intune tenant. +- Confirm Android Enterprise availability in your country or region. For more information, see [Is Android Enterprise available in my country?](https://support.google.com/work/android/answer/6270910). +- Confirm the Microsoft Entra account you want to use. This account is used to manage the Google Admin account and associated subscriptions, and will be associated with all Android Enterprise management tasks in your Microsoft Intune tenant. - Confirm that the Microsoft Entra account has a mailbox set up so that you can complete the validation process required by Google. ## Connect accounts > [!TIP] -> Due to interaction between Google and Microsoft domains, this process may require you to adjust your browser settings. Make sure that `portal.azure.com`, `play.google.com`, and `enterprise.google.com` are in the same security zone in your browser. +> Due to interaction between Google and Microsoft domains, you might need to adjust your browser settings to complete this process. Make sure that `portal.azure.com`, `play.google.com`, and `enterprise.google.com` are in the same security zone in your browser. Complete these steps to enable Android Enterprise management options in Microsoft Intune. 1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). 2. Go to **Devices** > **Enrollment**. 3. Select the **Android** tab. -4. Under **Prerequisites**, choose **Managed Google Play**. If you're using a custom Intune admin role, access to this option requires organization *read* and *update* permissions. +4. Under **Prerequisites**, choose **Managed Google Play**. If you're using a custom Intune role, access to this option requires organization *read* and *update* permissions. 5. Select **I agree** to grant Microsoft permission to [send user and device information to Google](../protect/data-intune-sends-to-google.md). -6. Select **Launch Google to connect now** to open the Managed Google Play website. The website opens on a new tab in your browser. +6. Select **Launch Google to connect now** to open the managed Google Play website. The website opens on a new tab in your browser. 7. On the Google sign-in page, confirm that the prefilled Microsoft Entra account is the account you want to associate with all Android Enterprise management tasks for this tenant. > [!IMPORTANT] - > - This account is used to manage the Google Admin account and associated subscriptions, as appropriate. The Microsoft Entra account must have a mailbox set up to complete the validation process required by Google. - > - We recommend using the Microsoft Entra account you're signed into to create the Google account. After you establish the connection, you can add and remove more administrators, if needed, in the Google admin console. + > - This account is used to manage the Google Admin account and associated subscriptions, as appropriate. The Microsoft Entra account must have an active mailbox to complete the validation process required by Google. + > - We recommend using the Microsoft Entra account you're signed into to create the Google Admin account. After you establish the connection, you can add and remove more administrators, if needed, in the Google admin console. 8. Follow the onscreen prompts to finish creating a Google Admin account. 9. When prompted, select **Allow and create account** to allow Microsoft Intune to manage your Android Enterprise devices. > [!TIP] -> To choose a scope tag for your managed Google Play apps, go to **Tenant administration** > **Connectors and tokens** > **Managed Google Play** in the Microsoft Intune admin center. Then select a scope tag to apply to all newly-approved Managed Google Play apps. You must have the following permissions to interact with this area in the admin center and to remove the selected scope tag. Tenant admins, or admins who are in charge of giving admin permissions to others, can go to **Tenant Administration** > **Roles** to edit permissions. +> To choose a scope tag for your managed Google Play apps, go to **Tenant administration** > **Connectors and tokens** > **Managed Google Play** in the Microsoft Intune admin center. Then select a scope tag to apply to all newly-approved managed Google Play apps. You must have the following permissions to interact with this area in the admin center and to remove the selected scope tag. Tenant admins, or admins who are in charge of giving admin permissions to others, can go to **Tenant Administration** > **Roles** to edit permissions. > - Android Sync - Read > - Android Sync – UpdateOnBoarding -## Disconnect your Android Enterprise administrative account +## Disconnect your Android Enterprise administrative account -You can turn off Android Enterprise enrollment and management by following these steps: +You can disconnect the link between Microsoft Intune and Google in the admin center. Disconnecting the account disables Android Enterprise device management for your tenant. -1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) with your Intune administrator account. +1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) with an Intune Administrator account. 2. [Retire](../remote-actions/devices-wipe.md#retire) all of the following devices: - Android Enterprise personally owned work profile devices - Android Enterprise corporate-owned work profile devices @@ -104,7 +104,7 @@ You can turn off Android Enterprise enrollment and management by following these ## Next steps -After you connect to the Managed Google Play account, you can set up Microsoft Intune for these Android Enterprise scenarios: +After you connect to a managed Google Play account, you can set up Microsoft Intune for these Android Enterprise scenarios: - [Personally owned work profile devices](android-work-profile-enroll.md). - [Corporate-owned work profile devices](android-corporate-owned-work-profile-enroll.md). - [Dedicated devices](android-kiosk-enroll.md). diff --git a/memdocs/intune/enrollment/corporate-identifiers-add.md b/memdocs/intune/enrollment/corporate-identifiers-add.md index 7a1fa536a18..dbbce515741 100644 --- a/memdocs/intune/enrollment/corporate-identifiers-add.md +++ b/memdocs/intune/enrollment/corporate-identifiers-add.md @@ -7,7 +7,7 @@ keywords: author: Lenewsad ms.author: lanewsad manager: dougeby -ms.date: 06/25/2024 +ms.date: 08/08/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: enrollment @@ -31,7 +31,7 @@ ms.collection: # Identify devices as corporate-owned -*Applies to: Android, iOS/iPadOS, Windows 11* +*Applies to: Android, iOS/iPadOS, Windows 10, Windows 11* Ensure that corporate devices are marked as *corporate-owned* as soon as they enroll by adding their corporate identifiers ahead of time in the Microsoft Intune admin center. The benefit of managing corporate devices is that they enable more device management capabilities than personal devices. For example, Microsoft Intune can collect full phone number and app inventory from a corporate device, but can only collect partial phone number and app inventory for personal devices. To add corporate identifiers to Microsoft Intune, you can upload a file of corporate identifiers in the admin center or enter each identifier separately. @@ -88,6 +88,7 @@ The following table shows the identifiers supported for each platform. When a de | Platform | IMEI number | Serial number | Serial number, model, manufacturer | |---|---|---|---| | Windows 11 | Not supported | Not supported | ✔️

Supported with Windows 11, version 22H2 and later with [KB5035942 (OS Builds 22621.3374 and 22631.3374)](https://support.microsoft.com/topic/march-26-2024-kb5035942-os-builds-22621-3374-and-22631-3374-preview-3ad9affc-1a91-4fcb-8f98-1fe3be91d8df). | +| Windows 10 | Not supported | Not supported | ✔️

Supported with Windows 10, version 22H2 and later with [KB5039299 (OS Build 19045.4598)](https://support.microsoft.com/topic/june-25-2024-kb5039299-os-build-19045-4598-preview-d4e3e815-fdd8-465e-8144-42afa165efed). | | iOS/iPadOS | ✔️

Supported in some cases. For more information, see [Add Android, iOS corporate identifiers](#add-android-ios-corporate-identifiers). | ✔️

We recommend using a serial number for iOS/iPadOS identification when possible. |Not supported| | macOS | Not supported | ✔️ |Not supported | | Android device administrator | ✔️

Supported with Android 9 and earlier. | ✔️

Supported with Android 9 and earlier. |Not supported | @@ -119,7 +120,7 @@ Android serial numbers aren't guaranteed to be unique or present. Check with you ### Add Windows corporate identifiers > [!IMPORTANT] -> Corporate identifiers are not supported for devices running Windows 10. If you're enrolling Windows 10 devices, do not use the corporate identifier feature. +> Corporate identifiers are supported for devices running Windows 10 KB5039299 (with OS Build 19045.4598) and later. If you're enrolling Windows 10 devices with an earlier build, do not use the corporate identifier feature. To add corporate identifiers for corporate devices running Windows 11, list the manufacturer, model, and serial number for each device as shown in the following example. @@ -246,7 +247,7 @@ To confirm the reason for an enrollment failure, go to **Devices** > **Enrollmen ## Known issues and limitations -- Windows corporate device identifiers are only supported for devices running Windows 11 version 22H2 and later. Earlier versions can't render the model and manufacturer property. As a result, the property appears in the admin center as **Unknown**. We're working on expanding corporate identifer support to devices running earlier versions of Windows. +- Windows corporate device identifiers are only supported for devices running Windows 10 version 22H2 and later and Windows 11 version 22H2 and later. Earlier versions can't render the model and manufacturer property. As a result, the property appears in the admin center as **Unknown**. We're working on expanding corporate identifer support to devices running earlier versions of Windows. - You can upload up to 10 CSV files for Windows corporate identifiers in the admin center. If you need to upload more data, we recommend using PowerShell or the Microsoft Intune Graph API to add corporate identifiers. diff --git a/memdocs/intune/enrollment/device-enrollment-manager-enroll.md b/memdocs/intune/enrollment/device-enrollment-manager-enroll.md index 5a675cbc9d3..3e621b94bc5 100644 --- a/memdocs/intune/enrollment/device-enrollment-manager-enroll.md +++ b/memdocs/intune/enrollment/device-enrollment-manager-enroll.md @@ -8,7 +8,7 @@ keywords: author: Lenewsad ms.author: lanewsad manager: dougeby -ms.date: 01/22/2024 +ms.date: 05/24/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: enrollment @@ -33,7 +33,15 @@ ms.collection: # Add device enrollment managers -A device enrollment manager (DEM) is a non-administrator user who can enroll devices in Intune. Device enrollment managers are useful to have when you need to enroll and prepare many devices for distribution. People signed in to a DEM account can enroll and manage up to 1,000 devices, while a standard non-admin account can only enroll 15. +A device enrollment manager (DEM) is a nonadministrator user who can enroll devices in Intune. Device enrollment managers are useful to have when you need to enroll and prepare many devices for distribution. People signed in to a DEM account can enroll and manage up to 1,000 devices, while a standard nonadmin account can only enroll 15. + +> [!TIP] +> The following enrollment methods allow standard nonadmin accounts to enroll more than 15 devices: +> - Co-management with Configuration Manager +> - Automatic enrollment + group policy +> - Windows Autopilot +> +> If you're using these methods to enroll devices, you do not need to use a DEM account. A DEM account requires an Intune user or device license, and an associated Microsoft Entra user. This article describes the limits and specifications of DEM accounts and how to manage permissions. @@ -103,7 +111,7 @@ DEM-enrolled devices can install VPP apps if they have Apple VPP device licenses ### Microsoft Entra ID -Applying a Microsoft Entra maximum device limit of less than 1,000 to a DEM account will prevent you from reaching the 1,000 device limit that the DEM account can enroll. +Applying a Microsoft Entra maximum device limit of less than 1,000 to a DEM account prevents you from reaching the 1,000 device limit that the DEM account can enroll. ### Certificates You must use device-level certificates to manage Wi-Fi and email connections. diff --git a/memdocs/intune/enrollment/enrollment-restrictions-set.md b/memdocs/intune/enrollment/enrollment-restrictions-set.md index b2bbd55c30a..93079dc5b66 100644 --- a/memdocs/intune/enrollment/enrollment-restrictions-set.md +++ b/memdocs/intune/enrollment/enrollment-restrictions-set.md @@ -153,7 +153,13 @@ Intune also blocks personal devices using these enrollment methods: ## Limitations -* Enrollment restrictions are applied to users. For enrollment scenarios that aren't user-driven, such as Windows Autopilot self-deploying mode and Autopilot for pre-provisioned deployment, bulk enrollment (WCD), Azure Virtual desktop, or userless Apple Automated device enrollment (ADE without user device affinity), Intune enforces the default policy. +* Enrollment restrictions are applied to enrollments that are user-driven. Intune enforces the default policy in enrollment scenarios that aren't user-driven, such as: + + * Windows Autopilot self-deploying mode and Autopilot for pre-provisioned deployment + * Bulk enrollment via Windows Configuration Designer + * Userless Apple automated device enrollment (without user-device affinity) + * Azure Virtual Desktop + * Windows 365 * Device limit restrictions can't be applied to devices in the following Windows enrollment scenarios, because these scenarios utilize shared device mode: diff --git a/memdocs/intune/enrollment/ios-user-enrollment-supported-actions.md b/memdocs/intune/enrollment/ios-user-enrollment-supported-actions.md index 1a5c3ab0052..94884a32267 100644 --- a/memdocs/intune/enrollment/ios-user-enrollment-supported-actions.md +++ b/memdocs/intune/enrollment/ios-user-enrollment-supported-actions.md @@ -8,7 +8,7 @@ keywords: author: Lenewsad ms.author: lanewsad manager: dougeby -ms.date: 07/18/2024 +ms.date: 08/19/2024 ms.topic: conceptual ms.service: microsoft-intune ms.subservice: enrollment @@ -34,12 +34,12 @@ You can utilize Apple User Enrollment to enroll and manage user-owned iOS/iPadOS This article provides an overview of the Apple User Enrollment features and functionality supported by Microsoft Intune. -## Apple User Enrollment methods +## Apple User Enrollment methods -> [!IMPORTANT] -> The account driven user enrollment feature is in public preview. For more information, see [Public preview in Microsoft Intune](../fundamentals/public-preview.md). +>[!IMPORTANT] +> Apple user enrollment with Company Portal has been deprecated as an enrollment option, and is no longer available for newly enrolled devices. Microsoft Intune product and technical support remains available to devices that already have the enrollment profile. For new enrollments, we recommend account-driven user enrollment. -Microsoft Intune supports account driven Apple User Enrollment and Apple User Enrollment with Company Portal. +Microsoft Intune supports account driven Apple User Enrollment and profile based Apple User Enrollment with Company Portal. * Account driven user enrollment: Also referred to as *account-based enrollment*. The device user initiates enrollment by going to the **Settings** app > **VPN & Device Management** and adding their work or school account. After the device user approves device management, the enrollment profile silently installs, and Intune policies are applied. diff --git a/memdocs/intune/enrollment/media/apple-configurator-enroll-ios/apple-configurator.png b/memdocs/intune/enrollment/media/apple-configurator-enroll-ios/apple-configurator.png deleted file mode 100644 index def11aed54d..00000000000 Binary files a/memdocs/intune/enrollment/media/apple-configurator-enroll-ios/apple-configurator.png and /dev/null differ diff --git a/memdocs/intune/enrollment/media/apple-school-manager-set-up-ios/asm-device-assignment.png b/memdocs/intune/enrollment/media/apple-school-manager-set-up-ios/asm-device-assignment.png deleted file mode 100644 index e8d7261418c..00000000000 Binary files a/memdocs/intune/enrollment/media/apple-school-manager-set-up-ios/asm-device-assignment.png and /dev/null differ diff --git a/memdocs/intune/enrollment/media/apple-school-manager-set-up-ios/asm-server-assignment.png b/memdocs/intune/enrollment/media/apple-school-manager-set-up-ios/asm-server-assignment.png deleted file mode 100644 index e4ed2525482..00000000000 Binary files a/memdocs/intune/enrollment/media/apple-school-manager-set-up-ios/asm-server-assignment.png and /dev/null differ diff --git a/memdocs/intune/enrollment/media/apple-school-manager-set-up-ios/authenticatewithcompanyportal.png b/memdocs/intune/enrollment/media/apple-school-manager-set-up-ios/authenticatewithcompanyportal.png deleted file mode 100644 index ee07548d826..00000000000 Binary files a/memdocs/intune/enrollment/media/apple-school-manager-set-up-ios/authenticatewithcompanyportal.png and /dev/null differ diff --git a/memdocs/intune/enrollment/media/apple-school-manager-set-up-ios/image01.png b/memdocs/intune/enrollment/media/apple-school-manager-set-up-ios/image01.png deleted file mode 100644 index d5a37c988c4..00000000000 Binary files a/memdocs/intune/enrollment/media/apple-school-manager-set-up-ios/image01.png and /dev/null differ diff --git a/memdocs/intune/enrollment/media/apple-school-manager-set-up-ios/image02.png b/memdocs/intune/enrollment/media/apple-school-manager-set-up-ios/image02.png deleted file mode 100644 index a0662db90ef..00000000000 Binary files a/memdocs/intune/enrollment/media/apple-school-manager-set-up-ios/image02.png and /dev/null differ diff --git a/memdocs/intune/enrollment/media/apple-school-manager-set-up-ios/setupassistantcustom.png b/memdocs/intune/enrollment/media/apple-school-manager-set-up-ios/setupassistantcustom.png deleted file mode 100644 index 64ad008266e..00000000000 Binary files a/memdocs/intune/enrollment/media/apple-school-manager-set-up-ios/setupassistantcustom.png and /dev/null differ diff --git a/memdocs/intune/enrollment/media/connect-intune-android-enterprise/android-work-bind.png b/memdocs/intune/enrollment/media/connect-intune-android-enterprise/android-work-bind.png deleted file mode 100644 index 2a5c7df75b5..00000000000 Binary files a/memdocs/intune/enrollment/media/connect-intune-android-enterprise/android-work-bind.png and /dev/null differ diff --git a/memdocs/intune/enrollment/media/device-enrollment-program-enroll-ios/ios-enroll.png b/memdocs/intune/enrollment/media/device-enrollment-program-enroll-ios/ios-enroll.png deleted file mode 100644 index f4c9c7f72ea..00000000000 Binary files a/memdocs/intune/enrollment/media/device-enrollment-program-enroll-ios/ios-enroll.png and /dev/null differ diff --git a/memdocs/intune/enrollment/media/enrollment-autopilot/autopilot-import-device.png b/memdocs/intune/enrollment/media/enrollment-autopilot/autopilot-import-device.png deleted file mode 100644 index 1f405fe6655..00000000000 Binary files a/memdocs/intune/enrollment/media/enrollment-autopilot/autopilot-import-device.png and /dev/null differ diff --git a/memdocs/intune/enrollment/media/windows-enroll/auto-enroll-azure-select.png b/memdocs/intune/enrollment/media/windows-enroll/auto-enroll-azure-select.png deleted file mode 100644 index 70ad6c2396f..00000000000 Binary files a/memdocs/intune/enrollment/media/windows-enroll/auto-enroll-azure-select.png and /dev/null differ diff --git a/memdocs/intune/enrollment/windows-bulk-enroll.md b/memdocs/intune/enrollment/windows-bulk-enroll.md index 0fa6aa875ba..ae7609b6284 100644 --- a/memdocs/intune/enrollment/windows-bulk-enroll.md +++ b/memdocs/intune/enrollment/windows-bulk-enroll.md @@ -6,7 +6,7 @@ keywords: author: Lenewsad ms.author: lanewsad manager: dougeby -ms.date: 04/02/2024 +ms.date: 08/22/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: enrollment @@ -61,32 +61,32 @@ Additionally, ensure that the service principal for Microsoft.Azure.SyncFabric ( 1. Install [Windows Configuration Designer (WCD)](https://www.microsoft.com/p/windows-configuration-designer/9nblggh4tx22) from the Microsoft Store. 1. Open the **Windows Configuration Designer** app and select **Provision desktop devices**. - ![Screenshot of selecting Provision desktop devices in the Windows Configuration Designer app](./media/windows-bulk-enroll/bulk-enroll-select.png) +![Screenshot of selecting Provision desktop devices in the Windows Configuration Designer app](./media/windows-bulk-enroll/bulk-enroll-select.png) 1. A **New project** window opens where you specify the following information: - **Name** - A name for your project - **Project folder** - Save location for the project - **Description** - An optional description of the project ![Screenshot of specifying name, project folder, and description in the Windows Configuration Designer app](./media/windows-bulk-enroll/bulk-enroll-name.png) - -1. Enter a unique name for your devices. Names can include a serial number (%SERIAL%) or a random set of characters. Optionally, you can also enter a product key if you are upgrading the edition of Windows, configure the device for shared use, and remove pre-installed software. - ![Screenshot of specifying name and product key in the Windows Configuration Designer app](./media/windows-bulk-enroll/bulk-enroll-device.png) +1. Enter a unique name for your devices. Names can include a serial number (%SERIAL%) or a random set of characters. Optionally, you can also enter a product key if you are upgrading the edition of Windows, configure the device for shared use, and remove pre-installed software. + ![Screenshot of specifying name and product key in the Windows Configuration Designer app](./media/windows-bulk-enroll/bulk-enroll-device.png) + 1. Optionally, you can configure the Wi-Fi network devices connect to when they first start. If the network devices aren't configured, a wired network connection is required when the device is first started. - ![Screenshot of enabling Wi-Fi including Network SSID and Network type options in the Windows Configuration Designer app](./media/windows-bulk-enroll/bulk-enroll-network.png) +![Screenshot of enabling Wi-Fi including Network SSID and Network type options in the Windows Configuration Designer app](./media/windows-bulk-enroll/bulk-enroll-network.png) 1. Select **Enroll in Azure AD**, enter a **Bulk Token Expiry** date, and then select **Get Bulk Token**. The token validity period is 180 days. > [!NOTE] > Once a provisioning package is created, it can be revoked before its expiration by removing the associated package_{GUID} user account from Microsoft Entra ID. - 1. Provide your Microsoft Entra credentials to get a bulk token. - ![Screenshot of signing in to the Windows Configuration Designer app](./media/windows-bulk-enroll/bulk-enroll-cred.png) +![Screenshot of signing in to the Windows Configuration Designer app](./media/windows-bulk-enroll/bulk-enroll-cred.png) > [!NOTE] - > The account used to request the bulk token must be included in the [MDM user scope](windows-enroll.md#enable-windows-automatic-enrollment) that is specified in Microsoft Entra ID. If this account is removed from a group that is tied to the MDM user scope, bulk enrollment will stop working. - + > - The account you use to request the bulk token must be included in the [MDM user scope](windows-enroll.md#enable-windows-automatic-enrollment) in Microsoft Entra ID. If you remove this account from a group that's tied to the MDM user scope, bulk enrollment will stop working. + > - Bulk token retrieval does not work for federated user accounts enabled for staged rollouts. + 1. In the **Stay signed in to all your apps** page, select **No, sign in to this app only**. If you keep the check box selected and press OK, the device you are using will become managed by your organization. If you do not intend for your device to be managed, make sure to select **No, sign in to this app only**. 1. Click **Next** when **Bulk Token** is fetched successfully. @@ -94,7 +94,7 @@ Additionally, ensure that the service principal for Microsoft.Azure.SyncFabric ( 1. Optionally, you can **Add applications** and **Add certificates**. These apps and certificates are provisioned on the device. 1. Optionally, you can password protect your provisioning package. Click **Create**. - ![Screenshot of package protection in the Windows Configuration Designer app](./media/windows-bulk-enroll/bulk-enroll-create.png) +![Screenshot of package protection in the Windows Configuration Designer app](./media/windows-bulk-enroll/bulk-enroll-create.png) ## Provision devices @@ -106,8 +106,8 @@ Additionally, ensure that the service principal for Microsoft.Azure.SyncFabric ( For step-by-step instruction on applying a provisioning package, see [Apply a provisioning package](/windows/configuration/provisioning-packages/provisioning-apply-package). -3. After you apply the package, the device will automatically restart in one minute. - ![Screenshot of project folder, specifying name, and description in the Windows Configuration Designer app](./media/windows-bulk-enroll/bulk-enroll-add.png) +1. After you apply the package, the device will automatically restart in one minute. +![Screenshot of project folder, specifying name, and description in the Windows Configuration Designer app](./media/windows-bulk-enroll/bulk-enroll-add.png) 4. When the device restarts, it connects to the Microsoft Entra ID and enrolls in Microsoft Intune. diff --git a/memdocs/intune/fundamentals/azure-virtual-desktop-multi-session.md b/memdocs/intune/fundamentals/azure-virtual-desktop-multi-session.md index 8a640685328..9c207d54018 100644 --- a/memdocs/intune/fundamentals/azure-virtual-desktop-multi-session.md +++ b/memdocs/intune/fundamentals/azure-virtual-desktop-multi-session.md @@ -137,6 +137,8 @@ Windows 10 or Windows 11 Administrative Templates are supported for Windows 10 o - ADMX-backed policies are supported. Some policies aren't yet available in the Settings catalog. - ADMX-ingested policies are supported, including Office and Microsoft Edge settings available in Office administrative template files and Microsoft Edge administrative template files. For a complete list of ADMX-ingested policy categories, see [Win32 and Desktop Bridge app policy configuration](/windows/client-management/mdm/win32-and-centennial-app-policy-configuration#overview). Some ADMX ingested settings won't be applicable to Windows 10 or Windows 11 Enterprise multi-session. +To list supported Administrative Templates, you'll need to use the filter in Settings catalog. + ## Compliance and Conditional access You can secure your Windows 10 or Windows 11 Enterprise multi-session VMs by configuring compliance policies and Conditional Access policies in the Microsoft Intune admin center. The following compliance policies are supported on Windows 10 or Windows 11 Enterprise multi-session VMs: @@ -256,7 +258,7 @@ The following sections provide troubleshooting guidance for common issues. Configuration policy reports as Not applicable|Some policies aren't applicable to Azure Virtual Desktop VMs.| |Microsoft Edge/Microsoft Office ADMX policy doesn't show up when I apply the filter for Windows 10 or Windows 11 Enterprise multi-session edition|Applicability for these settings isn't based on the Windows version or edition but on whether those apps have been installed on the device. To add these settings to your policy, you may have to remove any filters applied in the settings picker.| |App configured to install in system context didn't apply|Confirm the app doesn't have a dependency or supersedence relationship on any apps configured to install in user context. User context apps aren't currently supported on Windows 10 or Windows 11 Enterprise multi-session.| -|Update rings for Windows 10 and later policy didn't apply|Windows update rings policies aren't currently supported.| +|Update rings for Windows 10 and later policy didn't apply|Windows update rings policies aren't currently supported. Quality updates can be managed via settings available in the [settings catalog](../configuration/settings-catalog.md).| ## Next steps diff --git a/memdocs/intune/fundamentals/china.md b/memdocs/intune/fundamentals/china.md index b9c8e4c1821..d9e6afa6738 100644 --- a/memdocs/intune/fundamentals/china.md +++ b/memdocs/intune/fundamentals/china.md @@ -8,7 +8,7 @@ keywords: author: Smritib17 ms.author: smbhardwaj manager: dougeby -ms.date: 08/23/2022 +ms.date: 08/21/2024 ms.topic: conceptual ms.service: microsoft-intune ms.subservice: fundamentals @@ -31,7 +31,7 @@ ms.collection: - government --- -# Intune operated by 21Vianet in China +# Intune operated by 21Vianet in China Intune operated by 21Vianet is designed to meet the needs for secure, reliable, and scalable cloud services in China. Intune as a service is built on top of Microsoft Azure. Microsoft Azure operated by 21Vianet is a physically separated instance of cloud services located in China. It's independently operated and transacted by 21Vianet. This service is powered by technology that Microsoft has licensed to 21Vianet. @@ -41,7 +41,7 @@ Microsoft doesn't operate the service itself. 21Vianet operates, provides, and m ## Feature differences in Intune operated by 21Vianet -Because the China services are operated by a partner from inside China, there are some feature differences with Intune. +Because the China services are operated by a partner from inside China, there are some feature differences with Intune. - Intune operated by 21Vianet only supports standalone deployments. Customers can use co-management to attach their existing Configuration Manager deployment to the Microsoft Intune cloud. - Migrations from public clouds to sovereign clouds aren't supported. Customers interested in moving to Intune operated by 21Vianet must migrate manually. @@ -50,29 +50,31 @@ Because the China services are operated by a partner from inside China, there ar - Management of Windows 10 is supported by using the modern MDM channel. - Intune operated by 21Vianet doesn't support on-premises Exchange Connector. - Windows Autopilot and Business Store features aren't currently available. -- Intune operated by 21Vianet supports the Microsoft Store app (legacy) with Available assignment. You can deploy the Company Portal for Windows from the Download Center. Download the Microsoft Intune Company Portal for Windows from the Official [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=105219) and deploy it via the LOB required app as a workaround. +- Intune operated by 21Vianet supports the Company Portal for Windows app. Use WinGet to download the Company portal package and dependencies and then deploy as a Line-of-Business app via Intune. [Use the WinGet tool to install and manage applications](/windows/package-manager/winget/). - Microsoft Intune Endpoint Analytics and Log Analytics features aren't currently available. - Because Google Mobile Services isn't available in China, customers in Intune operated by 21Vianet can't use features that require Google Mobile Services. These features include: - Google Play Protect capabilities such as Play integrity verdict. - Managing apps from the Google Play Store. - Android Enterprise capabilities. For more information, see this [Google documentation](https://support.google.com/work/android/answer/6270910?hl=en). -- The Intune Company Portal app for Android uses Google Mobile Services to communicate with the Microsoft Intune service. Because Google Play services isn't available in China, some tasks can require up to 8 hours to finish. For more information, see this [article](../apps/manage-without-gms.md#limitations-of-intune-management-when-gms-is-unavailable). +- The Intune Company Portal app for Android uses Google Mobile Services to communicate with the Microsoft Intune service. Because Google Play services isn't available in China, some tasks can require up to 8 hours to finish. For more information, see this [article](../apps/manage-without-gms.md#limitations-of-intune-management-when-gms-is-unavailable). - To follow local regulations and provide improved functionality, the Intune client experience (Company Portal app) may differ in China. - Fencing isn't available. - Mobile Application Management (MAM) availability is conditional on those apps being available in People's Republic of China. -- Intune operated by 21Vianet doesn't support Android (AOSP) management for corporate devices. -- Intune operated by 21Vianet doesn't support Mobile Threat Defense (MTD) connector for Android and iOS devices with MTD vendors. +- Mobile Threat Defense (MTD) connectors for Android and iOS/iPadOS devices are supported for the MTD partners that also support the 21Vianet environment. When you sign in to a 21Vianet tenant, you will see the connectors that are available in that environment. +- Intune operated by 21Vianet doesn't support Android (AOSP) management for corporate devices. - Intune operated by 21Vianet doesn't support partner device management integration with Jamf for macOS devices. ## You control customer data In Microsoft Azure, Intune, Microsoft 365, and Power BI operated by 21Vianet, you have full control of your data: + - You know where customer data is located. - You control access to your customer data. - You control your customer data if you leave the service. - You have options to control the security of your customer data. With Microsoft Azure, Intune, Microsoft 365, and Power BI operated by 21Vianet, you’re the owner of your data: + - 21Vianet doesn’t use customer data for advertising. - You control who has access to your customer data. - We use logical isolation to segregate each customer’s data. @@ -88,4 +90,4 @@ The Tenant Administrator role for Intune operated by 21Vianet can request data f ## Next steps -[Learn more about Intune supported configurations](supported-devices-browsers.md) +[Learn more about Intune supported configurations](supported-devices-browsers.md) \ No newline at end of file diff --git a/memdocs/intune/fundamentals/cloud-configuration-setup-guide.md b/memdocs/intune/fundamentals/cloud-configuration-setup-guide.md index 5ba12bedd29..f1c0a8d5e7c 100644 --- a/memdocs/intune/fundamentals/cloud-configuration-setup-guide.md +++ b/memdocs/intune/fundamentals/cloud-configuration-setup-guide.md @@ -105,7 +105,7 @@ In this step, you enable MDM automatic enrollment in Intune and configure how de If you already use Windows Autopilot, then skip this step, and go to [Step 3 - Deploy a script to configure Known Folder Move and remove built-in apps](#step-3---configure-onedrive-known-folder-move-and-deploy-a-script-to-remove-built-in-apps) (in this article). -### ✔️ 1 - Enable automatic enrollment +### ✅ 1 - Enable automatic enrollment Enable automatic enrollment for the organization users that you want to use cloud config. Automatic enrollment is required for cloud config. For more information on automatic enrollment, go to [Enrollment guide - Windows automatic enrollment](../fundamentals/deployment-guide-enrollment-windows.md#windows-automatic-enrollment). @@ -119,7 +119,7 @@ Enable automatic enrollment for the organization users that you want to use clou 4. Don't configure the MAM user scope, MAM terms of user URL, MDM discovery URL, and MAM compliance URL settings. Leave these settings blank. MAM settings aren't configured for cloud config. 5. Select **Save** to save your changes. -### ✔️ 2 - Choose how devices enroll and configure users to be standard users on devices +### ✅ 2 - Choose how devices enroll and configure users to be standard users on devices After Windows automatic enrollment is enabled in Intune, the next step is to determine how devices enroll in Intune. When they enroll, they're available to receive your cloud config policies. You also need to configure users to be standard users on their devices. Standard users can only install apps that your organization approves. @@ -238,7 +238,7 @@ When you configure OneDrive **Known Folder Move**, user files and data are autom This step helps simplify the Windows user experience. -### ✔️ 1 - Configure OneDrive Known Folder Move with an Administrative Template +### ✅ 1 - Configure OneDrive Known Folder Move with an Administrative Template With **Known Folder Move**, users data (files and folders) is saved to OneDrive. When users sign in to another device, OneDrive automatically synchronizes the data to the new device. Users don't have to manually move their files. @@ -265,7 +265,7 @@ To configure **Known Folder Move**, use an ADMX template in Intune: 7. Assign the profile to the group you created in [Step 1 - Create a Microsoft Entra group](#step-1---create-a-microsoft-entra-group) (in this article). -### ✔️ 2 - Deploy a script to remove built-in apps +### ✅ 2 - Deploy a script to remove built-in apps Microsoft created a Windows PowerShell script that: @@ -321,13 +321,13 @@ To prevent these outside apps, use the following steps: This step deploys Microsoft Edge and Microsoft Teams. You can deploy other essential apps in this step. Remember, only deploy what users need. -### ✔️ 1 - Deploy Microsoft Edge +### ✅ 1 - Deploy Microsoft Edge 1. [Add Microsoft Edge to Intune](../apps/apps-windows-edge.md). 2. For **App settings**, select the **Stable Channel**. 3. Assign the Microsoft Edge app to the group you created in [Step 1 - Create a Microsoft Entra group](#step-1---create-a-microsoft-entra-group) (in this article). -### ✔️ 2- Deploy Microsoft Teams +### ✅ 2- Deploy Microsoft Teams 1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). 2. Select **Apps** > **Windows**. @@ -364,7 +364,7 @@ This step deploys Microsoft Edge and Microsoft Teams. You can deploy other essen This step configures endpoint security settings to help keep devices secure, including the built-in Windows security baseline and BitLocker settings. -### ✔️ 1 - Deploy the Windows 10/11 MDM security baseline +### ✅ 1 - Deploy the Windows 10/11 MDM security baseline For Windows in cloud configuration, it's recommended to use the Windows 10/11 [security baseline](/windows/security/operating-system-security/device-management/windows-security-configuration-framework/windows-security-baselines). There are some setting values you can change based on your organization's preference. @@ -387,7 +387,7 @@ Configure the security baseline in Intune: 6. In **Assignments**, select the group that you created in [Step 1 - Create a Microsoft Entra group](#step-1---create-a-microsoft-entra-group) (in this article). 7. Select **Create** to create and assign the baseline. -### ✔️ 2 - Deploy more BitLocker settings with a drive encryption endpoint security profile +### ✅ 2 - Deploy more BitLocker settings with a drive encryption endpoint security profile There are more BitLocker settings that help keep your devices secure. Configure these BitLocker settings in Intune: @@ -501,7 +501,7 @@ Create the compliance policy in Intune: There are optional policies you can create and deploy with your cloud config. This section describes these optional policies. -### ✔️ Configure a tenant domain name +### ✅ Configure a tenant domain name Configure devices to automatically use your tenant's domain name for user sign-ins. When you add a domain name, users don't have to type their full UPN to sign in. @@ -515,7 +515,7 @@ Add the tenant domain name in Intune: 6. In **Configuration settings**, for **Password**, configure the **Preferred Microsoft Entra tenant domain**. Enter the Microsoft Entra domain name that users should use to sign in to devices. 7. Assign the profile to the group you created in [Step 1 - Create a Microsoft Entra group](#step-1---create-a-microsoft-entra-group) (in this article). -### ✔️ Deploy other essential productivity and line of business (LOB) apps +### ✅ Deploy other essential productivity and line of business (LOB) apps You might have a few essential LOB apps that all devices need. Choose a minimum number of these apps to deploy. If you deliver apps using a virtualization solution, then also deploy the virtualization client app to devices. @@ -525,19 +525,19 @@ You might need specific LOB apps on some of your devices. Or, there might be som Cloud config is recommended for devices that need just a few key apps, along with collaboration and browsing. -### ✔️ Deploy resources that users need for organization access +### ✅ Deploy resources that users need for organization access Configure essential resources that users might need, which depends on your organization's processes. Essential resources can include certificates, printers, VPN connections, and Wi-Fi profiles. In Intune, assign these resources to the group you created in [Step 1 - Create a Microsoft Entra group](#step-1---create-a-microsoft-entra-group) (in this article). -### ✔️ Configure recommended settings for OneDrive Known Folder Move +### ✅ Configure recommended settings for OneDrive Known Folder Move There are more settings that improve the user experience for OneDrive **Known Folder Move**. The settings aren't required for **Known Folder Move** to work but are helpful. For more information on these settings, go to [OneDrive settings recommended for Known Folder Move](/sharepoint/ideal-state-configuration). -### ✔️ Configure recommended Microsoft Edge settings +### ✅ Configure recommended Microsoft Edge settings There are some Microsoft Edge app settings that can be configured for a better user experience. You can configure these settings based on requirements or preference for the end user experience. diff --git a/memdocs/intune/fundamentals/cloud-configuration.md b/memdocs/intune/fundamentals/cloud-configuration.md index 69f0ef4b43b..f6fb7652d91 100644 --- a/memdocs/intune/fundamentals/cloud-configuration.md +++ b/memdocs/intune/fundamentals/cloud-configuration.md @@ -7,7 +7,7 @@ keywords: author: MandiOhlinger ms.author: mandia manager: dougeby -ms.date: 10/19/2023 +ms.date: 08/19/2024 ms.topic: conceptual ms.service: microsoft-intune ms.subservice: fundamentals @@ -34,18 +34,18 @@ ms.collection: Windows 10/11 in cloud configuration is a Microsoft-recommended device configuration. You can turn any Windows 10/11 Professional, Enterprise, and Education device into a cloud-optimized device. -It's ideal for: +Cloud configuration is ideal for: -- Frontline workers +- Frontline workers (FLW) - Remote workers -- Other users with focused workflow needs, like productivity and browsing +- Users with focused workflow needs, like productivity and browsing Cloud config makes these devices easy to use, and secures these devices with Microsoft-recommended security features. There are two ways to deploy cloud config: - **Option 1 - Automatic** (this article): Use the guided scenario described in this article to automatically create all the groups and policies with their configured values. -- **Option 2 - Manual**: Use a step-by-step setup guide to deploy cloud config yourself, including manually creating all the policies. For more information on this option, go to [Windows client cloud config setup guide](cloud-configuration-setup-guide.md). +- **Option 2 - Manual**: Use a step-by-step setup guide to deploy cloud config yourself, including manually creating all the policies. For information on this option, go to [Windows client cloud config setup guide](cloud-configuration-setup-guide.md). With Windows 10/11 in cloud configuration: @@ -59,67 +59,70 @@ With Windows 10/11 in cloud configuration: ## What this guided scenario does -Using Microsoft Intune, you can use a guided scenario to deploy a cloud configuration. The guided scenario automatically creates all the resources you need, including the following resources: +Using Microsoft Intune, you can use a guided scenario to deploy a cloud configuration. The guided scenario automatically creates all the resources you need, including: - Creates a new Microsoft Entra security group, or uses an existing Microsoft Entra security group. -- Deploys the Microsoft Edge and Microsoft Teams apps. For more information on deploying these apps individually, go to: +- Deploys the Microsoft Edge and Microsoft Teams apps. For information on deploying these apps individually, go to: - [Add Microsoft Edge for Windows 10/11](../apps/apps-windows-edge.md) - [Add Microsoft 365 apps to Windows 10/11 devices](../apps/apps-add-office365.md) - Creates a Windows 10/11 security baseline policy with recommended security settings that are already configured. - For more information about security baselines, and what they do, go to [Use security baselines to configure Windows client devices](../protect/security-baselines.md). + For information about security baselines, and what they do, go to [Use security baselines to configure Windows client devices](../protect/security-baselines.md). - Creates a Windows Autopilot enrollment profile that automatically enrolls devices in Microsoft Intune. - For more information on creating your own Windows Autopilot profile, go to [Configure Autopilot profiles](/autopilot/profiles). + For information on creating your own Windows Autopilot profile, go to [Configure Autopilot profiles](/autopilot/profiles). - Turns on and configures the Windows Autopilot enrollment status page (ESP). This page shows users the enrollment progress. - For more information about the ESP, go to [Set up the Enrollment Status Page](../enrollment/windows-enrollment-status.md). + For information about the ESP, go to [Set up the Enrollment Status Page](../enrollment/windows-enrollment-status.md). - Creates an administrative template that configures OneDrive with the Known Folder Move settings. With these settings, user files and data are automatically saved in OneDrive. For information on this setting, go to [Redirect and move Windows known folders](/onedrive/redirect-known-folders). -- Creates an administrative template that configures some SmartScreen settings in the Microsoft Edge app. For more information on creating your own profile, go to [Configure Microsoft Edge policy settings](../configuration/administrative-templates-configure-edge.md). +- Creates an administrative template that configures some SmartScreen settings in the Microsoft Edge app. For information on creating your own profile, go to [Configure Microsoft Edge policy settings](../configuration/administrative-templates-configure-edge.md). -- Creates a compliance policy that monitors compliance and health. Users are allowed to use noncompliant devices, and access resources. If your organization blocks access to non-compliant devices, then create another compliance policy that blocks access, and assign it to the same group. +- Creates a compliance policy that monitors compliance and health. Users are allowed to use noncompliant devices, and access resources. If your organization blocks access to noncompliant devices, then create another compliance policy that blocks access, and assign it to the same group. - For more information on the compliance settings you can configure on your own, go to [Windows client settings to mark devices as compliant or not compliant](../protect/compliance-policy-create-windows.md). + For information on the compliance settings you can configure on your own, go to [Windows client settings to mark devices as compliant or not compliant](../protect/compliance-policy-create-windows.md). - Deploys a Windows PowerShell script that removes built-in apps, and simplifies the Start menu. - For more information about PowerShell scripts in Intune, go to [Use PowerShell scripts on Windows client devices](../apps/intune-management-extension.md). + For information about PowerShell scripts in Intune, go to [Use PowerShell scripts on Windows client devices](../apps/intune-management-extension.md). - Creates a Windows client update ring policy. This policy automatically updates the devices, including product updates, drivers, and Windows updates. - For more information about update rings, and creating your policy, go to [Update rings for Windows client devices](../protect/windows-10-update-rings.md). + For information about update rings, and creating your policy, go to [Update rings for Windows client devices](../protect/windows-10-update-rings.md). > [!TIP] -> This guided scenario creates all these resources for you, automatically. If you want create your own individual resources, and not use the guided scenario, then you can. For the specific steps, go to the [cloud config overview and setup guide](https://aka.ms/CloudConfigGuide). +> This guided scenario creates all these resources for you, automatically. If you want create your own individual resources, and not use the guided scenario, you can. For the steps, go to the [cloud config overview and setup guide](https://aka.ms/CloudConfigGuide). ## Prerequisites -- At a minimum, the account creating the guided scenario must have the following licenses: +- Confirm your licenses. At a minimum, the account creating the guided scenario must have the following licenses: - Microsoft Entra ID P1 - Microsoft Intune - Microsoft Teams - - OneDrive for Business + - OneDrive - Windows 10 Pro - Windows 11 Pro - All of these services are included with the Microsoft 365 E3 license. For more security options and features, it's recommended to use the Microsoft 365 E5 license. To help decide which license is right for your organization, go to [Transform your enterprise with Microsoft 365](https://www.microsoft.com/microsoft-365/compare-microsoft-365-enterprise-plans). + All of these services are included with the Microsoft 365 E3 license. For more security options and features, use the Microsoft 365 E5 license. To help decide which license is right for your organization, go to [Transform your enterprise with Microsoft 365](https://www.microsoft.com/microsoft-365/compare-microsoft-365-enterprise-plans). - [Set the MDM authority to Intune](mdm-authority-set.md). The mobile device management (MDM) authority setting determines how you manage your devices. As an IT admin, you must set an MDM authority before users can enroll devices for management. -- Enable automatic enrollment for Windows client devices. For more information, go to: +- Enable automatic enrollment for Windows client devices. For information, go to: - [Quickstart: Set up automatic enrollment for Windows client devices](../enrollment/quickstart-setup-auto-enrollment.md) - [Enable Windows 10/11 automatic enrollment](../enrollment/windows-enroll.md#enable-windows-automatic-enrollment) -- Sign in as the Intune Service Administrator, also known as the Intune Administrator. For more information on the roles in Intune, go to [Role-based access control (RBAC) with Microsoft Intune](role-based-access-control.md). +- Sign in as the Intune Service Administrator Microsoft Entra role, also known as the Intune Administrator. For information on the roles that affect Intune, go to: + + - [Intune Administrator - Microsoft Entra built-in role](/entra/identity/role-based-access-control/permissions-reference#intune-administrator) + - [Role-based access control (RBAC) with Microsoft Intune](role-based-access-control.md) ## Step 1 - Introduction @@ -127,7 +130,7 @@ Open the guided scenario: 1. Open the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). 2. Select **Troubleshooting + support** > **Guided scenarios** > **Deploy Windows 10 and later in cloud configuration** > **Start**. -3. Select **Next**. +3. In **Introduction**, select **Next**. ## Step 2 - Basics @@ -147,17 +150,22 @@ Choose how your devices are named when they enroll, and choose the prefix of all - **Resource name prefix**: When you deploy the guided scenario, several resources are automatically created. To distinguish the items used in this deployment, add a prefix: - - **Enter a resource prefix name**: Enter some text that will be at the beginning of the items created. For example, enter `Windows cloud config`. All resources created will be named something like **Windows cloud config Autopilot profile**, or **Windows cloud config compliance policy**. + - **Enter a resource prefix name**: Enter some text that will be at the beginning of the items created. For example, enter `Windows cloud config`. All resources created are named something like **Windows cloud config Autopilot profile**, or **Windows cloud config compliance policy**. + +- **Resources to be created**: Select the default file format for the resources created by this guided scenario. Your options: + + - **Office Open Document**: Creates the resources in Office Open Document format (ODF). + - **Office Open XML**: Creates the resources in Office Open XML format, which is typically the recommended format. Your settings look similar to the following image: - :::image type="content" source="./media/cloud-configuration/guided-scenario-basics.png" alt-text="Screenshot that shows how to configure the device name template and resource name prefix in a Windows 10/11 cloud configuration guided scenario in Microsoft Intune."::: + :::image type="content" source="./media/cloud-configuration/guided-scenario-basics.png" alt-text="Screenshot that shows how to configure the device name template and resource name prefix in a Windows 10/11 cloud configuration guided scenario in Microsoft Intune." lightbox="./media/cloud-configuration/guided-scenario-basics.png"::: - Select **Next**. ## Step 3 - Apps -Select the apps you want to deploy to devices. Microsoft recommends deploying the smallest number of apps as possible. The idea is to keep your cloud config devices simple, and easy to manage.​ +Select the apps you want to deploy to devices. Microsoft recommends you deploy the smallest number of apps as possible. The idea is to keep your cloud config devices simple, and easy to manage.​ - **Cloud config defaults**: This guided scenario automatically includes the Microsoft Edge and Microsoft Teams apps. They can't be removed when creating the guided scenario. You can delete or uninstall these apps after the guided scenario finishes. @@ -166,15 +174,15 @@ Select the apps you want to deploy to devices. Microsoft recommends deploying th - **Select additional M365 apps (optional)**: From the list, add other Microsoft 365 apps that you want on the devices. Remember, keep the list small, and only include apps your users need. The idea is to keep the devices simple. > [!TIP] - > To add apps not listed, or add line-of-business apps, complete this guided scenario. Then, in the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Apps**, and create a policy. Deploy the app policy to the same group that you deployed this cloud config guided scenario. For more information on adding apps, go to [Add apps to Microsoft Intune](../apps/apps-add.md). + > To add apps not listed, or add line-of-business apps, complete this guided scenario. Then, in the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Apps**, and create a policy. Deploy the app policy to the same group that you deployed this cloud config guided scenario. For information on adding apps, go to [Add apps to Microsoft Intune](../apps/apps-add.md). - Select **Next**. ## Step 4 - Assignments -Select the groups that will receive this guided scenario, and all the resources it creates. +Select the groups that should receive this guided scenario, and all the resources it creates. -- **Create new group**: Creates a new group, and deploys the guided scenario policies to this group. As devices are added to this group, they'll start to receive this guided scenario. +- **Create new group**: Creates a new group, and deploys the guided scenario policies to this group. As devices are added to this group, they receive this guided scenario. - **Group name**: Enter the group name. For example, enter `Cloud configured devices`. - **Choose an existing group**: Select an existing group. You guided scenario policies are deployed to this group. @@ -204,7 +212,7 @@ When it deploys successfully, you can use the monitoring and reporting features ## What you need to know -- You can complete the guided scenario before there are any devices in the group. When devices are added to the group, and have internet access, then they'll automatically start receiving the policies in this guided scenario. +- You can complete the guided scenario before there are any devices in the group. When devices are added to the group, and have internet access, then they automatically start receiving the policies in this guided scenario. You can also: @@ -218,7 +226,7 @@ When it deploys successfully, you can use the monitoring and reporting features - After the guided scenario is deployed, you can go to a policy, and see the settings and their configured values. You can change any of these settings to another value, if you like. - To remove the guided scenario settings from devices, go to each policy created by the cloud config guided scenario. Configure the settings to **Not Configured**. Deploy each policy again to the same group as this guided scenario. - The next time the device checks in, the setting is no longer locked. Then, the setting can be changed by another policy, and possibly the end user. It's possible the setting might have the same value set by the guided scenario. + The next time the device checks in, the setting is no longer locked. Then, another policy or possibly the end can change the setting. It's possible the setting might have the same value set by the guided scenario. Now, you can delete the individual items created by this guided scenario, including apps, policies, the Windows PowerShell script, and the group. diff --git a/memdocs/intune/fundamentals/create-custom-role.md b/memdocs/intune/fundamentals/create-custom-role.md index 3acde65e365..5ac5b597eb8 100644 --- a/memdocs/intune/fundamentals/create-custom-role.md +++ b/memdocs/intune/fundamentals/create-custom-role.md @@ -127,11 +127,11 @@ The following permissions are available when creating custom roles. | Device compliance policies/Read | View device compliance policies and the list of Exchange Active Sync Connectors, or view the settings for Exchange on-premises access. | | Device compliance policies/Update | Change device compliance policies, Exchange ActiveSync connectors and Exchange on-premises access settings. | | Device compliance policies/View reports | View, generate, and export device compliance reports. | -| Device configurations/Assign | Assign device configuration profiles or assign device enrollment restrictions to Microsoft Entra security groups. | -| Device configurations/Create | Create new device configuration profiles, or create new device enrollment restrictions. | -| Device configurations/Delete | Delete device configuration profiles, or delete device enrollment restrictions. | -| Device configurations/Read | View device configuration profiles, or view device enrollment restrictions. | -| Device configurations/Update | Change device configuration profiles, or change device enrollment restrictions. | +| Device configurations/Assign | Assign device configuration profiles to Microsoft Entra security groups. | +| Device configurations/Create | Create new device configuration profiles. | +| Device configurations/Delete | Delete device configuration profiles. | +| Device configurations/Read | View device configuration profiles. | +| Device configurations/Update | Change device configuration profiles. | | Device configurations/View Reports | View, generate, and export device configuration reports and reports for endpoint security policies. | | Device enrollment managers/Read | View the list of device enrollment manager accounts. | | Device enrollment managers/Update | Create new device enrollment manager accounts, or delete device enrollment manager accounts. | diff --git a/memdocs/intune/fundamentals/deployment-guide-intune-setup.md b/memdocs/intune/fundamentals/deployment-guide-intune-setup.md index f53f631f091..0eaab3d21b2 100644 --- a/memdocs/intune/fundamentals/deployment-guide-intune-setup.md +++ b/memdocs/intune/fundamentals/deployment-guide-intune-setup.md @@ -340,13 +340,13 @@ There are some policy types that can't be exported. There are some policy types | Windows app (Win32) | ❌ Export
❌ Import

To add your LOB app to a new tenant, you also need the original `.intunewin` application source files.| | **Compliance policies** |   | | Actions for Non-Compliance | ❌ Export
❌ Import

It's possible there could be a link to an e-mail template. When you import a policy that has non-compliance actions, the default actions for non-compliance are added instead. | -| Assignments | ✔️ Export
❌ Import

Assignments are targeted to a group ID. In a new tenant, the group ID is different. | +| Assignments | ✅ Export
❌ Import

Assignments are targeted to a group ID. In a new tenant, the group ID is different. | | **Configuration profiles** |   | -| Email | ✔️ Export

✔️ If an email profile doesn't use certificates, then the import should work.
❌ If an email profile uses a root certificate, then the profile can't be imported to a new tenant. The root certificate ID is different in a new tenant. | -| SCEP certificate | ✔️ Export

❌ Import

SCEP certificate profiles use a root certificate. The root certificate ID is different in a new tenant. | -| VPN | ✔️ Export

✔️ If a VPN profile doesn't use certificates, then the import should work.
❌ If a VPN profile uses a root certificate, then the profile can't be imported to a new tenant. The root certificate ID is different in a new tenant. | -| Wi-Fi | ✔️ Export

✔️ If a Wi-Fi profile doesn't use certificates, then the import should work.
❌ If a Wi-Fi profile uses a root certificate, then the profile can't be imported to a new tenant. The root certificate ID is different in a new tenant. | -| Assignments | ✔️ Export
❌ Import

Assignments are targeted to a group ID. In a new tenant, the group ID is different. | +| Email | ✅ Export

✅ If an email profile doesn't use certificates, then the import should work.
❌ If an email profile uses a root certificate, then the profile can't be imported to a new tenant. The root certificate ID is different in a new tenant. | +| SCEP certificate | ✅ Export

❌ Import

SCEP certificate profiles use a root certificate. The root certificate ID is different in a new tenant. | +| VPN | ✅ Export

✅ If a VPN profile doesn't use certificates, then the import should work.
❌ If a VPN profile uses a root certificate, then the profile can't be imported to a new tenant. The root certificate ID is different in a new tenant. | +| Wi-Fi | ✅ Export

✅ If a Wi-Fi profile doesn't use certificates, then the import should work.
❌ If a Wi-Fi profile uses a root certificate, then the profile can't be imported to a new tenant. The root certificate ID is different in a new tenant. | +| Assignments | ✅ Export
❌ Import

Assignments are targeted to a group ID. In a new tenant, the group ID is different. | | **Endpoint Security** |   | | Endpoint detection and response | ❌ Export
❌ Import

This policy is linked to Microsoft Defender for Endpoint. In the new tenant, you configure Microsoft Defender for Endpoint, which automatically includes the **Endpoint detection and response** policy. | diff --git a/memdocs/intune/fundamentals/deployment-guide-platform-windows.md b/memdocs/intune/fundamentals/deployment-guide-platform-windows.md index b40e9f5347d..a5c2b973cf4 100644 --- a/memdocs/intune/fundamentals/deployment-guide-platform-windows.md +++ b/memdocs/intune/fundamentals/deployment-guide-platform-windows.md @@ -7,7 +7,7 @@ keywords: author: lenewsad ms.author: lanewsad manager: dougeby -ms.date: 07/22/2024 +ms.date: 08/21/2024 ms.topic: conceptual ms.service: microsoft-intune ms.subservice: fundamentals @@ -161,8 +161,10 @@ After devices are set up, you can use supported remote actions to manage and tro | ---- | ------ | |[Take remote action on devices](../remote-actions/device-management.md)|Learn how to drill down and remotely manage and troubleshoot individual devices in Intune. This article lists all remote actions available in Intune and links to those procedures. | |[Use TeamViewer to remotely administer Intune devices](../remote-actions/teamviewer-support.md)|Configure TeamViewer within Intune, and learn how to remotely administer a device. | -|[Use security tasks to view threats and vulnerabilities](../protect/atp-manage-vulnerabilities.md)|Use Intune to remediate endpoint weakness identified by Microsoft Defender for Endpoint. Before you can work with security tasks, you must integrate Microsoft Defender for Endpoint with Intune. | -|[Use organizational messages](../remote-actions/organizational-messages-overview.md)|Use organizational messages to send important messages to employees on Intune-managed devices running Windows 11. Organizational messages can be used to communicate in remote and hybrid work scenarios.| +|[Use security tasks to view threats and vulnerabilities](../protect/atp-manage-vulnerabilities.md)|Use Intune to remediate endpoint weakness identified by Microsoft Defender for Endpoint. Before you can work with security tasks, you must integrate Microsoft Defender for Endpoint with Intune. | + + ## Step 10: Help employees and students diff --git a/memdocs/intune/fundamentals/deployment-plan-configuration-profile.md b/memdocs/intune/fundamentals/deployment-plan-configuration-profile.md index d799f3659fa..4219ad6b85b 100644 --- a/memdocs/intune/fundamentals/deployment-plan-configuration-profile.md +++ b/memdocs/intune/fundamentals/deployment-plan-configuration-profile.md @@ -7,7 +7,7 @@ description: Step 4 to deploy device configuration profiles as part of the minim author: MandiOhlinger ms.author: mandia manager: dougeby -ms.date: 10/20/2023 +ms.date: 08/14/2024 ms.topic: conceptual ms.service: microsoft-intune ms.subservice: configuration @@ -29,7 +29,7 @@ ms.collection: # Step 4 - Configure device features and settings to secure devices and access resources -So far, you've set up your Intune subscription, created app protection policies, and created device compliance policies. +So far, you set up your Intune subscription, created app protection policies, and created device compliance policies. In this step, you're ready to configure a minimum or baseline set of security and device features that all devices must have. @@ -42,7 +42,7 @@ This article applies to: - macOS - Windows -When you create device configuration profiles, there are different levels and types of policies available. These levels are the minimum Microsoft recommended policies. Know that your environment and business needs may be different. +When you create device configuration profiles, there are different levels and types of policies available. These levels are the minimum Microsoft recommended policies. Know that your environment and business needs can be different. - **Level 1 - Minimum device configuration**: In this level, Microsoft recommends you create policies that: @@ -52,7 +52,7 @@ When you create device configuration profiles, there are different levels and ty - **Level 2 - Enhanced device configuration**: In this level, Microsoft recommends you create policies that: - Expand device security, including configuring disk encryption, enabling secure boot, and adding more password rules. - - Use the built-in features and templates to configure more settings that are important for your organization, including analyzing on-premises GPOs. + - Use the built-in features and templates to configure more settings that are important for your organization, including analyzing on-premises Group Policy Objects (GPOs). - **Level 3 - High device configuration**: In this level, Microsoft recommends you create policies that: @@ -63,7 +63,7 @@ When you create device configuration profiles, there are different levels and ty This article lists the different levels of device configuration policies that organizations should use. Most of these policies in this article focus on access to organization resources and security. -These features are configured in device configuration profiles in the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). When the profiles are ready, they can be deployed from Intune to your devices. +These features are configured in device configuration profiles in the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). When the Intune profiles are ready, they can be assigned to your users and devices. > [!TIP] > [Take a tour of Intune and the Microsoft Intune admin center](tutorial-walkthrough-endpoint-manager.md). @@ -86,7 +86,7 @@ For a more granular list of Windows settings and their recommended values, go to ### Antivirus and scanning -✔️ **Install antivirus software and regularly scan for malware** +✅ **Install antivirus software and regularly scan for malware** All devices should have antivirus software installed and be regularly scanned for malware. Intune integrates with third party partner mobile threat defense (MTD) services that provide AV and threat scanning. For macOS and Windows, antivirus and scanning are built in to Intune with Microsoft Defender for Endpoint. @@ -112,7 +112,7 @@ For more information on these features, go to: ### Detection and response -✔️ **Detect attacks and act on these threats** +✅ **Detect attacks and act on these threats** When you detect threats quickly, you can help minimize the impact of the threat. When you combine these policies with Conditional Access, you can block users and devices from accessing organization resources if a threat is detected. @@ -139,9 +139,9 @@ For more information on these features, go to: ### Firewall -✔️ **Enable the firewall on all devices** +✅ **Enable the firewall on all devices** -Some platforms come with a built-in firewall and on others, you may have to install a firewall separately. Intune integrates with third party partner mobile threat defense (MTD) services that can manage a firewall for Android and iOS/iPadOS devices. For macOS and Windows, firewall security is built in to Intune with Microsoft Defender for Endpoint. +Some platforms come with a built-in firewall and on others, you might have to install a firewall separately. Intune integrates with third party partner mobile threat defense (MTD) services that can manage a firewall for Android and iOS/iPadOS devices. For macOS and Windows, firewall security is built in to Intune with Microsoft Defender for Endpoint. Your policy options: @@ -163,7 +163,7 @@ For more information on these features, go to: ### Password policy -✔️ **Create a strong password/PIN policy and block simple passcodes** +✅ **Create a strong password/PIN policy and block simple passcodes** PINs unlock devices. On devices that access organization data, including personally owned devices, you should require strong PINs/passcodes and support biometrics to unlock devices. Using biometrics is part of a password-less approach, which is recommended. @@ -174,7 +174,7 @@ Your policy options: | Platform | Policy type | | --- | --- | | Android Enterprise | Intune device restrictions profile to manage the:
- Device password
- Work profile password | -| AOSP | Intune device restrictions profile | +| Android Open-Source Project (AOSP) | Intune device restrictions profile | | iOS/iPadOS | Intune device restrictions profile | | macOS | Intune device restrictions profile | | Windows client | - Intune security baselines (recommended)
- Intune device restrictions profile | @@ -195,9 +195,9 @@ For a list of the settings you can configure, go to: ### Software updates -✔️ **Regularly install software updates** +✅ **Regularly install software updates** -All devices should be updated regularly and policies should be created to make sure these updates are successfully installed. For most platforms, Intune has dedicated policies that focus on managing and installing updates. +All devices should be updated regularly and policies should be created to make sure these updates are successfully installed. For most platforms, Intune has policy settings that focus on managing and installing updates. Your policy options: @@ -226,33 +226,33 @@ This section focuses on accessing resources in your organization. These resource - VPN connection for remote connectivity - Wi-Fi connection for on-premises connectivity -:::image type="content" source="./media/deployment-plan-configuration-profile/deploy-email-vpn-wifi.png" alt-text="Diagram that shows an email, VPN and Wi-Fi profiles deployed from Microsoft Intune to end user devices."::: +:::image type="content" source="./media/deployment-plan-configuration-profile/deploy-email-vpn-wifi.png" alt-text="Diagram that shows an email, VPN, and Wi-Fi profiles deployed from Microsoft Intune to end user devices."::: ### Email Many organizations deploy email profiles with preconfigured settings to user devices. -✔️ **Automatically connect to user email accounts** +✅ **Automatically connect to user email accounts** The profile includes the email configuration settings that connect to your email server. Depending on the settings you configure, the email profile can also automatically connect the users to their individual email account settings. -✔️ **Use enterprise level email apps** +✅ **Use enterprise level email apps** -Email profiles in Intune use common and popular email apps, like Outlook. The email app is deployed to user devices. After it's deployed, you deploy the email device configuration profile with the settings that configure the email app. +Email profiles in Intune use common and popular email apps, like Outlook. The email app is deployed to user devices. After the app is deployed, you deploy the email device configuration profile with the settings that configure the email app. The email device configuration profile includes settings that connect to your Exchange. -✔️ **Access work or school email** +✅ **Access work or school email** Creating an email profile is a common minimum baseline policy for organizations with users that use email on their devices. -Intune has built in email settings for Android, iOS/iPadOS, and Windows client devices. When users open their email app, they can automatically connect, authenticate, and synchronize their organizational email accounts on their devices. +Intune has built-in email settings for Android, iOS/iPadOS, and Windows client devices. When users open their email app, they can automatically connect, authenticate, and synchronize their organizational email accounts on their devices. -✔️ **Deploy anytime** +✅ **Deploy anytime** -On new devices, it's recommended to deploy the email app during the enrollment process. When enrollment completes, then deploy the email device configuration policy. +On new devices, we recommended you deploy the email app during the enrollment process. When enrollment completes, then deploy the email device configuration policy. If you have existing devices, then deploy the email app at any time, and deploy the email device configuration policy. @@ -283,25 +283,25 @@ Many organizations deploy VPN profiles with preconfigured settings to user devic If your organization uses cloud services with modern authentication and secure identities, then you probably don't need a VPN profile. Cloud-native services don't require a VPN connection. -If your apps or services aren't cloud-based or aren't cloud-native, then it's recommended to deploy a VPN profile to connect to your internal organization network. +If your apps or services aren't cloud-based or aren't cloud-native, then deploy a VPN profile to connect to your internal organization network. -✔️ **Work from anywhere** +✅ **Work from anywhere** Creating a VPN profile is a common minimum baseline policy for organizations with remote workers and hybrid workers. As users work from anywhere, they can use the VPN profile to securely connect to your organization's network to access resources. -Intune has built in VPN settings for Android, iOS/iPadOS, macOS, and Windows client devices. On user devices, your VPN connection is shown as an available connection. Users select it. And, depending on the settings in your VPN profile, users can automatically authenticate and connect to the VPN on their devices. +Intune has built-in VPN settings for Android, iOS/iPadOS, macOS, and Windows client devices. On user devices, your VPN connection is shown as an available connection. Users select it. And, depending on the settings in your VPN profile, users can automatically authenticate and connect to the VPN on their devices. -✔️ **Use enterprise level VPN apps** +✅ **Use enterprise level VPN apps** VPN profiles in Intune use common enterprise VPN apps, like Check Point, Cisco, Microsoft Tunnel, and more. The VPN app is deployed to user devices. After the app is deployed, then you deploy the VPN connection profile with settings that configure the VPN app. The VPN device configuration profile includes settings that connect to your VPN server. -✔️ **Deploy anytime** +✅ **Deploy anytime** -On new devices, it's recommended to deploy the VPN app during the enrollment process. When enrollment completes, then deploy the VPN device configuration policy. +On new devices, we recommended you deploy the VPN app during the enrollment process. When enrollment completes, then deploy the VPN device configuration policy. If you have existing devices, deploy the VPN app at any time, and then deploy the VPN device configuration policy. @@ -328,21 +328,21 @@ To get started: Many organizations deploy Wi-Fi profiles with preconfigured settings to user devices. If your organization has a remote-only workforce, then you don't need to deploy Wi-Fi connection profiles. Wi-Fi profiles are optional and are used for on-premises connectivity. -✔️ **Connect wirelessly** +✅ **Connect wirelessly** As users work from different mobile devices, they can use the Wi-Fi profile to wirelessly and securely connect to your organization's network. The profile includes the Wi-Fi configuration settings that automatically connect to your network and/or SSID (service set identifier). Users don't have to manually configure their Wi-Fi settings. -✔️ **Support mobile devices on-premises** +✅ **Support mobile devices on-premises** Creating a Wi-Fi profile is a common minimum baseline policy for organizations with mobile devices that work on-premises. -Intune has built in Wi-Fi settings for Android, iOS/iPadOS, macOS, and Windows client devices. On user devices, your Wi-Fi connection is shown as an available connection. Users select it. And, depending on the settings in your Wi-Fi profile, users can automatically authenticate and connect to the Wi-Fi on their devices. +Intune has built-in Wi-Fi settings for Android, iOS/iPadOS, macOS, and Windows client devices. On user devices, your Wi-Fi connection is shown as an available connection. Users select it. And, depending on the settings in your Wi-Fi profile, users can automatically authenticate and connect to the Wi-Fi on their devices. -✔️ **Deploy anytime** +✅ **Deploy anytime** -On new devices, it's recommended to deploy the Wi-Fi device configuration policy when devices enroll in Intune. +On new devices, we recommended you deploy the Wi-Fi device configuration policy when devices enroll in Intune. If you have existing devices, you can deploy the Wi-Fi device configuration policy at any time. @@ -362,7 +362,7 @@ To get started: ## Level 2 - Enhanced protection and configuration -This level expands on what you've configured in level 1 and adds more security for your devices. In this section, you create a level 2 set of policies that configure more security settings for your devices. +This level expands on what you configured in level 1 and adds more security for your devices. In this section, you create a level 2 set of policies that configure more security settings for your devices. Microsoft recommends the following level 2 security policies: @@ -385,7 +385,7 @@ Microsoft recommends the following level 2 security policies: For more specific information, go to [Introduction to Apple platform security](https://support.apple.com/guide/security/intro-to-apple-platform-security-seccd5016d31/web) and [Secure Enclave](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/web) (opens Apple's web site). - There are Intune policies that focus on password settings and encrypting backups. + There are Intune policy settings that focus on [password settings and encrypting backups](../configuration/device-restrictions-ios.md). # [macOS](#tab/macos-disk) @@ -458,17 +458,17 @@ Microsoft recommends the following level 2 security policies: - Windows -- If you use **on-premises GPOs** and want to know if these same settings are available in Intune, then use Group Policy analytics. This feature analyzes your GPOs and depending on the analysis, can import them into an Intune settings catalog policy. +- If you use **on-premises GPOs** and want to know if these same settings are available in Intune, then use [Group Policy analytics](../configuration/group-policy-analytics.md). This feature analyzes your GPOs and depending on the analysis, can import them into an Intune settings catalog policy. For more information, go to [Analyze your on-premises GPOs and import them in Intune](../configuration/group-policy-analytics.md). ## Level 3 - High protection and configuration -This level expands on what you've configured in levels 1 and 2. It adds extra security features used in enterprise level organizations. +This level expands on what you configured in levels 1 and 2. It adds extra security features used in enterprise level organizations. - **Expand password-less authentication** to other services used by your workforce. In level 1, you enabled biometrics so users can sign in to their devices with a fingerprint or facial recognition. In this level, expand password-less to other parts of the organization. - - **Use certificates to authenticate** email, VPN, and Wi-Fi connections. Certificates are deployed to users and devices, and are then used by users to get access to resources in your organization through these email, VPN, and Wi-Fi connections. + - **Use certificates to authenticate** email, VPN, and Wi-Fi connections. Certificates are deployed to users and devices, and are then used by users to get access to resources in your organization through the email, VPN, and Wi-Fi connections. To learn more about using certificates in Intune, go to: @@ -497,17 +497,21 @@ This level expands on what you've configured in levels 1 and 2. It adds extra se - In addition to Microsoft Tunnel for devices enrolled with Intune, you can use **Microsoft Tunnel for Mobile Application Management** (Tunnel for MAM) to extend tunnel capabilities to Android and iOS/iPad devices that are *not enrolled* with Intune. [Tunnel for MAM](../protect/microsoft-tunnel-mam.md) is available as an Intune add-on that requires an extra license. - For more information, see [Use Intune Suite add-on capabilities](../fundamentals/intune-add-ons.md). + For more information, go to [Use Intune Suite add-on capabilities](../fundamentals/intune-add-ons.md). -- **Use Windows Local Administrator Password Solution (LAPS) policy** to manage and back up the built-in local administrator account on your Windows devices. Because the local admin account can’t be deleted and has full permissions to the device, management of the built-in Windows administrator account is an important step in securing your organization. Intune policy for Windows LAPS uses the capabilities that are available for Windows devices that run version 21h2 or later. +- **Use Windows Local Administrator Password Solution (LAPS) policy** to manage and back up the built-in local administrator account on your Windows devices. Because the local admin account can't be deleted and has full permissions to the device, management of the built-in Windows administrator account is an important step in securing your organization. Intune policy for Windows LAPS uses the capabilities that are available for Windows devices that run version 21h2 or later. - For more information, see [Intune support for Windows LAPS](../protect/windows-laps-overview.md). + For more information, go to [Intune support for Windows LAPS](../protect/windows-laps-overview.md). - Use **Microsoft Intune Endpoint Privilege Management** (EPM) to reduce the attack surface of your Windows devices. EPM empowers you to have users that run as standard users (without administrator rights) yet remain productive by determining when those users can run apps in an elevated context. - EPM elevation rules can be based on file hashes, certificate rules, and more. The rules you configure help to ensure that only the expected and trusted applications you allow can run as elevated. Rules can manage the child processes that an app creates, support requests by users to elevate a managed process, and allow for automatic elevations of files that just need to run without any user interruption. + EPM elevation rules can be based on file hashes, certificate rules, and more. The rules you configure help to ensure that only the expected and trusted applications you allow can run as elevated. Rules can: - [Endpoint Privilege Management](../protect/epm-overview.md) is available as an Intune add-on that requires an extra license. For more information, see [Use Intune Suite add-on capabilities](../fundamentals/intune-add-ons.md). + - Manage the child processes that an app creates. + - Support requests by users to elevate a managed process. + - Allow for automatic elevations of files that just need to run without any user interruption. + + [Endpoint Privilege Management](../protect/epm-overview.md) is available as an Intune add-on that requires an extra license. For more information, go to [Use Intune Suite add-on capabilities](../fundamentals/intune-add-ons.md). - **Use Android Common Criteria mode** on Android devices that are used by highly sensitive organizations, like government establishments. @@ -528,9 +532,8 @@ This level expands on what you've configured in levels 1 and 2. It adds extra se - **Android device administrator** - [Use and manage Zebra devices with Zebra Mobility Extensions](../configuration/android-zebra-mx-overview.md) - [Device settings to run as a kiosk](../configuration/device-restrictions-android.md#kiosk) - - [!INCLUDE [android_device_administrator_support](../includes/android-device-administrator-support.md)] + [!INCLUDE [android_device_administrator_support](../includes/android-device-administrator-support.md)] # [iOS/iPadOS](#tab/ios-kiosk) diff --git a/memdocs/intune/fundamentals/filters-device-properties.md b/memdocs/intune/fundamentals/filters-device-properties.md index a86409ebbf8..23deca8fafb 100644 --- a/memdocs/intune/fundamentals/filters-device-properties.md +++ b/memdocs/intune/fundamentals/filters-device-properties.md @@ -7,7 +7,7 @@ keywords: author: MandiOhlinger ms.author: mandia manager: dougeby -ms.date: 07/18/2024 +ms.date: 08/21/2024 ms.topic: conceptual ms.service: microsoft-intune ms.subservice: fundamentals @@ -43,37 +43,49 @@ Advanced rule editing is also available. You can use common operators, such as ` This article describes the different [managed device properties](#managed-device-properties), [managed app properties](#managed-app-properties), and [operators](#supported-operators) you can use in your filters, and gives examples. - - [!INCLUDE [android_device_administrator_support](../includes/android-device-administrator-support.md)] +[!INCLUDE [android_device_administrator_support](../includes/android-device-administrator-support.md)] ## Managed device properties You can use the following device properties in your managed device filter rules: -- **`deviceName` (Device Name)**: Create a filter rule based on the Intune device name property. Enter a string value for the device's full name (using `-eq`, `-ne`, `-in`, `-notIn` operators), or partial value (using `-startswith`, `-contains`, `-notcontains` operators). +- **`cpuArchitecture` (CPU Architecture)**: Create a filter rule based on the Intune device CPU architecture property. + + For Windows, your options are (with `-eq`, `-ne`, `-in`, `-notIn` operators): + + - amd64 + - x86 + - arm64 + - unknown + + For macOS, your options are (with `-eq`, `-ne`, `-in`, `-notIn` operators): + + - x64 + - arm64 + - unknown Examples: - - `(device.deviceName -eq "Scott's Device")` - - `(device.deviceName -in ["Scott's device", "Sara's device"])` - - `(device.deviceName -startsWith "S")` + - `(device.cpuArchitecture -eq "arm64")` + - `(device.cpuArchitecture -in ["x64", "arm64"])` + - `(device.cpuArchitecture -eq "unknown")` This property applies to: - - Android device administrator - - Android Enterprise - - Android (AOSP) - - iOS/iPadOS - macOS - Windows 11 - Windows 10 -- **`manufacturer` (Manufacturer)**: Create a filter rule based on the Intune device manufacturer property. Enter the full string value (using `-eq`, `-ne`, `-in`, `-notIn` operators), or partial value (using `-startswith`, `-contains`, `-notcontains` operators). + > [!NOTE] + > Currently, enrollment scenarios don't support the `cpuArchitecture` property. Support will be added in a future update (no ETA). + +- **`deviceCategory` (Device Category)**: Create a filter rule based on the Intune device category property. Enter the full string value (using `-eq`, `-ne`, `-in`, `-notIn` operators), or partial value (using `-startswith`, `-contains`, `-notcontains` operators). Examples: - - `(device.manufacturer -eq "Microsoft")` - - `(device.manufacturer -startsWith "Micro")` + - `(device.deviceCategory -eq "Engineering devices")` + - `(device.deviceCategory -contains "Engineering")` + - `(device.model -startsWith "E")` This property applies to: @@ -85,17 +97,13 @@ You can use the following device properties in your managed device filter rules: - Windows 11 - Windows 10 -- **`model` (Model)**: Create a filter rule based on the Intune device model property. Enter the full string value (using `-eq`, `-ne`, `-in`, `-notIn` operators), or partial value (using `-startswith`, `-contains`, `-notcontains` operators). +- **`deviceName` (Device Name)**: Create a filter rule based on the Intune device name property. Enter a string value for the device's full name (using `-eq`, `-ne`, `-in`, `-notIn` operators), or partial value (using `-startswith`, `-contains`, `-notcontains` operators). - For iOS/iPadOS and macOS devices, use the model, not the product name. Only the model is recognized for Apple devices. For example, for iPhone 8 devices, enter the model as `iPhone 8`. - Examples: - - `(device.model -eq "Surface Book 3")` - - `(device.model -in ["Surface Book 3", "Surface Book 2"])` - - `(device.model -startsWith "Surface Book")` - - `(device.model -startsWith "MacBookPro")` - - `(device.model -startsWith "iPhone 8")` + - `(device.deviceName -eq "Scott's Device")` + - `(device.deviceName -in ["Scott's device", "Sara's device"])` + - `(device.deviceName -startsWith "S")` This property applies to: @@ -107,13 +115,11 @@ You can use the following device properties in your managed device filter rules: - Windows 11 - Windows 10 -- **`deviceCategory` (Device Category)**: Create a filter rule based on the Intune device category property. Enter the full string value (using `-eq`, `-ne`, `-in`, `-notIn` operators), or partial value (using `-startswith`, `-contains`, `-notcontains` operators). +- **`deviceOwnership` (Ownership)**: Create a filter rule based on the device's ownership property in Intune. Select `Personal`, `Corporate`, or unknown values using the `-eq` and `-ne` operators. - Examples: + Example: - - `(device.deviceCategory -eq "Engineering devices")` - - `(device.deviceCategory -contains "Engineering")` - - `(device.model -startsWith "E")` + - `(device.deviceOwnership -eq "Personal")` This property applies to: @@ -125,54 +131,39 @@ You can use the following device properties in your managed device filter rules: - Windows 11 - Windows 10 -- **`operatingSystemVersion` (Operating System Version)**: Create a filter rule based on the Intune device operating system (OS) version. Enter a version value (using `-eq`, `-ne`, `-gt`, `-ge`, `-lt`, `-le` operators). +- **`deviceTrustType` (Microsoft Entra join type)**: Create a filter rule based on the device's Microsoft Entra join type. Choose between Azure AD joined, Azure AD registered, Hybrid Azure AD joined, or Unknown values (with `-eq`, `-ne`, `-in`, `-notIn` operators). Examples: - - `(device.operatingSystemVersion -eq 14.2.1)` - - `(device.operatingSystemVersion -gt 10.0.22000.1000)` - - `(device.operatingSystemVersion -le 10.0.22631.3235)` - - For a list of supported operators, go to [operatingSystemVersion supported operators](#operatingsystemversion-supported-operators) (in this article). + - `(device.deviceTrustType -eq "Azure AD joined")` + - `(device.deviceTrustType -ne "Azure AD registered")` + - `(device.deviceTrustType -in ["Hybrid Azure AD joined","Azure AD joined"])` This property applies to: - - Android device administrator - - Android Enterprise - - Android (AOSP) - - iOS/iPadOS - - macOS - Windows 11 - Windows 10 > [!NOTE] - > The `operatingSystemVersion` property is in public preview. For more information on what that means, go to [Public preview in Microsoft Intune](../fundamentals/public-preview.md). + > The `deviceTrustType` property exists in Microsoft Entra ID and Intune. The values in this Intune filters article apply to Intune. They don't apply to Microsoft Entra ID. -- **`osVersion` (OS Version)**: Create a filter rule based on the Intune device operating system (OS) version. Enter the full string value (using `-eq`, `-ne`, `-in`, `-notIn` operators), or partial value (using `-startswith`, `-contains`, `-notcontains` operators). +- **`enrollmentProfileName` (Enrollment profile name)**: Create a filter rule based on the enrollment profile name. This property is applied to a device when the device enrolls. It's a string value created by you, and matches the Windows Autopilot, Apple Automated Device Enrollment (ADE), or Google enrollment profile applied to the device. To see your enrollment profile names, sign in to the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), and go to **Devices** > **Enroll devices**. - > [!TIP] - > The `osVersion` property is being deprecated. Instead, use the `operatingSystemVersion` property. When `operatingSystemVersion` is generally available (GA), the `osVersion` property will retire, and you won't be able to create new filters using this property. Existing filters that use `osVersion` continue to work. + Enter the full string value (using `-eq`, `-ne`, `-in`, `-notIn` operators), or partial value (using `-startswith`, `-contains`, `-notcontains` operators). Examples: - - `(device.osVersion -eq "14.2.1")` - - `(device.osVersion -in ["10.15.3 (19D2064)","10.14.2 (18C54)"])` - - `(device.osVersion -startsWith "10.0.18362")` + - `(device.enrollmentProfileName -eq "DEP iPhones")` + - `(device.enrollmentProfileName -startsWith "Autopilot Profile")` + - `(device.enrollmentProfileName -ne $null)` This property applies to: - - Android device administrator - Android Enterprise - Android (AOSP) - iOS/iPadOS - - macOS - Windows 11 - Windows 10 - - > [!NOTE] - > For Apple devices, the `OSversion` property doesn't include Apple's Security Patch Version (SPV) information. The SPV is the letter after the version number, like `14.1.2a`. When creating filters for Apple devices, don't include the SPV in the `OSversion` rule syntax. - - - **`IsRooted` (Rooted or jailbroken)**: Create a filter rule based on the device's rooted (Android) or jailbroken (iOS/iPadOS) device property. Select `True`, `False`, or unknown values using the `-eq` and `-ne` operators. @@ -187,11 +178,12 @@ You can use the following device properties in your managed device filter rules: - Android (AOSP) - iOS/iPadOS -- **`deviceOwnership` (Ownership)**: Create a filter rule based on the device's ownership property in Intune. Select `Personal`, `Corporate`, or unknown values using the `-eq` and `-ne` operators. +- **`manufacturer` (Manufacturer)**: Create a filter rule based on the Intune device manufacturer property. Enter the full string value (using `-eq`, `-ne`, `-in`, `-notIn` operators), or partial value (using `-startswith`, `-contains`, `-notcontains` operators). - Example: + Examples: - - `(device.deviceOwnership -eq "Personal")` + - `(device.manufacturer -eq "Microsoft")` + - `(device.manufacturer -startsWith "Micro")` This property applies to: @@ -203,40 +195,75 @@ You can use the following device properties in your managed device filter rules: - Windows 11 - Windows 10 -- **`enrollmentProfileName` (Enrollment profile name)**: Create a filter rule based on the enrollment profile name. This property is applied to a device when the device enrolls. It's a string value created by you, and matches the Windows Autopilot, Apple Automated Device Enrollment (ADE), or Google enrollment profile applied to the device. To see your enrollment profile names, sign in to the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), and go to **Devices** > **Enroll devices**. - - Enter the full string value (using `-eq`, `-ne`, `-in`, `-notIn` operators), or partial value (using `-startswith`, `-contains`, `-notcontains` operators). +- **`model` (Model)**: Create a filter rule based on the Intune device model property. Enter the full string value (using `-eq`, `-ne`, `-in`, `-notIn` operators), or partial value (using `-startswith`, `-contains`, `-notcontains` operators). + For iOS/iPadOS and macOS devices, use the model, not the product name. Only the model is recognized for Apple devices. For example, for iPhone 8 devices, enter the model as `iPhone 8`. + Examples: - - `(device.enrollmentProfileName -eq "DEP iPhones")` - - `(device.enrollmentProfileName -startsWith "Autopilot Profile")` - - `(device.enrollmentProfileName -ne $null)` + - `(device.model -eq "Surface Book 3")` + - `(device.model -in ["Surface Book 3", "Surface Book 2"])` + - `(device.model -startsWith "Surface Book")` + - `(device.model -startsWith "MacBookPro")` + - `(device.model -startsWith "iPhone 8")` This property applies to: + - Android device administrator - Android Enterprise - Android (AOSP) - iOS/iPadOS + - macOS - Windows 11 - Windows 10 -- **`deviceTrustType` (Microsoft Entra join type)**: Create a filter rule based on the device's Microsoft Entra join type. Choose between Azure AD joined, Azure AD registered, Hybrid Azure AD joined, or Unknown values (with `-eq`, `-ne`, `-in`, `-notIn` operators). +- **`operatingSystemVersion` (Operating System Version)**: Create a filter rule based on the Intune device operating system (OS) version. Enter a version value (using `-eq`, `-ne`, `-gt`, `-ge`, `-lt`, `-le` operators). Examples: - - `(device.deviceTrustType -eq "Azure AD joined")` - - `(device.deviceTrustType -ne "Azure AD registered")` - - `(device.deviceTrustType -in ["Hybrid Azure AD joined","Azure AD joined"])` + - `(device.operatingSystemVersion -eq 14.2.1)` + - `(device.operatingSystemVersion -gt 10.0.22000.1000)` + - `(device.operatingSystemVersion -le 10.0.22631.3235)` + + For a list of supported operators, go to [operatingSystemVersion supported operators](#operatingsystemversion-supported-operators) (in this article). This property applies to: + - Android device administrator + - Android Enterprise + - Android (AOSP) + - iOS/iPadOS + - macOS - Windows 11 - Windows 10 > [!NOTE] - > The `deviceTrustType` property exists in Microsoft Entra ID and Intune. The values in this Intune filters article apply to Intune. They don't apply to Microsoft Entra ID. - + > The `operatingSystemVersion` property is in public preview. For more information on what that means, go to [Public preview in Microsoft Intune](../fundamentals/public-preview.md). + +- **`osVersion` (OS Version)**: Create a filter rule based on the Intune device operating system (OS) version. Enter the full string value (using `-eq`, `-ne`, `-in`, `-notIn` operators), or partial value (using `-startswith`, `-contains`, `-notcontains` operators). + + > [!TIP] + > The `osVersion` property is being deprecated. Instead, use the `operatingSystemVersion` property. When `operatingSystemVersion` is generally available (GA), the `osVersion` property will retire, and you won't be able to create new filters using this property. Existing filters that use `osVersion` continue to work. + + Examples: + + - `(device.osVersion -eq "14.2.1")` + - `(device.osVersion -in ["10.15.3 (19D2064)","10.14.2 (18C54)"])` + - `(device.osVersion -startsWith "10.0.18362")` + + This property applies to: + + - Android device administrator + - Android Enterprise + - Android (AOSP) + - iOS/iPadOS + - macOS + - Windows 11 + - Windows 10 + + > [!NOTE] + > For Apple devices, the `OSversion` property doesn't include Apple's Security Patch Version (SPV) information. The SPV is the letter after the version number, like `14.1.2a`. When creating filters for Apple devices, don't include the SPV in the `OSversion` rule syntax. + - **`operatingSystemSKU` (Operating System SKU)**: Create a filter rule based on the device's Windows client OS SKU. Enter the full string value (using `-eq`, `-ne`, `-in`, `-notIn` operators), or partial value (using `-startswith`, `-contains`, `-notcontains` operators). Examples: diff --git a/memdocs/intune/fundamentals/filters-supported-workloads.md b/memdocs/intune/fundamentals/filters-supported-workloads.md index 53b9e689ec8..d694ff1255c 100644 --- a/memdocs/intune/fundamentals/filters-supported-workloads.md +++ b/memdocs/intune/fundamentals/filters-supported-workloads.md @@ -40,7 +40,7 @@ This article assumes you're familiar with filters. If not, learn more at [Use fi ## Before you begin -- ✔️: Supports filters. +- ✅: Supports filters. - ❌: Doesn't support filters. - N/A: Doesn't apply to the platform. @@ -58,10 +58,10 @@ You can use filters for some common app policies on the following platforms. For | Microsoft Defender for Endpoint | N/A | | Web link | N/A | | Line-of-business apps | N/A | -| Android Enterprise system app | ✔️ | -| Managed Google Play store app | ✔️ | -| Managed Google Play web link | ✔️ | -| Managed Android line-of-business app | ✔️ | +| Android Enterprise system app | ✅ | +| Managed Google Play store app | ✅ | +| Managed Google Play web link | ✅ | +| Managed Android line-of-business app | ✅ | > [!NOTE] > Filters aren't supported on Android Enterprise personally-owned devices with work profile (BYOD) when used in "Available" app assignments. If users are targeted with an "Available" app intent, then the app continues to show as available to install from the Google managed play store. Any include or exclude filtering is ignored. @@ -70,12 +70,12 @@ You can use filters for some common app policies on the following platforms. For | App type | Supported | | --- | --- | -| Store app | ✔️ | +| Store app | ✅ | | Microsoft 365 apps | N/A | | Microsoft Edge version 77 and newer | N/A | | Microsoft Defender for Endpoint | N/A | | Web link | ❌ | -| Line-of-business apps | ✔️ | +| Line-of-business apps | ✅ | [!INCLUDE [android_device_administrator_support](../includes/android-device-administrator-support.md)] @@ -84,39 +84,39 @@ You can use filters for some common app policies on the following platforms. For | App type | Supported | | --- | --- | -| Store app | ✔️ | +| Store app | ✅ | | Microsoft 365 apps | N/A | | Microsoft Edge version 77 and newer | N/A | | Microsoft Defender for Endpoint | N/A | | Web link | ❌ | -| iOS/iPadOS web clip | ✔️ | -| Line-of-business apps | ✔️ | -| iOS/iPadOS volume purchase program (VPP) app | ✔️ | +| iOS/iPadOS web clip | ✅ | +| Line-of-business apps | ✅ | +| iOS/iPadOS volume purchase program (VPP) app | ✅ | ### macOS | App type | Supported | | --- | --- | | Store app | N/A | -| Microsoft 365 apps | ✔️ | -| Microsoft Edge version 77 and newer | ✔️ | -| Microsoft Defender for Endpoint | ✔️ | +| Microsoft 365 apps | ✅ | +| Microsoft Edge version 77 and newer | ✅ | +| Microsoft Defender for Endpoint | ✅ | | Web link | ❌ | -| Line-of-business apps | ✔️ | +| Line-of-business apps | ✅ | ### Windows 10/11 | App type | Supported | | --- | --- | -| Store app | ✔️ | -| Microsoft 365 apps | ✔️ | -| Microsoft Edge version 77 and newer | ✔️ | +| Store app | ✅ | +| Microsoft 365 apps | ✅ | +| Microsoft Edge version 77 and newer | ✅ | | Microsoft Defender for Endpoint | N/A | | Web link | ❌ | -| Windows web link | ✔️ | -| Line-of-business apps | ✔️ | -| Windows app (Win32) | ✔️ | -| Microsoft Store for Business | ✔️ | +| Windows web link | ✅ | +| Line-of-business apps | ✅ | +| Windows app (Win32) | ✅ | +| Microsoft Store for Business | ✅ | ## [App configuration policies](../apps/app-configuration-policies-overview.md) @@ -170,23 +170,23 @@ You can use filters for some common app policies on the following platforms. For | Profile type | Supported | | --- | --- | | **Device configuration profile** |   | -| Custom | ✔️ | +| Custom | ✅ | | Derived credential | N/A | -| Device restrictions | ✔️ | +| Device restrictions | ✅ | | Device restrictions (Windows 10 Team) | N/A | | Device features | N/A | | Email | N/A | -| Email (Samsung KNOX only) | ✔️ | +| Email (Samsung KNOX only) | ✅ | | Endpoint Protection | N/A | | Enrollment device platform restrictions | ❌ | -| MX profile (Zebra only) | ✔️ | -| PKCS certificate | ✔️ | -| PKCS imported certificate | ✔️ | -| SCEP certificate | ✔️ | +| MX profile (Zebra only) | ✅ | +| PKCS certificate | ✅ | +| PKCS imported certificate | ✅ | +| SCEP certificate | ✅ | | Settings catalog | N/A | -| Trusted certificate | ✔️ | -| VPN | ✔️ | -| Wi-Fi | ✔️ | +| Trusted certificate | ✅ | +| VPN | ✅ | +| Wi-Fi | ✅ | |   |   | | **Endpoint Security profile** |   | | Account protection | N/A | @@ -202,22 +202,22 @@ You can use filters for some common app policies on the following platforms. For | Profile type | Supported | | --- | --- | | **Device configuration profile** |   | -| Custom | ✔️ | -| Derived credential | ✔️ | -| Device restrictions | ✔️ | +| Custom | ✅ | +| Derived credential | ✅ | +| Device restrictions | ✅ | | Device Restrictions (Windows 10 Team) | N/A | | Device Features | N/A | -| Email | ✔️ | +| Email | ✅ | | Endpoint Protection | N/A | | Enrollment device platform restrictions | ❌ | -| OEMConfig | ✔️ | -| PKCS certificate | ✔️ | -| PKCS imported certificate | ✔️ | -| SCEP certificate | ✔️ | +| OEMConfig | ✅ | +| PKCS certificate | ✅ | +| PKCS imported certificate | ✅ | +| SCEP certificate | ✅ | | Settings catalog | N/A | -| Trusted certificate | ✔️ | -| VPN | ✔️ | -| Wi-Fi | ✔️ | +| Trusted certificate | ✅ | +| VPN | ✅ | +| Wi-Fi | ✅ | |   |   | | **Endpoint Security profile** |   | | Account protection | N/A | @@ -233,31 +233,31 @@ You can use filters for some common app policies on the following platforms. For | Profile type | Supported | | --- | --- | | **Device configuration profile** |   | -| Device restrictions | ✔️ | -| PKCS certificate | ✔️ | -| SCEP certificate | ✔️ | -| Trusted certificate | ✔️ | +| Device restrictions | ✅ | +| PKCS certificate | ✅ | +| SCEP certificate | ✅ | +| Trusted certificate | ✅ | ### iOS/iPadOS | Profile type | Supported | | --- | --- | | **Device configuration profile** |   | -| Custom | ✔️ | -| Derived credential | ✔️ | -| Device restrictions | ✔️ | +| Custom | ✅ | +| Derived credential | ✅ | +| Device restrictions | ✅ | | Device Restrictions (Windows 10 Team) | N/A | -| Device Features | ✔️ | -| Email | ✔️ | +| Device Features | ✅ | +| Email | ✅ | | Endpoint Protection | N/A | -| Enrollment device platform restrictions | ✔️ | -| PKCS certificate | ✔️ | -| PKCS imported certificate | ✔️ | -| SCEP certificate | ✔️ | +| Enrollment device platform restrictions | ✅ | +| PKCS certificate | ✅ | +| PKCS imported certificate | ✅ | +| SCEP certificate | ✅ | | Settings catalog | N/A | -| Trusted certificate | ✔️ | -| VPN | ✔️ | -| Wi-Fi | ✔️ | +| Trusted certificate | ✅ | +| VPN | ✅ | +| Wi-Fi | ✅ | |   |   | | **Endpoint Security profile** |   | | Account protection | N/A | @@ -273,24 +273,24 @@ You can use filters for some common app policies on the following platforms. For | Profile type | Supported | | --- | --- | | **Device configuration profile** |   | -| Custom | ✔️ | +| Custom | ✅ | | Derived credential | N/A | -| Device restrictions | ✔️ | +| Device restrictions | ✅ | | Device restrictions (Windows 10 Team) | N/A | -| Device features | ✔️ | +| Device features | ✅ | | Email | N/A | -| Endpoint Protection | ✔️ | -| Enrollment device platform restrictions | ✔️ | -| Extensions | ✔️ | -| PKCS certificate | ✔️ | -| PKCS imported certificate | ✔️ | -| Preference file | ✔️ | -| SCEP certificate | ✔️ | -| Settings catalog | ✔️ | -| Trusted certificate | ✔️ | -| VPN | ✔️ | -| Wi-Fi | ✔️ | -| Wired network | ✔️ | +| Endpoint Protection | ✅ | +| Enrollment device platform restrictions | ✅ | +| Extensions | ✅ | +| PKCS certificate | ✅ | +| PKCS imported certificate | ✅ | +| Preference file | ✅ | +| SCEP certificate | ✅ | +| Settings catalog | ✅ | +| Trusted certificate | ✅ | +| VPN | ✅ | +| Wi-Fi | ✅ | +| Wired network | ✅ | |   |   | | **Endpoint Security profile** |   | | Account protection | N/A | @@ -305,46 +305,46 @@ You can use filters for some common app policies on the following platforms. For | Profile type | Supported | | --- | --- | -| Update rings for Windows 10/11 | ✔️ | +| Update rings for Windows 10/11 | ✅ | |   |   | | **Device configuration profile** |   | -| Administrative Templates | ✔️ | -| Custom | ✔️ | +| Administrative Templates | ✅ | +| Custom | ✅ | | Derived credential | N/A | -| Delivery optimization | ✔️ | -| Device restrictions | ✔️ | -| Device Restrictions (Windows 10 Team) | ✔️ | +| Delivery optimization | ✅ | +| Device restrictions | ✅ | +| Device Restrictions (Windows 10 Team) | ✅ | | Device Features | N/A | -| Device Firmware Configuration Interface (DFCI) on Windows 11 and Windows 10 RS5 (1809)+ on supported UEFI | ✔️ | -| Domain Join | ✔️ | -| Edition upgrade and S mode switch | ✔️ | -| Email | ✔️ | -| Endpoint analytics Remediations scripts|✔️ | -| Endpoint Protection | ✔️ | -| Enrollment device platform restrictions | ✔️
Support for a subset of filter properties including device `osVersion`, `operatingSystemSKU`, and `enrollmentProfileName` | -| Kiosk | ✔️ | -| Network boundary | ✔️ | -| PKCS certificate | ✔️ | -| PKCS imported certificate | ✔️ | -| SCEP certificate | ✔️ | -| Secure assessment (Education) | ✔️ | -| Settings catalog | ✔️ | -| Shared multi-user device | ✔️ | -| Trusted certificate | ✔️ | -| VPN | ✔️ | -| Wi-Fi | ✔️ | +| Device Firmware Configuration Interface (DFCI) on Windows 11 and Windows 10 RS5 (1809)+ on supported UEFI | ✅ | +| Domain Join | ✅ | +| Edition upgrade and S mode switch | ✅ | +| Email | ✅ | +| Endpoint analytics Remediations scripts|✅ | +| Endpoint Protection | ✅ | +| Enrollment device platform restrictions | ✅
Support for a subset of filter properties including device `osVersion`, `operatingSystemSKU`, and `enrollmentProfileName` | +| Kiosk | ✅ | +| Network boundary | ✅ | +| PKCS certificate | ✅ | +| PKCS imported certificate | ✅ | +| SCEP certificate | ✅ | +| Secure assessment (Education) | ✅ | +| Settings catalog | ✅ | +| Shared multi-user device | ✅ | +| Trusted certificate | ✅ | +| VPN | ✅ | +| Wi-Fi | ✅ | | Wired network | ❌ | -| Windows health monitoring | ✔️ | +| Windows health monitoring | ✅ | |   |   | | **Endpoint Security profile** |   | -| Account protection | ✔️
**Account protection**, **Local user group membership**, and **Local admin password solution (Windows LAPS)** | -| Antivirus | ✔️ | -| Attack surface reduction | ✔️
Excludes **Web protection (Microsoft Edge Legacy)**, **Application control**, and **App and browser isolation** | -| Disk encryption | ✔️ | -| Endpoint detection and response | ✔️ | -| Endpoint Privilege Management (EPM) |✔️ | -| Firewall | ✔️ | -| Microsoft Defender for Endpoint (Windows 10/11 Desktop) | ✔️ | +| Account protection | ✅
**Account protection**, **Local user group membership**, and **Local admin password solution (Windows LAPS)** | +| Antivirus | ✅ | +| Attack surface reduction | ✅
Excludes **Web protection (Microsoft Edge Legacy)**, **Application control**, and **App and browser isolation** | +| Disk encryption | ✅ | +| Endpoint detection and response | ✅ | +| Endpoint Privilege Management (EPM) |✅ | +| Firewall | ✅ | +| Microsoft Defender for Endpoint (Windows 10/11 Desktop) | ✅ | | Security baselines | ❌ | ## Not supported on managed devices diff --git a/memdocs/intune/fundamentals/get-started-with-intune.md b/memdocs/intune/fundamentals/get-started-with-intune.md index 0ed8b39e327..5cfa06bac1c 100644 --- a/memdocs/intune/fundamentals/get-started-with-intune.md +++ b/memdocs/intune/fundamentals/get-started-with-intune.md @@ -81,7 +81,7 @@ This article provides an overview of the steps to start your Intune deployment. In this step: -✔️ **Confirm your devices are supported, create your Intune tenant, add users & groups, assign licenses**, and more. +✅ **Confirm your devices are supported, create your Intune tenant, add users & groups, assign licenses**, and more. This step focuses on setting up Intune and getting it ready for you to manage your user identities, apps, and devices. Intune uses many features in Microsoft Entra ID, including your domain, your users, and your groups. @@ -91,9 +91,9 @@ For more information, go to [Step 1 - Set up Microsoft Intune](deployment-plan-s In this step: -✔️ **On devices that will enroll** in Intune, create a baseline of apps that devices must have, and then assign these app policies during enrollment. On apps that need extra security, also use app protection policies. +✅ **On devices that will enroll** in Intune, create a baseline of apps that devices must have, and then assign these app policies during enrollment. On apps that need extra security, also use app protection policies. -✔️ **On devices that won't enroll** in Intune, use app protection policies and multifactor authentication (MFA): +✅ **On devices that won't enroll** in Intune, use app protection policies and multifactor authentication (MFA): - App protection policies help protect organization data on personal devices. - MFA helps protect your organization's data from unauthorized access. @@ -116,9 +116,9 @@ If users with their own personal devices access organization resources, then you In this step: -✔️ **Create a baseline of compliance policies** that devices must have, and then assign these compliance policies during enrollment. +✅ **Create a baseline of compliance policies** that devices must have, and then assign these compliance policies during enrollment. -✔️ **Enable Conditional Access** to enforce your compliance policies. +✅ **Enable Conditional Access** to enforce your compliance policies. For more information, go to [Step 3 – Plan for compliance policies](deployment-plan-compliance-policies.md). @@ -139,7 +139,7 @@ If you prefer, you can enroll your devices before checking compliance. It's your In this step: -✔️ **Create baseline of security features and device features** that should be enabled or blocked. Assign these profiles during enrollment. +✅ **Create baseline of security features and device features** that should be enabled or blocked. Assign these profiles during enrollment. For more information, go to [Step 4 - Create device configuration profiles to secure devices and access organization resources](deployment-plan-configuration-profile.md). @@ -160,7 +160,7 @@ The following articles are good resources: In this step: -✔️ **Enroll your devices** in Intune. +✅ **Enroll your devices** in Intune. For more specific information, go to [Step 5 - Deployment guidance: Enroll devices in Microsoft Intune](deployment-guide-enrollment.md). diff --git a/memdocs/intune/fundamentals/in-development.md b/memdocs/intune/fundamentals/in-development.md index f4c34a5aa5a..6e6bd658959 100644 --- a/memdocs/intune/fundamentals/in-development.md +++ b/memdocs/intune/fundamentals/in-development.md @@ -7,7 +7,7 @@ keywords: author: dougeby ms.author: dougeby manager: dougeby -ms.date: 08/05/2024 +ms.date: 09/10/2024 ms.topic: conceptual ms.service: microsoft-intune ms.subservice: fundamentals @@ -61,30 +61,36 @@ You can use RSS to be notified when this article is updated. For more informatio ## Microsoft Intune Suite -### Easy creation of Endpoint Privilege Management elevation rules based on support approval requests +### Use Copilot with Endpoint Privilege Manager to help identify potential elevation risks -You’ll soon be able to create Endpoint Privilege Management (EPM) elevation rules directly from a support approval request or from details found in the Elevation report. This new process will replace the need to manually enter details about an elevation and how it should be managed, and supports creation of a new rules policy or adding the new rules to an existing policy. +We’re adding support for Copilot to help you investigate Endpoint Privilege Manager (EPM) elevation details. Copilot will help you evaluate information from you EPM elevation requests to identify potential indicators of compromise by using information from [Microsoft Defender](/defender-endpoint/microsoft-defender-endpoint). -Applies to: +EPM is available as an [Intune Suite add-on-capability](../fundamentals/intune-add-ons.md). To learn more about how you can use Copilot in Intune, see [Microsoft Copilot in Intune](../copilot/copilot-intune-overview.md). -- Windows 10 -- Windows 11 +### Endpoint Privilege Manager elevation rule support for file arguments and parameters + +Soon, the file elevation rules for Endpoint Privilege Manager (EPM) will support use of arguments or parameters that you want to allow. Arguments and parameters that aren't explicitly allowed will be blocked from use. This capability helps to improve control of the context for file elevations. -For information about using EPM, see [Endpoint Privilege Management overview](../protect/epm-overview.md). +EPM is available as an [Intune Suite add-on-capability](../fundamentals/intune-add-ons.md). -### Resource performance report for physical devices in Advanced Analytics + + +## App management -We're introducing a Resource performance report for Windows physical devices in Intune Advanced Analytics. The report will be included as an Intune-add on under Microsoft Intune Suite. +### New UI for Intune Company Portal app for Windows -The resource performance scores and insights for physical devices are aimed to help IT admins make CPU/RAM asset management and purchase decisions that improve the user experience while balancing hardware costs. +The UI for the Intune Company Portal app for Windows will be updated. Users will be able to use the same functionality they’re used to with an improved experience for their desktop app. With the updated design, users will see improvements in user experience for the **Home**, **Devices**, and **Downloads & updates** pages. The new design will be more intuitive and will highlight areas where users need to take action. -For more information, see [Microsoft Intune Suite](../fundamentals/intune-add-ons.md). +For more information, see [New look for Intune Company Portal app for Windows](https://techcommunity.microsoft.com/t5/intune-customer-success/new-look-for-intune-company-portal-app-for-windows/ba-p/4158755). -## App management +### Working Time settings for Microsoft Teams -### Managed Home Screen for Android Enterprise Fully Managed devices +Working time settings will allow you to enforce policies that limit access and to mute notifications received during non-working time on Microsoft Teams app. You'll be able to limit access by using App Protection Policies (APP) to block end users from using the iOS/iPadOS or Android Teams app during non-working time. Also, you'll be able to create a non-working time policy to mute notifications from the Teams app to end users during non-working time. -Managed Home Screen (MHS) will be supported on Android Enterprise Fully Managed devices. This capability will offer organizations the ability to leverage MHS in scenarios where a device is associated with a single user. +Applies to: + +- Android +- iOS/iPadOS ### Added protection for iOS/iPadOS app widgets @@ -98,48 +104,27 @@ Applies to: ## Device configuration -### Enhancements to multiple administrative approval +### New settings available in the Apple settings catalog -Multi administrative approval (MAA) adds the ability to limit application access policies to Windows applications or all non-Windows applications or both. We're adding a new access policy to the multiple administrative approval feature. +The [Settings Catalog](../configuration/settings-catalog.md) lists all the settings you can configure in a device policy, and all in one place. For more information about configuring Settings Catalog profiles in Intune, go to [Create a policy using settings catalog](../configuration/settings-catalog.md). -For more information, see [multiple admin approval](../fundamentals/multi-admin-approval.md). - -### New settings available in the Apple settings catalog - -The [Settings Catalog](../configuration/settings-catalog.md) lists all the settings you can configure in a device policy, and all in one place. For more information about configuring Settings Catalog profiles in Intune, see [Create a policy using settings catalog](../configuration/settings-catalog.md). - -There are new settings in the Apple Settings Catalog. To see these settings, in the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Devices** > **Manage devices** > **Configuration** > **Create** > **New policy** > **iOS/iPadOS** or **macOS** for platform > **Settings catalog** for profile type. +There are new settings in the Settings Catalog. To see these settings, in the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Devices** > **Manage devices** > **Configuration** > **Create** > **New policy** > **iOS/iPadOS** or **macOS** for platform > **Settings catalog** for profile type. #### iOS/iPadOS -**Declarative Device Management (DDM) > Safari Extension Settings**: - -- Managed Extensions - - Allowed Domains - - Denied Domains - - Private Browsing - - State +**Declarative Device Management (DDM) > Math Settings**: -**Declarative Device Management (DDM) > Software Update Settings**: +- Calculator + - Basic Mode + - Math Notes Mode + - Scientific Mode -- Automatic Actions - - Download - - Install OS Updates - -- Deferrals - - Combined Period In Days - -- Notifications - -- Rapid Security Response - - Enable - - Enable Rollback - -- Recommended Cadence +- System Behavior + - Keyboard Suggestions + - Math Notes **Restrictions**: -- Allow ESIM Outgoing Transfers - Allow Personalized Handwriting Results - Allow Video Conferencing Remote Control - Allow Genmoji @@ -148,56 +133,23 @@ There are new settings in the Apple Settings Catalog. To see these settings, in - Allow iPhone Mirroring - Allow Writing Tools -#### macOS - -**Authentication > Extensible Single Sign On (SSO)**: - -- Platform SSO - - Authentication Grace Period - - FileVault Policy - - Non Platform SSO Accounts - - Offline Grace Period - - Unlock Policy - -**Authentication > Extensible Single Sign On Kerberos**: +**Web Content Filter**: -- Allow Password -- Allow SmartCard -- Identity Issuer Auto Select Filter -- Start In Smart Card Mode +- Hide Deny List URLs -**Declarative Device Management (DDM) > Disk Management**: - -- External Storage -- Network Storage - -**Declarative Device Management (DDM) > Safari Extension Settings**: - -- Managed Extensions - - Allowed Domains - - Denied Domains - - Private Browsing - - State - -**Declarative Device Management (DDM) > Software Update Settings**: - -- Allow Standard User OS Updates - -- Automatic Actions - - Download - - Install OS Updates - - Install Security Update +#### macOS -- Deferrals - - Major Period In Days - - Minor Period In Days - - System Period In Days +**Declarative Device Management (DDM) > Math Settings**: -- Notifications +- Calculator + - Basic Mode + - Math Notes Mode + - Programmer Mode + - Scientific Mode -- Rapid Security Response - - Enable - - Enable Rollback +- System Behavior + - Keyboard Suggestions + - Math Notes **Restrictions**: @@ -206,119 +158,105 @@ There are new settings in the Apple Settings Catalog. To see these settings, in - Allow iPhone Mirroring - Allow Writing Tools -**System Policy > System Policy Control**: +**System Configuration > System Extensions**: -- Enable XProtect Malware Upload +- Non Removable From UI System Extensions +- Non Removable System Extensions - - -## Device enrollment - -### Support ending for Apple User Enrollment with Company Portal -After the release of iOS/iPadOS 18, Apple will no longer support profile-based Apple User Enrollment. As a result, Intune will end support for [user enrollment with Company Portal](../enrollment/apple-user-enrollment-with-company-portal.md) shortly after the release of iOS/iPadOS 18. +### Device Firmware Configuration Interface (DFCI) supports VAIO devices -After Intune ends support for user enrollment with Company Portal: +For Windows 10/11 devices, you can create a DFCI profile to manage UEFI (BIOS) settings. In [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Devices** > **Manage devices** > **Configuration** > **Create** > **New policy** > **Windows 10 and later** for platform > **Templates** > **Device Firmware Configuration Interface** for profile type. -- Existing enrolled devices won't be impacted. -- Users won't be able to enroll devices if they're targeted with this enrollment profile type. -- Microsoft Intune technical support will be available for existing enrolled devices with this enrollment profile type. Technical support won't be available for new enrollments. +Some VAIO devices running Windows 10/11 are enabled for DFCI. Contact your device vendor or device manufacturer for eligible devices. -To prepare, use a different management method to enroll devices. We recommend account-driven Apple User Enrollment for similar functionality and an improved user experience. For a simpler enrollment experience, try web- based device enrollment. For more information, see: +For more information about DFCI profiles, see: -- [Set up account-driven Apple User Enrollment](../enrollment/apple-account-driven-user-enrollment.md) -- [Set up web-based device enrollment for iOS/iPadOS](../enrollment/web-based-device-enrollment-ios.md) - -### Account-driven Apple User Enrollment to be generally available for iOS/iPadOS 15+ devices - -Intune will support account-driven Apple User Enrollment, the new and improved version of Apple User Enrollment, for devices running iOS/iPadOS 15 and later. This new enrollment method utilizes just-in-time registration, removing the Company Portal app for iOS as an enrollment requirement. Device users will be able to initiate enrollment directly in the Settings app, resulting in a shorter and more efficient onboarding experience. For more information, see [Set up account driven Apple User Enrollment](../enrollment/apple-account-driven-user-enrollment.md) on Microsoft Learn. - -If you prefer, you can continue to target iOS/iPadOS devices using the Apple User Enrollment method that requires Company Portal. Devices running iOS/iPadOS 14.8.1 and earlier will be unaffected by this update and can continue to use the method with Company Portal. +- [Configure Device Firmware Configuration Interface (DFCI) profiles on Windows devices in Microsoft Intune](../configuration/device-firmware-configuration-interface-windows.md) +- [Device Firmware Configuration Interface (DFCI) management with Windows Autopilot](../../autopilot/dfci-management.md) Applies to: -- iOS/iPadOS 15 and later - - - -## Device management +- Windows 10 +- Windows 11 -### Intune will support macOS 13.x as the minimum version +### Samsung ended support for multiple Android device administrator (DA) settings -With Apple's release of macOS 15 Sequoia, Microsoft Intune, the Company Portal app, and the Intune MDM agent will now require macOS 13 (Big Sur) and later. +On Android device administrator managed (DA) devices, Samsung has deprecated many [Samsung Knox APIs](https://docs.samsungknox.com/dev/knox-sdk/api-reference/deprecated-api-methods/) (opens Samsung's web site) configuration settings. -For more information on this change, see [Plan for change: Intune is moving to support macOS 13 and later](../fundamentals/whats-new.md#plan-for-change-intune-is-moving-to-support-macos-13-and-higher-later-this-year). +In Intune, this deprecation impacts the following device restrictions settings, compliance settings and trusted certificate profiles: -> [!NOTE] -> macOS devices enrolled through Automated Device Enrollment (ADE) have a slightly nuanced support statement due to their shared usage. For more information, see [Support statement](https://aka.ms/Intune/macOS/ADE-DE-support). +- [Device restriction settings for Android in Microsoft Intune](../configuration/device-restrictions-android.md) +- [View the Android device administrator compliance settings for Microsoft Intune compliance policies](../protect/compliance-policy-create-android.md) +- [Create trusted certificate profiles in Microsoft Intune](../protect/certificates-trusted-root.md#trusted-certificate-profiles-for-android-device-administrator) -Applies to: +In the Intune admin center, when you create or update a profile with these settings, the impacted settings are noted. -- macOS +Though the functionality might continue to work, there's no guarantee that it will continue working for any or all Android DA versions supported by Intune. For more information on Samsung support for deprecated APIs, see [What kind of support is offered after an API is deprecated?](https://docs.samsungknox.com/dev/knox-sdk/faqs/general/deprecated-api-support-change.htm) (opens Samsung's web site). -### Intune supports iOS/iPadOS 16.x as the minimum version +Instead, you can manage Android devices with Intune using one of the following Android Enterprise options: -Later this year, we expect iOS18 and iPadOS 18 to be released by Apple. Microsoft Intune, including the Intune Company Portal and Intune app protection policies (APP, also known as MAM), will require iOS/iPadOS 16 and higher shortly after the iOS/iPadOS 18 release. - -For more information on this change, see [Plan for change: Intune is moving to support iOS/iPadOS 16 and later](../fundamentals/whats-new.md#plan-for-change-intune-is-moving-to-support-iosipados-16-and-later). - -> [!NOTE] -> Userless iOS and iPadOS devices enrolled through Automated Device Enrollment (ADE) have a slightly nuanced support statement due to their shared usage. For more information, go to [Support statement for supported versus allowed iOS/iPadOS versions for user-less devices](https://aka.ms/ADE_userless_support). +- [Set up enrollment of Android Enterprise personally owned work profile devices](../enrollment/android-work-profile-enroll.md) +- [Set up Intune enrollment of Android Enterprise corporate-owned devices with work profile](../enrollment/android-corporate-owned-work-profile-enroll.md) +- [Set up enrollment for Android Enterprise fully managed devices](../enrollment/android-fully-managed-enroll.md) +- [Set up Intune enrollment of Android Enterprise dedicated devices](../enrollment/android-kiosk-enroll.md) +- [App protection policies overview](../apps/app-protection-policy.md) Applies to: -- iOS/iPadOS +- Android device administrator (DA) -### 21 Vianet support for Mobile Threat Defense connector support on 21Vianet +### Consent prompt update for remote log collection -Intune operated by 21Vianet will soon support Mobile Threat Defense (MTD) connectors for Android and iOS/iPadOS devices for MTD vendors that also have support in that environment. When an MTD partner is supported and you sign in to a 21Vianet tenant, the supported connectors will be available. +End users might see a different consent experience for remote log collection after the Android APP SDK 10.4.0 and iOS APP SDK 19.6.0 updates. End users will no longer see a common prompt from Intune and will only see a prompt from the application if it has one. Applies to: - Android - iOS/iPadOS -For more information, see: + + +## Device enrollment + +### New Setup Assistant screens available for configuration -- [Intune operated by 21Vianet in China](../fundamentals/china.md) -- [Mobile Threat Defense integration with Intune](../protect/mobile-threat-defense.md) +New Setup Assistant screens will be available to configure in the Microsoft Intune admin center. You can hide or show these screens during automated device enrollment. -### New `cpuArchitecture` filter device property for app and policy assignments +For macOS: -When you assign an app, compliance policy, or configuration profile, you can filter the assignment using different device properties, such as device manufacturer, operating system SKU, and more. +- **Wallpaper**: Show or hide the macOS Sonoma wallpaper setup pane that appears after an upgrade on devices running macOS 14 and later. +- **Lockdown mode**: Show or hide the macOS lockdown mode setup pane on devices running macOS 14 and later. +- **Intelligence**: Show or hide the intelligence setup pane on devices running macOS 15 and later. -A new `cpuArchitecture` device filter property is available for Windows and macOS devices. With this property, you can filter app and policy assignments depending on the processor architecture. +For iOS/iPadOS: -For more information on filters and the device properties you can use, see: +- **Emergency SOS**: Show or hide the safety (emergency SOS) setup pane on devices running iOS/iPadOS 16 and later. +- **Action button**: Show or hide the action button setup pane on devices running iOS/iPadOS 17 and later. +- **Intelligence**: Show or hide the intelligence setup pane on devices running iOS/iPadOS 18 and later. -- [Use filters when assigning your apps, policies, and profiles in Microsoft Intune](filters.md) -- [Filter properties](filters-device-properties.md) -- [Supported workloads](filters-supported-workloads.md) +You can configure these screens in new and existing enrollment policies. Applies to: -- Windows 10 -- Windows 11 +- iOS/iPadOS - macOS ## Device security -### Target Date Time setting for Apple software update enforcement will schedule updates using the local time on devices - -You will be able to specify the time that OS updates are enforced on devices in their local time zone. For example, configuring an OS update to be enforced at 5pm will schedule the update for 5pm in the device's local time zone. Currently, this setting uses the time zone that the policy is configured. +### New disk encryption template for Personal Data Encryption -This change will only apply to new policies that are created in the August 2408 release and later. The **Target Date Time** setting is in the settings catalog at **Devices** > **Manage devices** > **Configuration** > **Create** > **New policy** > **iOS/iPadOS** or **macOS** for platform > **Settings catalog** for profile type > **Declarative Device Management** > Software Update. +We’re adding a new template named *Personal Data Encryption* (PDE) to endpoint security BitLocker policy. The new template configures the Windows PDE configuration service provider (CSP) that was introduced in Windows 11 22H2. -In a future release, the **UTC** text will be removed from the **Target Date Time** setting. +PDE is different than BitLocker. PDE encrypts individual files and content, instead of whole volumes and disks. You can use PDE with other encryption methods, such as BitLocker. -For more information on using the settings catalog to configure software updates, see [Managed software updates with the settings catalog](../protect/managed-software-updates-ios-macos.md). +Previously, the [PDE CSP](/windows/client-management/mdm/personaldataencryption-csp) was made available through the [Intune settings catalog](../fundamentals/whats-new-archive.md#turn-onoff-personal-data-encryption-on-windows-11-devices-using-the-settings-catalog). Applies to: -- iOS/iPadOS -- macOS +- Windows 11 ### Defender for Endpoint security settings support in government cloud environments diff --git a/memdocs/intune/fundamentals/intune-add-ons.md b/memdocs/intune/fundamentals/intune-add-ons.md index 0f5493970b8..c3d9e64a6c4 100644 --- a/memdocs/intune/fundamentals/intune-add-ons.md +++ b/memdocs/intune/fundamentals/intune-add-ons.md @@ -47,14 +47,14 @@ The following table provides a list of add-on capabilities and associated Intune |Capability|Standalone add-on|Intune Plan 2|Intune Suite| |:---|:---:|:---:|:---:| -|Endpoint Privilege Management |✔️| |✔️| -|Enterprise App Management |✔️| |✔️| -|Advanced Analytics|✔️ | |✔️| -|Remote Help|✔️| |✔️| -|Microsoft Tunnel for Mobile Application Management| |✔️|✔️| -|Microsoft Cloud PKI |✔️ ||✔️| -|Firmware-over-the-air update| |✔️ |✔️ | -|Specialized devices management| |✔️|✔️| +|Endpoint Privilege Management |✅ | |✅ | +|Enterprise App Management |✅ | |✅ | +|Advanced Analytics|✅ | |✅ | +|Remote Help|✅ | |✅ | +|Microsoft Tunnel for Mobile Application Management| |✅ |✅ | +|Microsoft Cloud PKI |✅ ||✅ | +|Firmware-over-the-air update| |✅ |✅ | +|Specialized devices management| |✅ |✅ | ### Microsoft Intune Endpoint Privilege Management diff --git a/memdocs/intune/fundamentals/intune-endpoints.md b/memdocs/intune/fundamentals/intune-endpoints.md index 7c029c96c4f..628bee2182f 100644 --- a/memdocs/intune/fundamentals/intune-endpoints.md +++ b/memdocs/intune/fundamentals/intune-endpoints.md @@ -98,7 +98,7 @@ The data columns shown in the tables are: ID |Desc |Category |ER |Addresses |Ports -- |---------------------------------------------------------------- |---------------------|--- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------| 163 | Endpoint Manager client and host service| Allow
Required | False | `*.manage.microsoft.com`
`manage.microsoft.com`
`EnterpriseEnrollment.manage.microsoft.com`
`104.46.162.96/27, 13.67.13.176/28, 13.67.15.128/27, 13.69.231.128/28, 13.69.67.224/28, 13.70.78.128/28, 13.70.79.128/27, 13.71.199.64/28, 13.73.244.48/28, 13.74.111.192/27, 13.77.53.176/28, 13.86.221.176/28,13.89.174.240/28, 13.89.175.192/28, 20.189.229.0/25, 20.191.167.0/25, 20.37.153.0/24, 20.37.192.128/25, 20.38.81.0/24, 20.41.1.0/24, 20.42.1.0/24, 20.42.130.0/24, 20.42.224.128/25, 20.43.129.0/24, 20.44.19.224/27, 20.49.93.160/27, 40.119.8.128/25, 40.67.121.224/27, 40.70.151.32/28, 40.71.14.96/28, 40.74.25.0/24, 40.78.245.240/28, 40.78.247.128/27, 40.79.197.64/27, 40.79.197.96/28, 40.80.180.208/28, 40.80.180.224/27, 40.80.184.128/25, 40.82.248.224/28, 40.82.249.128/25, 52.150.137.0/25, 52.162.111.96/28, 52.168.116.128/27, 52.182.141.192/27, 52.236.189.96/27, 52.240.244.160/27, 20.204.193.12/30, 20.204.193.10/31, 20.192.174.216/29, 20.192.159.40/29` | **TCP:** 80, 443| -172 | MDM Delivery Optimization | Default
Required | False | `*.do.dsp.mp.microsoft.com`
`*.dl.delivery.mp.microsoft.com`
`*.emdl.ws.microsoft.com`
`kv801.prod.do.dsp.mp.microsoft.com`
`geo.prod.do.dsp.mp.microsoft.com`
`emdl.ws.microsoft.com`
`2.dl.delivery.mp.microsoft.com`
`bg.v4.emdl.ws.microsoft.com`
| **TCP:** 80, 443| +172 | MDM Delivery Optimization | Default
Required | False | `*.do.dsp.mp.microsoft.com`
`*.dl.delivery.mp.microsoft.com`
| **TCP:** 80, 443| 170 | MEM - Win32Apps| Default
Required | False | `swda01-mscdn.manage.microsoft.com`
`swda02-mscdn.manage.microsoft.com`
`swdb01-mscdn.manage.microsoft.com`
`swdb02-mscdn.manage.microsoft.com`
`swdc01-mscdn.manage.microsoft.com`
`swdc02-mscdn.manage.microsoft.com`
`swdd01-mscdn.manage.microsoft.com`
`swdd02-mscdn.manage.microsoft.com`
`swdin01-mscdn.manage.microsoft.com`
`swdin02-mscdn.manage.microsoft.com` | **TCP:** 443| 97 | Consumer Outlook.com, OneDrive, Device authentication and Microsoft account | Default
Required | False | `account.live.com`
`login.live.com`
|**TCP:** 443 | 190 | Endpoint discovery | Default
Required | False | `go.microsoft.com` | **TCP:** 80, 443| @@ -110,7 +110,7 @@ ID |Desc |Category |ER |Addresses |Ports ID |Desc |Category |ER |Addresses |Ports| -- |-- |-----|--- |--------------|--------------------------------| -164 | Autopilot - Windows Update| Default
Required | False | `*.windowsupdate.com`
`*.dl.delivery.mp.microsoft.com`
`*.prod.do.dsp.mp.microsoft.com`
`emdl.ws.microsoft.com`
`*.delivery.mp.microsoft.com`
`*.update.microsoft.com`
`tsfe.trafficshaping.dsp.mp.microsoft.com`
`adl.windows.com`
| **TCP:** 80, 443| +164 | Autopilot - Windows Update| Default
Required | False | `*.windowsupdate.com`
`*.dl.delivery.mp.microsoft.com`
`*.prod.do.dsp.mp.microsoft.com`
`*.delivery.mp.microsoft.com`
`*.update.microsoft.com`
`tsfe.trafficshaping.dsp.mp.microsoft.com`
`adl.windows.com`
| **TCP:** 80, 443| 165 | Autopilot - NTP Sync | Default
Required | False | `time.windows.com` |**UDP:** 123| 169 | Autopilot - WNS Dependencies| Default
Required | False | `clientconfig.passport.net`
`windowsphone.com`
`*.s-microsoft.com`
`c.s-microsoft.com` | **TCP:** 443 | 173 | Autopilot - Third party deployment dependencies| Default
Required | False | `ekop.intel.com`
`ekcert.spserv.microsoft.com`
`ftpm.amd.com`
| **TCP:** 443| @@ -152,9 +152,9 @@ For Intune-managed Windows devices managed using Mobile Device Management (MDM), | ID | Desc | Category | ER | Addresses | Ports | | --- | ---- | -------- | ----- | --------- | ----- | -| 172 | MDM - Delivery Optimization Dependencies | Default
Required | False | `*.do.dsp.mp.microsoft.com`
`*.dl.delivery.mp.microsoft.com`
`*.emdl.ws.microsoft.com`
`kv801.prod.do.dsp.mp.microsoft.com`
`geo.prod.do.dsp.mp.microsoft.com`
`emdl.ws.microsoft.com`
`2.dl.delivery.mp.microsoft.com`
`bg.v4.emdl.ws.microsoft.com`
| **TCP:** 80, 443 | +| 172 | MDM - Delivery Optimization Dependencies | Default
Required | False | `*.do.dsp.mp.microsoft.com`
`*.dl.delivery.mp.microsoft.com`
| **TCP:** 80, 443 | -**Port requirements** - For peer-to-peer traffic, Delivery Optimization uses 7680 for TCP/IP or 3544 for NAT traversal (optionally Teredo). +**Port requirements** - For peer-to-peer traffic, Delivery Optimization uses 7680 for TCP/IP. It uses Teredo on port 3544 for NAT traversal (use of Teredo is optional) For client-service communication, it uses HTTP or HTTPS over port 80/443. **Proxy requirements** - To use Delivery Optimization, you must allow Byte Range requests. For more information, see [Proxy requirements for Windows Update](/windows/deployment/update/windows-update-troubleshooting). @@ -166,7 +166,6 @@ For client-service communication, it uses HTTP or HTTPS over port 80/443. For Delivery Optimization metadata: - \*.dl.delivery.mp.microsoft.com -- \*.emdl.ws.microsoft.com #### Apple dependencies @@ -221,9 +220,7 @@ You'll also need FQDNs that are covered as part of Microsoft 365 Requirements. F |*.update.microsoft.com| Windows Update and Delivery Optimization | |*.delivery.mp.microsoft.com| Windows Update and Delivery Optimization | |tsfe.trafficshaping.dsp.mp.microsoft.com| Windows Update and Delivery Optimization | -|emdl.ws.microsoft.com| Delivery Optimization | |*.do.dsp.mp.microsoft.com| Delivery Optimization | -|*.emdl.ws.microsoft.com| Delivery Optimization | |*.notify.windows.com| Push Notifications | |*.wns.windows.com| Push Notifications | |devicelistenerprod.microsoft.com| Windows Update for Business deployment service | diff --git a/memdocs/intune/fundamentals/intune-govt-service-description.md b/memdocs/intune/fundamentals/intune-govt-service-description.md index 8e2cab84295..eb9bc28b8b8 100644 --- a/memdocs/intune/fundamentals/intune-govt-service-description.md +++ b/memdocs/intune/fundamentals/intune-govt-service-description.md @@ -87,7 +87,6 @@ The following features are currently not available and aren't supported in GCC H | --- | --- | | Expedited updates | For more information on this feature, go to [Expedite Windows quality updates in Microsoft Intune](../protect/windows-10-expedite-updates.md). | | Feature updates | For more information on this feature, go to [Feature updates for Windows in Intune](../protect/windows-10-feature-updates.md). | -| Organizational Messages | For more information on this feature, go to [Organizational messages in Microsoft Intune](../remote-actions/organizational-messages-overview.md). | | Windows Autopilot | The following features are in the planning phase:

- Customize out-of-box experience (OOBE) and rename devices during provisioning based on organizational structure
- Self-deploying and pre-provisioning mode
- More admin-specified configurations delivered before allowing desktop access.
- Enhanced optional desktop onboarding experience inside the Windows Company Portal app
- The ability to associate a device with a tenant.

For information about Windows Autopilot, go to [Windows Autopilot overview](/autopilot/overview). | ### Not available diff --git a/memdocs/intune/fundamentals/intune-scale-guidelines.md b/memdocs/intune/fundamentals/intune-scale-guidelines.md index ac647e7d1e2..a6072d64e44 100644 --- a/memdocs/intune/fundamentals/intune-scale-guidelines.md +++ b/memdocs/intune/fundamentals/intune-scale-guidelines.md @@ -184,7 +184,7 @@ The [Full delegation model](#full-delegation-model) is recommended. #### Windows update rings - We recommend that Windows update rings are managed centrally. The Central team should create as many common Windows update ring policies as they need to support the variance of the local admins. -- The local admins shouldn't create their own Windows update rings. When you delegate to a large numbers of administrators, the total number of objects may become large and difficult to manage. Best practices vary for each feature. For more information, go to [Windows update rings](../protect/windows-10-update-rings.md). +- The local admins shouldn't create their own Windows update rings. When you delegate to a large number of administrators, the total number of objects may become large and difficult to manage. Best practices vary for each feature. For more information, go to [Windows update rings](../protect/windows-10-update-rings.md). #### Feature updates @@ -223,8 +223,6 @@ For more information, go to [How many tokens can I upload.](../apps/vpp-apps-ios - Local admins can create Win32 apps as needed within the cross-platform, line-of-business app and web-link limit. For more information, go to [Win32 app management](../apps/apps-win32-app-management.md). -- Local admins can purchase Microsoft Store for Business (MSFB) apps as needed. - > [!NOTE] > [Microsoft Store for Business](/microsoft-store/microsoft-store-for-business-overview) is being retired. Starting with Windows 11, you have a new option for your private volume-licensed apps. For more information, go to [Private app repository in Windows 11](/windows/application-management/private-app-repository-mdm-company-portal-windows-11) and [Update to Microsoft Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077). @@ -262,19 +260,19 @@ In this section: #### Autopilot - Grant local admins the permissions to read Autopilot devices and upload new Autopilot devices. -- Local admins shouldn't create Autopilot profiles. When you delegate to a large numbers of administrators, the total number of objects may become large and difficult to manage. The best practice varies per feature area. +- Local admins shouldn't create Autopilot profiles. When you delegate to a large number of administrators, the total number of objects may become large and difficult to manage. The best practice varies per feature area. For more information on Autopilot, go to [Use Autopilot to enroll Windows devices in Intune](../enrollment/tutorial-use-autopilot-enroll-devices.md). #### Enrollment status page - Local admins should select from existing Enrollment status page profiles to assign, or they should request the Central team to create an exception profile, only if necessary. -- Local admins shouldn't create Enrollment status page profiles. When you delegate to a large numbers of administrators, the total number of objects may become large and difficult to manage. The best practice varies per feature area. For information on Enrollment status page, go to [Set up the Enrollment Status Page](../enrollment/windows-enrollment-status.md). +- Local admins shouldn't create Enrollment status page profiles. When you delegate to a large number of administrators, the total number of objects may become large and difficult to manage. The best practice varies per feature area. For information on Enrollment status page, go to [Set up the Enrollment Status Page](../enrollment/windows-enrollment-status.md). #### Apple Business Manager If possible, local admins shouldn't be granted create, update or delete permissions on enrollment profiles. If local admins are given permissions to create Apple Business Manager profiles it also gives them create, update and delete permissions in Autopilot. However, local admins shouldn't create Autopilot profiles. -When you delegate to a large numbers of administrators, the total number of objects may become large and difficult to manage. The best practice varies per feature area. For more information, go to [Use Apple Business Manager to enroll Apple devices in Intune](../enrollment/tutorial-use-device-enrollment-program-enroll-ios.md). +When you delegate to a large number of administrators, the total number of objects may become large and difficult to manage. The best practice varies per feature area. For more information, go to [Use Apple Business Manager to enroll Apple devices in Intune](../enrollment/tutorial-use-device-enrollment-program-enroll-ios.md). #### Android Enterprise profiles @@ -300,5 +298,5 @@ For more information, go to [Device categories](../enrollment/device-group-mappi ### Endpoint analytics - The Central team should create as many common Endpoint Analytics baselines as they need to support the variance of the Local admins. -- If possible, local admins shouldn't create their own Endpoint Analytics baselines. When you delegate to a large numbers of administrators, the total number of objects may become large and difficult to manage. The best practice varies per feature area. +- If possible, local admins shouldn't create their own Endpoint Analytics baselines. When you delegate to a large number of administrators, the total number of objects may become large and difficult to manage. The best practice varies per feature area. - For more information, go to [Configuring settings in Endpoint analytics](../../analytics//settings.md#bkmk_baselines). diff --git a/memdocs/intune/fundamentals/manage-apps.md b/memdocs/intune/fundamentals/manage-apps.md index bca68349864..f5bcbfb2ed9 100644 --- a/memdocs/intune/fundamentals/manage-apps.md +++ b/memdocs/intune/fundamentals/manage-apps.md @@ -121,7 +121,6 @@ The app features in the Intune admin center make it easier to deploy these diffe For more specific information, go to: - - [Manage volume purchased apps from the Microsoft Store for Business](../apps/windows-store-for-business.md) - [Add Microsoft 365 apps to Windows client devices](../apps/apps-add-office365.md) - [Win32 app management](../apps/apps-win32-app-management.md) diff --git a/memdocs/intune/fundamentals/manage-os-versions.md b/memdocs/intune/fundamentals/manage-os-versions.md index a3b0eb73f0b..9b0479b7420 100644 --- a/memdocs/intune/fundamentals/manage-os-versions.md +++ b/memdocs/intune/fundamentals/manage-os-versions.md @@ -1,14 +1,14 @@ --- # required metadata -title: Manage operating system versions of devices you manage with Intune +title: Manage device operating system versions with Intune titleSuffix: Microsoft Intune -description: Learn how to manage operating system versions across platforms with Microsoft Intune. +description: Learn about the methods for managing device operating system versions supported by Microsoft Intune. keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 10/04/2023 +ms.date: 08/23/2024 ms.topic: conceptual ms.service: microsoft-intune ms.subservice: fundamentals @@ -117,7 +117,7 @@ You can use the Intune capabilities described in this article to help you move y ## Next steps -Use the following resources to manage operating system versions in your organization: +Use the following resources to manage the operating system versions that are in use in your organization: - [Set device type restrictions](../enrollment/enrollment-restrictions-set.md) - [Get started with device compliance](../protect/device-compliance-get-started.md) diff --git a/memdocs/intune/fundamentals/media/cloud-configuration/guided-scenario-basics.png b/memdocs/intune/fundamentals/media/cloud-configuration/guided-scenario-basics.png index ce95a0ed46e..8da36a82d49 100644 Binary files a/memdocs/intune/fundamentals/media/cloud-configuration/guided-scenario-basics.png and b/memdocs/intune/fundamentals/media/cloud-configuration/guided-scenario-basics.png differ diff --git a/memdocs/intune/fundamentals/media/deployment-guide-enrollment/orig-mdm-certificate.png b/memdocs/intune/fundamentals/media/deployment-guide-enrollment/orig-mdm-certificate.png deleted file mode 100644 index 4f1ca98594d..00000000000 Binary files a/memdocs/intune/fundamentals/media/deployment-guide-enrollment/orig-mdm-certificate.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/media/end-user-company-portal-messages/end-user-company-portal-messages-02.png b/memdocs/intune/fundamentals/media/end-user-company-portal-messages/end-user-company-portal-messages-02.png deleted file mode 100644 index 6f72d1cd28b..00000000000 Binary files a/memdocs/intune/fundamentals/media/end-user-company-portal-messages/end-user-company-portal-messages-02.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/media/end-user-company-portal-messages/end-user-company-portal-messages-03.png b/memdocs/intune/fundamentals/media/end-user-company-portal-messages/end-user-company-portal-messages-03.png deleted file mode 100644 index a4352f7841c..00000000000 Binary files a/memdocs/intune/fundamentals/media/end-user-company-portal-messages/end-user-company-portal-messages-03.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/media/high-level-architecture/intunearchitecture_wh.svg b/memdocs/intune/fundamentals/media/high-level-architecture/intunearchitecture_wh.svg deleted file mode 100644 index c9cf36952a6..00000000000 --- a/memdocs/intune/fundamentals/media/high-level-architecture/intunearchitecture_wh.svg +++ /dev/null @@ -1,34210 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/memdocs/intune/fundamentals/media/introduction-intune-education/intune-azure-vs-intuneedu.png b/memdocs/intune/fundamentals/media/introduction-intune-education/intune-azure-vs-intuneedu.png deleted file mode 100644 index 99f201d770e..00000000000 Binary files a/memdocs/intune/fundamentals/media/introduction-intune-education/intune-azure-vs-intuneedu.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/media/intune-reports/intune-reports-02.png b/memdocs/intune/fundamentals/media/intune-reports/intune-reports-02.png deleted file mode 100644 index 295c4103013..00000000000 Binary files a/memdocs/intune/fundamentals/media/intune-reports/intune-reports-02.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/media/manage-apps/orig-manage-apps-with-intune.png b/memdocs/intune/fundamentals/media/manage-apps/orig-manage-apps-with-intune.png deleted file mode 100644 index 82a0ea59139..00000000000 Binary files a/memdocs/intune/fundamentals/media/manage-apps/orig-manage-apps-with-intune.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/media/manage-devices/orig-manage-devices-with-intune.png b/memdocs/intune/fundamentals/media/manage-devices/orig-manage-devices-with-intune.png deleted file mode 100644 index dfb573e7f01..00000000000 Binary files a/memdocs/intune/fundamentals/media/manage-devices/orig-manage-devices-with-intune.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/media/manage-identities/orig-identities-different-user-types.png b/memdocs/intune/fundamentals/media/manage-identities/orig-identities-different-user-types.png deleted file mode 100644 index 1e07bab58ce..00000000000 Binary files a/memdocs/intune/fundamentals/media/manage-identities/orig-identities-different-user-types.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/media/microsoft-intune-admin-center-devices/all-devices-experience.png b/memdocs/intune/fundamentals/media/microsoft-intune-admin-center-devices/all-devices-experience.png deleted file mode 100644 index a07fde88346..00000000000 Binary files a/memdocs/intune/fundamentals/media/microsoft-intune-admin-center-devices/all-devices-experience.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/media/microsoft-intune-admin-center-devices/apple-updates-devices-experience.png b/memdocs/intune/fundamentals/media/microsoft-intune-admin-center-devices/apple-updates-devices-experience.png deleted file mode 100644 index 537fcd08969..00000000000 Binary files a/memdocs/intune/fundamentals/media/microsoft-intune-admin-center-devices/apple-updates-devices-experience.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/media/microsoft-intune-admin-center-devices/column-selector-all-devices.png b/memdocs/intune/fundamentals/media/microsoft-intune-admin-center-devices/column-selector-all-devices.png deleted file mode 100644 index 7b4a6a26112..00000000000 Binary files a/memdocs/intune/fundamentals/media/microsoft-intune-admin-center-devices/column-selector-all-devices.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/media/microsoft-intune-admin-center-devices/compliance-devices-experience.png b/memdocs/intune/fundamentals/media/microsoft-intune-admin-center-devices/compliance-devices-experience.png deleted file mode 100644 index 390abe5410e..00000000000 Binary files a/memdocs/intune/fundamentals/media/microsoft-intune-admin-center-devices/compliance-devices-experience.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/media/microsoft-intune-admin-center-devices/configuration-devices-experience.png b/memdocs/intune/fundamentals/media/microsoft-intune-admin-center-devices/configuration-devices-experience.png deleted file mode 100644 index 922da005464..00000000000 Binary files a/memdocs/intune/fundamentals/media/microsoft-intune-admin-center-devices/configuration-devices-experience.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/media/microsoft-intune-admin-center-devices/device-preview-toggle-off.png b/memdocs/intune/fundamentals/media/microsoft-intune-admin-center-devices/device-preview-toggle-off.png deleted file mode 100644 index ff0a26a8948..00000000000 Binary files a/memdocs/intune/fundamentals/media/microsoft-intune-admin-center-devices/device-preview-toggle-off.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/media/microsoft-intune-admin-center-devices/enrollment-devices-experience.png b/memdocs/intune/fundamentals/media/microsoft-intune-admin-center-devices/enrollment-devices-experience.png deleted file mode 100644 index d15dae4118a..00000000000 Binary files a/memdocs/intune/fundamentals/media/microsoft-intune-admin-center-devices/enrollment-devices-experience.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/media/microsoft-intune-admin-center-devices/overview-devices-experience.png b/memdocs/intune/fundamentals/media/microsoft-intune-admin-center-devices/overview-devices-experience.png deleted file mode 100644 index 3c92cac480c..00000000000 Binary files a/memdocs/intune/fundamentals/media/microsoft-intune-admin-center-devices/overview-devices-experience.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/media/microsoft-intune-admin-center-devices/public-preview-toggle-intune-2311.png b/memdocs/intune/fundamentals/media/microsoft-intune-admin-center-devices/public-preview-toggle-intune-2311.png deleted file mode 100644 index de6ea6bcdd7..00000000000 Binary files a/memdocs/intune/fundamentals/media/microsoft-intune-admin-center-devices/public-preview-toggle-intune-2311.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/media/microsoft-intune-admin-center-devices/public-preview-toggle-intune.png b/memdocs/intune/fundamentals/media/microsoft-intune-admin-center-devices/public-preview-toggle-intune.png deleted file mode 100644 index 68c2bf20cd8..00000000000 Binary files a/memdocs/intune/fundamentals/media/microsoft-intune-admin-center-devices/public-preview-toggle-intune.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/media/microsoft-intune-admin-center-devices/windows-10-devices-experience.png b/memdocs/intune/fundamentals/media/microsoft-intune-admin-center-devices/windows-10-devices-experience.png deleted file mode 100644 index b486c557d73..00000000000 Binary files a/memdocs/intune/fundamentals/media/microsoft-intune-admin-center-devices/windows-10-devices-experience.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/media/monitor-audit-logs/audit-logs-compliance-category-activity-options.png b/memdocs/intune/fundamentals/media/monitor-audit-logs/audit-logs-compliance-category-activity-options.png new file mode 100644 index 00000000000..4f1cea0e5dd Binary files /dev/null and b/memdocs/intune/fundamentals/media/monitor-audit-logs/audit-logs-compliance-category-activity-options.png differ diff --git a/memdocs/intune/fundamentals/media/monitor-audit-logs/audit-logs-date-range.png b/memdocs/intune/fundamentals/media/monitor-audit-logs/audit-logs-date-range.png new file mode 100644 index 00000000000..0fd4a317557 Binary files /dev/null and b/memdocs/intune/fundamentals/media/monitor-audit-logs/audit-logs-date-range.png differ diff --git a/memdocs/intune/fundamentals/media/monitor-audit-logs/audit-logs-export-data-settings.png b/memdocs/intune/fundamentals/media/monitor-audit-logs/audit-logs-export-data-settings.png index 537f7c73cda..6f79c5d7842 100644 Binary files a/memdocs/intune/fundamentals/media/monitor-audit-logs/audit-logs-export-data-settings.png and b/memdocs/intune/fundamentals/media/monitor-audit-logs/audit-logs-export-data-settings.png differ diff --git a/memdocs/intune/fundamentals/media/try-intune-overview/try-intune-overview-01.png b/memdocs/intune/fundamentals/media/try-intune-overview/try-intune-overview-01.png deleted file mode 100644 index e4ae1b470b7..00000000000 Binary files a/memdocs/intune/fundamentals/media/try-intune-overview/try-intune-overview-01.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/media/ui-changes/01-classic-rules.png b/memdocs/intune/fundamentals/media/ui-changes/01-classic-rules.png deleted file mode 100644 index 7958a843f20..00000000000 Binary files a/memdocs/intune/fundamentals/media/ui-changes/01-classic-rules.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/media/ui-changes/02-azure-enroll-restrictions.png b/memdocs/intune/fundamentals/media/ui-changes/02-azure-enroll-restrictions.png deleted file mode 100644 index 6a4c61060d4..00000000000 Binary files a/memdocs/intune/fundamentals/media/ui-changes/02-azure-enroll-restrictions.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/media/ui-changes/03-azure-device-limit.png b/memdocs/intune/fundamentals/media/ui-changes/03-azure-device-limit.png deleted file mode 100644 index f0b08469327..00000000000 Binary files a/memdocs/intune/fundamentals/media/ui-changes/03-azure-device-limit.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/media/ui-changes/04-azure-platform-restrictions.png b/memdocs/intune/fundamentals/media/ui-changes/04-azure-platform-restrictions.png deleted file mode 100644 index 5ff498902c6..00000000000 Binary files a/memdocs/intune/fundamentals/media/ui-changes/04-azure-platform-restrictions.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/media/ui-changes/05-azure-personal-block.png b/memdocs/intune/fundamentals/media/ui-changes/05-azure-personal-block.png deleted file mode 100644 index ea23f724a96..00000000000 Binary files a/memdocs/intune/fundamentals/media/ui-changes/05-azure-personal-block.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/media/ui-changes/06-classic-dep-token.png b/memdocs/intune/fundamentals/media/ui-changes/06-classic-dep-token.png deleted file mode 100644 index d9e07162790..00000000000 Binary files a/memdocs/intune/fundamentals/media/ui-changes/06-classic-dep-token.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/media/ui-changes/07-azure-dep-token.png b/memdocs/intune/fundamentals/media/ui-changes/07-azure-dep-token.png deleted file mode 100644 index 6aff07b6250..00000000000 Binary files a/memdocs/intune/fundamentals/media/ui-changes/07-azure-dep-token.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/media/ui-changes/08-azure-dep-sync.png b/memdocs/intune/fundamentals/media/ui-changes/08-azure-dep-sync.png deleted file mode 100644 index 26ac96a30c4..00000000000 Binary files a/memdocs/intune/fundamentals/media/ui-changes/08-azure-dep-sync.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/media/ui-changes/09-classic-apple-serials.png b/memdocs/intune/fundamentals/media/ui-changes/09-classic-apple-serials.png deleted file mode 100644 index 199eb8fd783..00000000000 Binary files a/memdocs/intune/fundamentals/media/ui-changes/09-classic-apple-serials.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/media/ui-changes/10-azure-dep-serials.png b/memdocs/intune/fundamentals/media/ui-changes/10-azure-dep-serials.png deleted file mode 100644 index d14ff4adbd1..00000000000 Binary files a/memdocs/intune/fundamentals/media/ui-changes/10-azure-dep-serials.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/media/ui-changes/11-azure-ac-serials.png b/memdocs/intune/fundamentals/media/ui-changes/11-azure-ac-serials.png deleted file mode 100644 index 39c23755a8a..00000000000 Binary files a/memdocs/intune/fundamentals/media/ui-changes/11-azure-ac-serials.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/media/ui-changes/12-classic-corp-imei.png b/memdocs/intune/fundamentals/media/ui-changes/12-classic-corp-imei.png deleted file mode 100644 index e683d998a86..00000000000 Binary files a/memdocs/intune/fundamentals/media/ui-changes/12-classic-corp-imei.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/media/ui-changes/13-azure-corp-imei.png b/memdocs/intune/fundamentals/media/ui-changes/13-azure-corp-imei.png deleted file mode 100644 index 542c5a4e23d..00000000000 Binary files a/memdocs/intune/fundamentals/media/ui-changes/13-azure-corp-imei.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/media/ui-changes/14-classic-corp-profiles.png b/memdocs/intune/fundamentals/media/ui-changes/14-classic-corp-profiles.png deleted file mode 100644 index e173dfc421f..00000000000 Binary files a/memdocs/intune/fundamentals/media/ui-changes/14-classic-corp-profiles.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/media/ui-changes/15-azure-dep-profiles.png b/memdocs/intune/fundamentals/media/ui-changes/15-azure-dep-profiles.png deleted file mode 100644 index 7ca40efbe39..00000000000 Binary files a/memdocs/intune/fundamentals/media/ui-changes/15-azure-dep-profiles.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/media/ui-changes/16-azure-ac-profiles.png b/memdocs/intune/fundamentals/media/ui-changes/16-azure-ac-profiles.png deleted file mode 100644 index fa0d3736714..00000000000 Binary files a/memdocs/intune/fundamentals/media/ui-changes/16-azure-ac-profiles.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/media/what-is-device-management/orig-device-management-features-mdm-mam.png b/memdocs/intune/fundamentals/media/what-is-device-management/orig-device-management-features-mdm-mam.png deleted file mode 100644 index eda8f1cde54..00000000000 Binary files a/memdocs/intune/fundamentals/media/what-is-device-management/orig-device-management-features-mdm-mam.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/media/whats-new/intune-assessment-status.png b/memdocs/intune/fundamentals/media/whats-new/intune-assessment-status.png deleted file mode 100644 index d66fdf153d2..00000000000 Binary files a/memdocs/intune/fundamentals/media/whats-new/intune-assessment-status.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/media/whats-new/intune-ffiec-assessment-status.png b/memdocs/intune/fundamentals/media/whats-new/intune-ffiec-assessment-status.png deleted file mode 100644 index dc9b7c1889e..00000000000 Binary files a/memdocs/intune/fundamentals/media/whats-new/intune-ffiec-assessment-status.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/media/whats-new/macos-hide-checkmark-users-groups-login-items-apps-list.png b/memdocs/intune/fundamentals/media/whats-new/macos-hide-checkmark-users-groups-login-items-apps-list.png deleted file mode 100644 index fd03f1eace1..00000000000 Binary files a/memdocs/intune/fundamentals/media/whats-new/macos-hide-checkmark-users-groups-login-items-apps-list.png and /dev/null differ diff --git a/memdocs/intune/fundamentals/microsoft-intune-service-description.md b/memdocs/intune/fundamentals/microsoft-intune-service-description.md index 251fb418113..f5b6f80f952 100644 --- a/memdocs/intune/fundamentals/microsoft-intune-service-description.md +++ b/memdocs/intune/fundamentals/microsoft-intune-service-description.md @@ -49,6 +49,8 @@ You can start to use Intune with a 30-day free trial that includes 100 user lice > [!NOTE] > If your organization has a Microsoft Online Services work or school account, and you might continue with this Intune subscription in production after the trial period ends, then choose the **Sign in** option on that page and authenticate by using the Global Administrator account for your organization. This action ensures that your Intune trial links to your existing work or school account. +Microsoft recommends that you use roles with the fewest permissions. Using lower permissioned accounts helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to the initial set up or emergency scenarios when you can't use an existing role. + + + +## Week of March 3, 2024 + +### Device enrollment + +#### Role-based access control changes to enrollment settings for Windows Hello for Business + +We updated Role-based access control (RBAC) in the enrollment area for Windows Hello for Business. Enrollment settings related to Windows Hello for Business are read-only for all roles except the Intune Service Administrator. The Intune Service Administrator can create and edit Windows Hello for Business enrollment settings. + +For more information, see [Role-based access control](../protect/windows-hello.md#role-based-access-control) in the *Windows Hello at device enrollment* article. + +### Device security + +#### New enrollment configuration for Windows Hello for Business + +A new Windows Hello for Business enrollment setting, **Enable enhanced sign in security** is available in the Intune admin center. Enhanced sign-in security is a Windows Hello feature that prevents malicious users from gaining access to a user's biometrics through external peripherals. + +For more information about this setting, see [Create a Windows Hello for Business policy](../protect/windows-hello.md). + +#### HTML formatting supported in noncompliance email notifications + +Intune now supports HTML formatting in noncompliance email notifications for all platforms. You can use supported HTML tags to add formatting such as italics, URL links, and bulleted lists to your organization's messages. + +For more information, see [Create a notification message template](../protect/actions-for-noncompliance.md#create-a-notification-message-template). + +## Week of February 26, 2024 + +### Microsoft Intune Suite + +#### New Microsoft Cloud PKI service + +Use the Microsoft Cloud PKI service to simplify and automate certificate lifecycle management for Intune-managed devices. ​Microsoft Cloud PKI is a feature component of the Microsoft Intune Suite and is also available as a standalone [Intune add-on](../fundamentals/intune-add-ons.md). The cloud-based service provides a dedicated PKI infrastructure for your organization, and doesn't require on-premises servers, connectors, or hardware. Microsoft Cloud PKI automatically issues, renews, and revokes certificates for all OS platforms supporting the SCEP certificate device configuration profile. Issued certificates can be used for certificate-based authentication for Wi-Fi, VPN, and other services supporting certificate-based authentication. For more information, see [Overview of Microsoft Cloud PKI](../protect/microsoft-cloud-pki-overview.md). + +Applies to: + +- Windows +- Android +- iOS/iPadOS +- macOS + +### Intune apps + +#### Newly available protected app for Intune + +The following protected app is now available for Microsoft Intune: + +- Cinebody by Super 6 LLC + +For more information about protected apps, see [Microsoft Intune protected apps](../apps/apps-supported-intune-apps.md). + +## Week of February 19, 2024 (Service release 2402) + +### App management + +#### More app configuration permissions for Android apps + +There are six new permissions that can be configured for an Android app using an app configuration policy. They are: + +- Allow background body sensor data +- Media Video (read) +- Media Images (read) +- Media Audio (read) +- Nearby Wifi Devices +- Nearby Devices + +For more information about how to use app config policies for Android apps, see [Add app configuration policies for managed Android Enterprise devices](../apps/app-configuration-policies-use-android.md). + +#### Newly available protected apps for Intune + +The following protected apps are now available for Microsoft Intune: + +- Bob HR by Hi Bob Ltd +- ePRINTit SaaS by ePRINTit USA LLC +- Microsoft Copilot by Microsoft Corporation + +For more information about protected apps, see [Microsoft Intune protected apps](../apps/apps-supported-intune-apps.md). + +#### Update to Intune Management Extension on Windows + +To support expanded functionality and bug fixes, use .NET Framework 4.7.2 or higher with the Intune Management Extension on Windows clients. If a Windows client continues to use an earlier version of the .NET Framework, the Intune Management Extension continues to function. The .NET Framework 4.7.2 is available from Windows Update as of July 10, 2018, which is included in Windows 10 1809 (RS5) and newer. Multiple versions of the .NET Framework can coexist on a device. + +Applies to: + +- Windows 10 +- Windows 11 + +### Device configuration + +#### Use assignment filters on Endpoint Privilege Management (EPM) policies + +You can use assignment filters to assign a policy based on rules you create. A filter allows you to narrow the assignment scope of a policy, like targeting devices with a specific OS version or a specific manufacturer. + +You can use filters on Endpoint Privilege Management (EPM) policies. + +For more information, see: + +- [Use filters when assigning your apps, policies, and profiles in Intune](filters.md) +- [List of platforms, policies, and app types supported by filters in Intune](filters-supported-workloads.md) + +Applies to: + +- Windows 10 +- Windows 11 + +#### New settings available in the Apple settings catalog + +The [Settings Catalog](../configuration/settings-catalog.md) lists all the settings you can configure in a device policy, and all in one place. + +There are new settings in the Settings Catalog. To see these settings, in the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Devices** > **Manage devices** > **Configuration** > **Create** > **New policy** > **iOS/iPadOS** or **macOS** for platform > **Settings catalog** for profile type. + +##### iOS/iPadOS + +- **Restrictions** + + - Allow Live Voicemail + - Force Classroom Unprompted Screen Observation + - Force Preserve ESIM On Erase + +##### macOS + +- **Full Disk Encryption > FileVault** > Force Enable In Setup Assistant +- **Restrictions** > Force Classroom Unprompted Screen Observation + +For more information, see: + +- [Use FileVault disk encryption for macOS with Intune](../protect/encrypt-devices-filevault.md) +- [Create a policy using settings catalog](../configuration/settings-catalog.md) + +#### Import up to 20 custom ADMX and ADML administrative templates + +You can import custom ADMX and ADML administrative templates in Microsoft Intune. Previously, you could import up to 10 files. Now, you can upload up to 20 files. + +Applies to: + +- Windows 10 +- Windows 11 + +For more information on this feature, see [Import custom ADMX and ADML administrative templates into Microsoft Intune (public preview)](../configuration/administrative-templates-import-custom.md). + +#### New setting for updating MAC address randomization on Android Enterprise devices + +There's a new **MAC address randomization** setting on Android Enterprise devices (**Devices** > **Manage devices** > **Configuration** > **Create** > **New policy** > **Android Enterprise** for platform > **Fully Managed, Dedicated, and Corporate-Owned Work Profile** > **Wi-Fi** for profile type). + +Starting with Android 10, when connecting to a network, devices present a randomized MAC address instead of the physical MAC address. Using randomized MAC addresses is recommended for privacy, as it's harder to track a device by its MAC address. However, randomized MAC addresses break functionality that relies on a static MAC address, including network access control (NAC). + +Your options: + +- **Use device default**: Intune doesn't change or update this setting. By default, when connecting to a network, devices present a randomized MAC address instead of the physical MAC address. Any updates made by the user to the setting persist. + +- **Use randomized MAC**: Enables MAC address randomization on devices. When devices connect to a new network, devices present a randomized MAC address, instead of the physical MAC address. If the user changes this value on their device, it resets to **Use randomized MAC** on the next Intune sync. + +- **Use device MAC**: Forces devices to present their actual Wi-Fi MAC address instead of a random MAC address. This setting allows devices to be tracked by their MAC address. Only use this value when necessary, such as for network access control (NAC) support. If the user changes this value on their device, it resets to **Use device MAC** on the next Intune sync. + +Applies to: + +- Android 13 and newer + +For more information on the Wi-Fi settings you can configure, see [Add Wi-Fi settings for Android Enterprise dedicated and fully managed devices in Microsoft Intune](../configuration/wi-fi-settings-android-enterprise.md). + +#### Turn Off Copilot in Windows setting in the Windows settings catalog + +The [Settings Catalog](../configuration/settings-catalog.md) lists all the settings you can configure in a device policy, and all in one place. + +There's a new setting in the Settings Catalog. To see this setting, in the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Devices** > **Manage devices** > **Configuration** > **Create** > **New policy** > **Windows** for platform > **Settings catalog** for profile type. + +- **Windows AI > Turn Off Copilot in Windows (User)** + + - If you enable this policy setting, users can't use Copilot. The Copilot icon won't appear on the taskbar. + - If you disable or don't configure this policy setting, users can use Copilot when it's available to them. + +This setting uses the [Policy CSP - WindowsAI](/windows/client-management/mdm/policy-csp-windowsai). + +For more information about configuring Settings Catalog policies in Intune, including user scope vs. device scope, see [Create a policy using settings catalog](../configuration/settings-catalog.md). + +Applies to: + +- Windows 10 and later + +#### Windows Autopilot self-deploying mode is now generally available + +Windows Autopilot self-deploying mode is now generally available and out of preview. Windows Autopilot self-deploying mode enables you to deploy Windows devices with little to no user interaction. Once the device connects to network, the device provisioning process starts automatically: the device joins Microsoft Entra ID, enrolls in Intune, and syncs all device-based configurations targeted to the device. Self-deploying mode ensures that the user can't access desktop until all device-based configuration is applied. The Enrollment Status Page (ESP) is displayed during OOBE so users can track the status of the deployment. For more information, see: + +- [Windows Autopilot self-deploying mode](/autopilot/self-deploying) +- [Step by step tutorial for Windows Autopilot self-deploying mode in Intune](/autopilot/tutorial/self-deploying/self-deploying-workflow) + +This information is also published in [Windows Autopilot: What's new](/autopilot/whats-new). + +#### Windows Autopilot for pre-provisioned deployment is now generally available + +Windows Autopilot for pre-provisioned deployment is now generally available and out of preview. Windows Autopilot for pre-provisioned deployment is used by organizations that want to ensure devices are business-ready before the user accesses them. With pre-provisioning, admins, partners, or OEMs can access a technician flow from the Out-of-box experience (OOBE) and kick off device setup. Next, the device is sent to the user who completes provisioning in the user phase. Pre-provisioning delivers most the configuration in advance so the end user can get to the desktop faster. For more information, see: + +- [Windows Autopilot for pre-provisioned deployment](/autopilot/pre-provision). +- [Step by step tutorial for Windows Autopilot for pre-provisioned deployment Microsoft Entra join in Intune](/autopilot/tutorial/pre-provisioning/azure-ad-join-workflow) +- [Step by step tutorial for Windows Autopilot for pre-provisioned deployment Microsoft Entra hybrid join in Intune](/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-workflow). + +This information is also published in [Windows Autopilot: What's new](/autopilot/whats-new). + +### Device enrollment + +#### ESP setting to install required apps during Windows Autopilot pre-provisioning + +The setting **Only fail selected blocking apps in technician phase** is now generally available to configure in Enrollment Status Page (ESP) profiles. This setting only appears in ESP profiles that have *blocking apps* selected. + +For more information, see [Set up the Enrollment Status Page](../enrollment/windows-enrollment-status.md#create-new-profile). + +#### New local primary account configuration for macOS automated device enrollment + +Configure local primary account settings for Macs enrolling in Intune via Apple automated device enrollment. These settings, supported on devices running macOS 10.11 and later, are available in new and existing enrollment profiles under the new **Account Settings** tab. For this feature to work, the enrollment profile must be configured with user-device affinity and one of the following authentication methods: + +- Setup Assistant with modern authentication +- Setup Assistant (legacy) + +Applies to: + +- macOS 10.11 and later + +For more information about macOS account settings, see [Create an Apple enrollment profile in Intune](../enrollment/device-enrollment-program-enroll-macos.md#create-an-apple-enrollment-profile). + +#### Await final configuration for macOS automated device enrollment now generally available + +Now generally available, *await final configuration* enables a locked experience at the end of Setup Assistant to ensure that critical device configuration policies are installed on devices. The locked experience works on devices targeted with new and existing enrollment profiles, enrolling via one of these authentication methods: + +- Setup Assistant with modern authentication +- Setup Assistant (legacy) +- Without user device affinity + +Applies to: + +- macOS 10.11 and later + +For information about how to enable await final configuration, see [Create an Apple enrollment profile](../enrollment/device-enrollment-program-enroll-macos.md#create-an-apple-enrollment-profile). + +### Device management + +#### AOSP devices check for new tasks and notifications approximately every 15 minutes + +On devices enrolled with Android (AOSP) management, Intune attempts to check for new tasks and notifications approximately every 15 minutes. To use this feature, devices must be using the Intune app version 24.02.4 or newer. + +Applies to: + +- Android (AOSP) + +For more information, see: + +- [How to use Intune in environments without Google Mobile Services](../apps/manage-without-gms.md#some-tasks-can-be-delayed) +- [Policy refresh intervals in Intune](../configuration/device-profile-troubleshoot.md#policy-refresh-intervals) + +#### New device management experience for Government clouds in Microsoft Intune + +In government clouds, there's a new device management experience in the Intune admin center. The **Devices** area now has a more consistent UI, with more capable controls and an improved navigation structure so you can find what you need faster. + +If you want to try the new experience before your tenant is updated, go to **Devices** > **Overview**, select the **Preview upcoming changes to Devices and provide feedback** notification banner, and select **Try it now**. + +#### Bulk approval of drivers + +Bulk actions are now available for Windows Driver update policies. With bulk actions, multiple driver updates can be approved, paused, or declined at the same time, saving time and effort. + +When you bulk approve drivers, the date for when the drivers become available to applicable devices can also be set, enabling drivers to be installed together. + +Applies to: + +- Windows 10 +- Windows 11 + +For more information, see [Bulk driver updates](../protect/windows-driver-updates-policy.md#bulk-driver-updates). + +#### App Control for Business policy limitation is resolved + +A previously documented limitation for App Control for Business policy (WDAC), that limited the number of active policies per device to 32, is resolved by Windows. The issue involves a potential [Boot stop failure when more than 32 policies are active](/windows/security/application-security/application-control/windows-defender-application-control/operations/known-issues#boot-stop-failure-blue-screen-occurs-if-more-than-32-policies-are-active) on a device. + +This issue is resolved for devices that run Windows 10 1903 or later with a Windows security update released on or after March 12, 2024. Older versions of Windows can expect to receive this fix in future Windows security updates. + +Applies to: + +- Windows 10 version 1903 and later + +To learn more about App Control for Business policy for Intune, see [Manage approved apps for Windows devices with App Control for Business policy and Managed Installers for Microsoft Intune](../protect/endpoint-security-app-control-policy.md). + +### Tenant administration + +#### Customization pane support for excluding groups + +The Customization pane now supports selecting groups to exclude when assigning policies. You can find this setting in the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) by selecting **Tenant administration** > **Customization**. + +For more information, see [Assign policies in Microsoft Intune](../configuration/device-profile-assign.md). + +## Week of January 29, 2024 + +### Microsoft Intune Suite + +#### Microsoft Intune Enterprise Application Management + +Enterprise Application Management provides an Enterprise App Catalog of Win32 applications that are easily accessible in Intune. You can add these applications to your tenant by selecting them from the Enterprise App Catalog. When you add an Enterprise App Catalog app to your Intune tenant, default installation, requirements, and detection settings are automatically provided. You can modify these settings as well. Intune hosts Enterprise App Catalog apps in Microsoft storage. + +For more information, see: + +- [Use Intune Suite add-on capabilities](../fundamentals/intune-add-ons.md) +- [Microsoft Intune Enterprise Application Management](../apps/apps-enterprise-app-management.md) +- [Add an Enterprise App Catalog app to Microsoft Intune](../apps/apps-add-enterprise-app.md) + +#### Microsoft Intune Advanced Analytics + +Intune Advanced Analytics provides comprehensive visibility of the end-user experience in your organization and optimizes it with data driven insights. It includes near real-time data about your devices with Device query, increased visibility with custom device scopes, a battery health report and a detailed device timeline for troubleshooting device issues, and anomaly detection to help identify potential vulnerabilities or risks across your device estate. + +- **Battery health report** + + The battery health report provides visibility into the health of batteries in your organization's devices and its influence on user experience. The scores and insights in this report are aimed to help IT admins with asset management and purchase decisions that improve user experience while balancing hardware costs. + +- **Run on-demand device queries on single devices** + + Intune allows you to quickly gain on-demand information about the state of your device. When you enter a query on a selected device, Intune runs a query in real time. + + The data returned can then be used to respond to security threats, troubleshoot the device, or make business decisions. + + Applies to: + + - Windows devices + +Intune Advanced Analytics is part of the Microsoft Intune Suite. For added flexibility, this new set of capabilities, together with the existing Advanced Analytics features, is also now available as an individual add-on to Microsoft subscriptions that include Intune. + +To use Device query and battery health report in your tenant, or any of the existing Advanced Analytics capabilities, you must have a license for either: + +- The Intune Advanced Analytics add-on +- The Microsoft Intune Suite add-on + +For more information, see: + +- [Use Intune Suite add-on capabilities](../fundamentals/intune-add-ons.md) +- [Microsoft Intune Advanced Analytics](../../analytics/advanced-endpoint-analytics.md) +- [Battery health](../../analytics/battery-health.md) +- [Device query](../../analytics/device-query.md) ## Week of January 22, 2024 (Service release 2401) @@ -1542,7 +1875,7 @@ The EpmTools PowerShell module is now available for use with Intune Endpoint Pri For more information, see [EpmTools PowerShell module](../protect/epm-overview.md#epmtools-powershell-module). #### Endpoint Privilege Management support to manage elevation rules for child processes -With Intune Endpoint Privilege Management (EPM) you can manage which files and processes are allowed to *Run as Administrator* on your Windows devices. Now, EPM [elevation rules](../protect/epm-policies.md#create-a-windows-elevation-rules-policy) support a new setting, **Child process behavior**. +With Intune Endpoint Privilege Management (EPM) you can manage which files and processes are allowed to *Run as Administrator* on your Windows devices. Now, EPM [elevation rules](../protect/epm-policies.md#windows-elevation-rules-policy) support a new setting, **Child process behavior**. With *Child process behavior*, your rules can manage the elevation context for any child processes created by the managed process. Options include: @@ -2463,7 +2796,7 @@ This permission is also added to the **Organizational Messages Manager** built-i You can now delete organizational messages from Microsoft Intune. After you delete a message, it's removed from Intune, and no longer appears in the admin center. You can delete a message anytime, regardless of its status. Intune automatically cancels active messages after you delete them. For more information, see [Delete organizational messages](../remote-actions/organizational-messages-cancel.md#delete-message). #### Review audit logs for organizational messages -Use audit logs to track and monitor organizational message events in Microsoft Intune. To access the logs, sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and go to **Tenant administration** > **Audit logs**. For more information, see [Audit logs for Intune activities](monitor-audit-logs.md#audit-logs-for-intune-workloads). +Use audit logs to track and monitor organizational message events in Microsoft Intune. To access the logs, sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and go to **Tenant administration** > **Audit logs**. For more information, see [Audit logs for Intune activities](monitor-audit-logs.md#view-the-audit-logs). ## Week of April 10, 2023 @@ -3817,7 +4150,7 @@ Applies to: - Windows 10/11 > [!NOTE] -> ASR polices don't support merge functionality for *ASR Only Per Rule Exclusions* and a policy conflict can result when multiple polices that configure *ASR Only Per Rule Exclusions* for the same device conflict. To avoid conflicts, combine the configurations for *ASR Only Per Rule Exclusions* into a single ASR policy. We are investigating adding policy merge for *ASR Only Per Rule Exclusions* in a future update. +> ASR policies don't support merge functionality for *ASR Only Per Rule Exclusions* and a policy conflict can result when multiple policies that configure *ASR Only Per Rule Exclusions* for the same device conflict. To avoid conflicts, combine the configurations for *ASR Only Per Rule Exclusions* into a single ASR policy. We are investigating adding policy merge for *ASR Only Per Rule Exclusions* in a future update. #### Grant apps permission to silently use certificates on Android Enterprise devices You can now configure silent use of certificates by apps on Android Enterprise devices that enrolled as **Fully Managed, Dedicated, and Corporate-Owned work Profile**. @@ -4124,7 +4457,7 @@ You can now use Intune role-based access control (RBAC) when interacting with te ### App management #### Android strong biometric change detection -The Android **Fingerprint instead of PIN for access** setting in Intune, which allows the end-user to use [fingerprint authentication](https://developer.android.com/about/versions/marshmallow/android-6.0.html#fingerprint-authentication) instead of a PIN, is being modified. This change allows you to require end-users to set strong biometrics. And, if a change in strong biometrics is detected, you can require end-users to confirm their app protection policy (APP) PIN. You can find Android app protection polices in [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) by selecting **Apps** > **App protection policies** > **Create policy** > **Android**. For more information, see [Android app protection policy settings in Microsoft Intune](../apps/app-protection-policy-settings-android.md#access-requirements). +The Android **Fingerprint instead of PIN for access** setting in Intune, which allows the end-user to use [fingerprint authentication](https://developer.android.com/about/versions/marshmallow/android-6.0.html#fingerprint-authentication) instead of a PIN, is being modified. This change allows you to require end-users to set strong biometrics. And, if a change in strong biometrics is detected, you can require end-users to confirm their app protection policy (APP) PIN. You can find Android app protection policies in [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) by selecting **Apps** > **App protection policies** > **Create policy** > **Android**. For more information, see [Android app protection policy settings in Microsoft Intune](../apps/app-protection-policy-settings-android.md#access-requirements). #### Noncompliance details available for Android (AOSP) in Microsoft Intune app Android (AOSP) users can view noncompliance reasons in the Microsoft Intune app. These details describe why a device is marked noncompliant. This information is available on the Device details page for devices enrolled as user-associated Android (AOSP) devices. diff --git a/memdocs/intune/fundamentals/whats-new.md b/memdocs/intune/fundamentals/whats-new.md index e735af4422e..86a285cd2e3 100644 --- a/memdocs/intune/fundamentals/whats-new.md +++ b/memdocs/intune/fundamentals/whats-new.md @@ -7,7 +7,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 08/02/2024 +ms.date: 09/10/2024 ms.topic: conceptual ms.service: microsoft-intune ms.subservice: fundamentals @@ -76,18 +76,365 @@ You can use RSS to be notified when this page is updated. For more information, --> +## Week of September 9, 2024 + +### App management + +#### Managed Home Screen user experience update +All Android devices will be automatically migrated to the updated Managed Home Screen (MHS) user experience. For more information, see [Updates to the Managed Home Screen experience](https://techcommunity.microsoft.com/t5/intune-customer-success/updates-to-the-managed-home-screen-experience/bc-p/3997842). + +### Device enrollment + +#### Support has ended for Apple profile-based user enrollment with Company Portal + +Apple supports two types of manual enrollment methods for users and devices in bring-your-own-device (BYOD) scenarios: *profile-based enrollment* and *account-driven enrollment*. Apple has ended support for profile-based user enrollment, known in Intune as *user enrollment with Company Portal*. This method was their privacy-focused BYOD enrollment flow that used managed Apple IDs. As a result of this change, Intune has ended support for [profile-based user enrollment with Company Portal](../enrollment/apple-user-enrollment-with-company-portal.md). Users can no longer enroll devices targeted with this enrollment profile type. Devices already enrolled with this profile type aren't impacted by this change, so you can continue to manage them in the admin center and receive Microsoft Intune technical support. Less than 1% of Apple devices across all Intune tenants are currently enrolled this way, so this change doesn't affect the majority of enrolled devices. + +There is no change to profile-based device enrollment with Company Portal, the default enrollment method for BYOD scenarios. Devices enrolled via Apple automated device enrollment also remain unaffected. + +We recommend account-driven user enrollment as a replacement method for devices. For more information about your BYOD enrollment options in Intune, see: + +* [Account-driven user enrollment](../enrollment/apple-account-driven-user-enrollment.md) + +* [Web-based device enrollment](../enrollment/web-based-device-enrollment-ios.md) + +* [Device enrollment with Company Portal](../enrollment/ios-device-enrollment.md#app-or-web-based-enrollment) (default enrollment method for BYOD scenarios) + +For more information about the device enrollment types supported by Apple, see [Intro to Apple device enrollment types](https://support.apple.com/en-mide/guide/deployment/dep08f54fcf6/web) in the Apple Platform Deployment guide. + +### Device management + +#### Intune now supports iOS/iPadOS 16.x as the minimum version + +Later this year, we expect iOS 18 and iPadOS 18 to be released by Apple. Microsoft Intune, including the Intune Company Portal and Intune app protection policies (APP, also known as MAM), will require iOS/iPadOS 16 and higher shortly after the iOS/iPadOS 18 release. + +For more information on this change, go to [Plan for change: Intune is moving to support iOS/iPadOS 16 and later](whats-new.md#plan-for-change-intune-is-moving-to-support-iosipados-16-and-later). + +> [!NOTE] +> Userless iOS and iPadOS devices enrolled through Automated Device Enrollment (ADE) have a slightly nuanced support statement due to their shared usage. For more information, go to [Support statement for supported versus allowed iOS/iPadOS versions for user-less devices](https://aka.ms/ADE_userless_support). + +Applies to: + +- iOS/iPadOS + +#### Intune now supports macOS 13.x as the minimum version + +With Apple's release of macOS 15 Sequoia, Microsoft Intune, the Company Portal app, and the Intune MDM agent will now require macOS 13 (Ventura) and later. + +For more information on this change, go to [Plan for change: Intune is moving to support macOS 13 and later](whats-new.md#plan-for-change-intune-is-moving-to-support-macos-13-and-higher-later-this-year) + +> [!NOTE] +> macOS devices enrolled through Automated Device Enrollment (ADE) have a slightly nuanced support statement due to their shared usage. For more information, go to [Support statement](https://aka.ms/Intune/macOS/ADE-DE-support). + +Applies to: + +- macOS + +## Week of August 19, 2024 (Service release 2408) + +### Microsoft Intune Suite + +#### Easy creation of Endpoint Privilege Management elevation rules from support approval requests and reports + +You can now create Endpoint Privilege Management (EPM) elevation rules directly from a support approved elevation request or from details found in the EPM Elevation report. With this new capability, you won’t need to manually identify specific file detection details for elevation rules. Instead, for files that appear in the Elevation report or a support approved elevation request, you can select that file to open its elevation detail pane, and then select the option to **Create a rule with these file details**. + +When you use this option, you can then choose to add the new rule to one of your existing elevation policies, or create a new policy with only the new rule. + +Applies to: + +- Windows 10 +- Windows 11 + +For information about this new capability, see [Windows elevation rules policy](../protect/epm-policies.md) in the *Configure policies for Endpoint Privilege management* article. + +#### Introducing the Resource performance report for physical devices in Advanced Analytics + +We're introducing the Resource performance report for Windows physical devices in Intune Advanced Analytics. The report is included as an Intune-add on under Microsoft Intune Suite. + +The resource performance scores and insights for physical devices are aimed to help IT admins make CPU/RAM asset management and purchase decisions that improve the user experience while balancing hardware costs. + +For more information, see: + +- [Resource Performance Report](../../analytics/resource-performance-report.md) +- [Microsoft Intune Suite](../fundamentals/intune-add-ons.md) + +### App management + +#### Managed Home Screen for Android Enterprise Fully Managed devices + +Managed Home Screen (MHS) is now supported on Android Enterprise Fully Managed devices. This capability offers organizations the ability to leverage MHS in scenarios where a device is associated with a single user. + +For related information, see: + +- [Configure the Microsoft Managed Home Screen app for Android Enterprise](../apps/app-configuration-managed-home-screen-app.md) +- [Android Enterprise device settings list to allow or restrict features on corporate-owned devices using Intune](../configuration/device-restrictions-android-for-work.md) +- [Configure permissions for the Managed Home Screen (MHS) on Android Enterprise devices using Microsoft Intune](../configuration/oemconfig-managed-home-screen-permissions-android.md) + +#### Updates to the Discovered Apps report + +The **Discovered Apps** report, which provides a list of detected apps that are on Intune enrolled devices for your tenant, now provides publisher data for Win32 apps, in addition to Store apps. Rather than providing publisher information only in the exported report data, we are including it as a column in the **Discovered Apps** report. + +For more information, see [Intune Discovered apps](../apps/app-discovered-apps.md#monitor-discovered-apps-with-intune). + +#### Improvements to Intune Management Extension logs + +We have updated how log activities and events are made for Win32 apps and the Intune Management Extension (IME) logs. A new log file (*AppWorkload.log*) contains all logging information related to app deployment activities conducted by the IME. These improvements provide better troubleshooting and analysis of app management events on the client. + +For more information, see [Intune management extension logs](../apps/intune-management-extension.md#intune-management-extension-logs). + +### Device configuration + +#### New settings available in the Apple settings catalog + +The [Settings Catalog](../configuration/settings-catalog.md) lists all the settings you can configure in a device policy, and all in one place. For more information about configuring Settings Catalog profiles in Intune, see [Create a policy using settings catalog](../configuration/settings-catalog.md). + +There are new settings in the Apple Settings Catalog. To see these settings, in the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Devices** > **Manage devices** > **Configuration** > **Create** > **New policy** > **iOS/iPadOS** or **macOS** for platform > **Settings catalog** for profile type. + +##### iOS/iPadOS + +**Declarative Device Management (DDM) > Safari Extension Settings**: + +- Managed Extensions + - Allowed Domains + - Denied Domains + - Private Browsing + - State + +**Declarative Device Management (DDM) > Software Update Settings**: + +- Automatic Actions + - Download + - Install OS Updates + +- Deferrals + - Combined Period In Days + +- Notifications + +- Rapid Security Response + - Enable + - Enable Rollback + +- Recommended Cadence + +**Restrictions**: + +- Allow ESIM Outgoing Transfers +- Allow Genmoji +- Allow Image Playground +- Allow Image Wand +- Allow iPhone Mirroring +- Allow Personalized Handwriting Results +- Allow Video Conferencing Remote Control +- Allow Writing Tools + +##### macOS + +**Authentication > Extensible Single Sign On (SSO)**: + +- Platform SSO + - Authentication Grace Period + - FileVault Policy + - Non Platform SSO Accounts + - Offline Grace Period + - Unlock Policy + +**Authentication > Extensible Single Sign On Kerberos**: + +- Allow Password +- Allow SmartCard +- Identity Issuer Auto Select Filter +- Start In Smart Card Mode + +**Declarative Device Management (DDM) > Disk Management**: + +- External Storage +- Network Storage + +**Declarative Device Management (DDM) > Safari Extension Settings**: + +- Managed Extensions + - Allowed Domains + - Denied Domains + - Private Browsing + - State + +**Declarative Device Management (DDM) > Software Update Settings**: + +- Allow Standard User OS Updates + +- Automatic Actions + - Download + - Install OS Updates + - Install Security Update + +- Deferrals + - Major Period In Days + - Minor Period In Days + - System Period In Days + +- Notifications + +- Rapid Security Response + - Enable + - Enable Rollback + +**Restrictions**: + +- Allow Genmoji +- Allow Image Playground +- Allow iPhone Mirroring +- Allow Writing Tools + +**System Policy > System Policy Control**: + +- Enable XProtect Malware Upload + +#### Enhancements to multi administrative approval + +Multi administrative approval adds the ability to limit application access policies to Windows applications or all non-Windows applications or both. We're adding a new access policy to the multiple administrative approval feature to allow approvals for changes to multiple administrative approval. + +For more information, see [Multi admin approval](../fundamentals/multi-admin-approval.md). + +### Device enrollment + +#### Account-driven Apple User Enrollment now generally available for iOS/iPadOS 15+ + +Intune now supports account-driven Apple User Enrollment, the new, and improved version of Apple User Enrollment, for devices running iOS/iPadOS 15 and later. This new enrollment method utilizes just-in-time registration, removing the Company Portal app for iOS as an enrollment requirement. Device users can initiate enrollment directly in the Settings app, resulting in a shorter and more efficient onboarding experience. + +For more information, see [Set up account driven Apple User Enrollment](../enrollment/apple-account-driven-user-enrollment.md) on Microsoft Learn. + +Apple has announced they are ending support for profile-based Apple User Enrollment. As a result, Microsoft Intune will end support for Apple User Enrollment with Company Portal shortly after the release of iOS/iPadOS 18. We recommend enrolling devices with account-driven Apple User Enrollment for similar functionality and an improved user experience. + +#### Use corporate Microsoft Entra account to enable Android Enterprise management options in Intune + +Managing Intune-enrolled devices with Android Enterprise management options previously required you to connect your Intune tenant to your managed Google Play account using an enterprise Gmail account. Now you can use a corporate Microsoft Entra account to establish the connection. This change is happening in new tenants, and doesn't affect tenants that have already established a connection. + +For more information, see [Connect Intune account to Managed Google Play account - Microsoft Intune | Microsoft Learn](../enrollment/connect-intune-android-enterprise.md). + +### Device management + +#### 21 Vianet support for Mobile Threat Defense connectors + +Intune operated by 21Vianet now supports Mobile Threat Defense (MTD) connectors for Android and iOS/iPadOS devices for MTD vendors that also have support in that environment. When an MTD partner is supported and you sign in to a 21Vianet tenant, the supported connectors are available. + +Applies to: + +- Android +- iOS/iPadOS + +For more information, see: + +- [Intune operated by 21Vianet in China](../fundamentals/china.md) +- [Mobile Threat Defense integration with Intune](../protect/mobile-threat-defense.md) + +#### New `cpuArchitecture` filter device property for app and policy assignments + +When you assign an app, compliance policy, or configuration profile, you can filter the assignment using different device properties, such as device manufacturer, operating system SKU, and more. + +A new `cpuArchitecture` device filter property is available for Windows and macOS devices. With this property, you can filter app and policy assignments depending on the processor architecture. + +For more information on filters and the device properties you can use, see: + +- [Use filters when assigning your apps, policies, and profiles in Microsoft Intune](filters.md) +- [Filter properties](filters-device-properties.md) +- [Supported workloads](filters-supported-workloads.md) + +Applies to: + +- Windows 10 +- Windows 11 +- macOS + +### Device security + +#### Windows platform name change for endpoint security policies + +When you create an endpoint security policy in Intune, you can select the Windows platform. For multiple templates in endpoint security, there are now only two options to choose for the Windows platform: **Windows** and **Windows (ConfigMgr)**. + +Specifically, the platform name changes are: + +| Original | New | +| --- | --- | +| Windows 10 and later​ | Windows | +| Windows 10 and later (ConfigMgr)​ | Windows (ConfigMgr)​ | +| Windows 10, Windows 11, and Windows Server | Windows | +| Windows 10, Windows 11, and Windows Server​ (ConfigMgr) | Windows (ConfigMgr)​ | + +These changes apply to the following policies: + +- Antivirus +- Disk encryption +- Firewall +- Endpoint Privilege Management +- Endpoint detection and response +- Attack surface reduction +- Account protection + +##### What you need to know + +- This change is only in the user experience (UX) that admins see when they create a new policy. There is no effect on devices. +- The functionally is the same as the previous platform names. +- There are no additional tasks or actions for existing policies. + +For more information on endpoint security features in Intune, see [Manage endpoint security in Microsoft Intune](../protect/endpoint-security.md). + +Applies to: + +- Windows + +#### Target Date Time setting for Apple software update enforcement schedules updates using the local time on devices + +You can specify the time that OS updates are enforced on devices in their local time zone. For example, configuring an OS update to be enforced at 5pm schedules the update for 5pm in the device's local time zone. Previously, this setting used the time zone of the browser where the policy was configured. + +This change only applies to new policies that are created in the August 2408 release and later. The **Target Date Time** setting is in the settings catalog at **Devices** > **Manage devices** > **Configuration** > **Create** > **New policy** > **iOS/iPadOS** or **macOS** for platform > **Settings catalog** for profile type > **Declarative Device Management** > Software Update. + +In a future release, the **UTC** text will be removed from the **Target Date Time** setting. + +For more information on using the settings catalog to configure software updates, see [Managed software updates with the settings catalog](../protect/managed-software-updates-ios-macos.md). + +Applies to: + +- iOS/iPadOS +- macOS + +### Intune Apps + +#### Newly available protected apps for Intune + +The following protected apps are now available for Microsoft Intune: + +- Singletrack for Intune (iOS) by Singletrack +- 365Pay by 365 Retail Markets +- Island Browser for Intune (Android) by Island Technology, Inc. +- Recruitment.Exchange by Spire Innovations, Inc. +- Talent.Exchange by Spire Innovations, Inc. + +For more information about protected apps, see [Microsoft Intune protected apps](../apps/apps-supported-intune-apps.md). + +### Tenant administration + +#### Organizational messages now in Microsoft 365 admin center + +The organizational message feature has moved out of the Microsoft Intune admin center and into its new home in the Microsoft 365 admin center. All organizational messages you created in Microsoft Intune are now in the Microsoft 365 admin center, where you can continue to view and manage them. The new experience includes highly requested features such as the ability to author custom messages, and deliver messages on Microsoft 365 apps. + +For more information, see: + +- [Introducing organizational messages (preview) in the Microsoft 365 admin center](https://techcommunity.microsoft.com/t5/microsoft-365-blog/introducing-organizational-messages-preview-in-the-microsoft-365/ba-p/4123890) +- [Organizational messages in the Microsoft 365 admin center](/microsoft-365/admin/misc/organizational-messages-microsoft-365) +- [Support tip: Organizational messages is moving to Microsoft 365 admin center - Microsoft Community Hub](https://techcommunity.microsoft.com/t5/intune-customer-success/support-tip-organizational-messages-is-moving-to-microsoft-365/ba-p/4148332) + ## Week of July 29, 2024 ### Microsoft Intune Suite -#### Endpoint Privilege Management, Advanced Analytics, and Intune Plan 2 is available for GCC High and DoD +#### Endpoint Privilege Management, Advanced Analytics, and Intune Plan 2 is available for GCC High and DoD We are excited to announce that the following capabilities from the Microsoft Intune Suite are now supported in U.S. Government Community Cloud (GCC) High and U.S. Department of Defense (DoD) environments. Add-on capabilities: - [Endpoint Privilege Management](../protect/epm-overview.md) -- [Advanced Analytics](../../analytics/advanced-endpoint-analytics.md) - With this release, GCC High and DoD support for Advanced Endpoint Analytics not include the [*Device query*](../../analytics/device-query.md) functionality. +- [Advanced Analytics](../../analytics/advanced-endpoint-analytics.md) - With this release, GCC High and DoD support for Advanced Endpoint Analytics doesn't include the [*Device query*](../../analytics/device-query.md) functionality. Plan 2 capabilities: @@ -100,34 +447,32 @@ For more information, see: - [Use Microsoft Intune Suite add-on capabilities](../fundamentals/intune-add-ons.md) - [Microsoft Intune for US Government GCC service description](../fundamentals/intune-govt-service-description.md) -### Device enrollment +### Device enrollment -#### ACME protocol support for iOS/iPadOS and macOS enrollment -As we prepare to support managed device attestation in Intune, we are starting a phased rollout of an infrastructure change for new enrollments that includes support for the *Automated Certificate Management Environment (ACME) protocol*. Now when new Apple devices enroll, the management profile from Intune receives an ACME certificate instead of a SCEP certificate. ACME provides better protection than SCEP against unauthorized certificate issuance through robust validation mechanisms and automated processes, which helps reduce errors in certificate management. +#### ACME protocol support for iOS/iPadOS and macOS enrollment +As we prepare to support managed device attestation in Intune, we are starting a phased rollout of an infrastructure change for new enrollments that includes support for the *Automated Certificate Management Environment (ACME) protocol*. Now when new Apple devices enroll, the management profile from Intune receives an ACME certificate instead of a SCEP certificate. ACME provides better protection than SCEP against unauthorized certificate issuance through robust validation mechanisms and automated processes, which helps reduce errors in certificate management. Existing OS and hardware eligible devices do not get the ACME certificate unless they re-enroll. There is no change to the end user's enrollment experience, and no changes to the Microsoft Intune admin center. This change only impacts enrollment certificates and has no impact on any device configuration policies. -ACME is supported for Apple Device Enrollment and Apple Configurator enrollment methods. Eligible OS versions include: - -* iOS 16.0 or later +ACME is supported for Apple Device Enrollment and Apple Configurator enrollment methods. Eligible OS versions include: -* iPadOS 16.1 or later - -* macOS 13.1 or later +- iOS 16.0 or later +- iPadOS 16.1 or later +- macOS 13.1 or later ## Week of July 22, 2024 (Service release 2407) -### Microsoft Intune Suite +### Microsoft Intune Suite -#### New actions for Microsoft Cloud PKI +#### New actions for Microsoft Cloud PKI -The following actions have been added for Microsoft Cloud PKI issuing and root certification authorities (CA): +The following actions have been added for Microsoft Cloud PKI issuing and root certification authorities (CA): -* Delete: Delete a CA. -* Pause: Temporarily suspend use of a CA. -* Revoke: Revoke a CA certificate. +- Delete: Delete a CA. +- Pause: Temporarily suspend use of a CA. +- Revoke: Revoke a CA certificate. -You can access all new actions in the Microsoft Intune admin center and Graph API. For more information, see [Delete Microsoft Cloud PKI certification authority](../protect/microsoft-cloud-pki-delete.md). +You can access all new actions in the Microsoft Intune admin center and Graph API. For more information, see [Delete Microsoft Cloud PKI certification authority](../protect/microsoft-cloud-pki-delete.md). ### App management @@ -199,10 +544,6 @@ Applies to: ### Device enrollment -#### Use corporate Microsoft Entra account to enable Android Enterprise management options in Intune - -Managing Intune-enrolled devices with Android Enterprise management options previously required you to connect your Intune tenant to your managed Google Play account using a personal Gmail account. Now you can use a corporate Microsoft Entra account to establish the connection. This change is happening in new tenants, and doesn't affect tenants that have already established a connection. For more information, see [Connect Intune account to Managed Google Play account - Microsoft Intune | Microsoft Learn](../enrollment/connect-intune-android-enterprise.md). - #### New support for Red Hat Enterprise Linux Microsoft Intune now supports device management for Red Hat Enterprise Linux. You can enroll and manage Red Hat Enterprise Linux devices, and assign standard compliance policies, custom configuration scripts, and compliance scripts. For more information, see [Deployment guide: Manage Linux devices in Microsoft Intune](deployment-guide-platform-linux.md) and [Enrollment guide: Enroll Linux desktop devices in Microsoft Intune](deployment-guide-enrollment-linux.md). @@ -223,7 +564,7 @@ For more information, see: #### Just-in-time registration and compliance remediation available for all iOS/iPadOS enrollments -You can now configure just-in-time (JIT) registration and JIT compliance remediation for all Apple iOS and iPadOS enrollments. These Intune-supported features improve the enrollment experience because they can take the place of the Intune Company Portal app for device registration and compliance checks. We recommend setting up JIT registration and compliance remediation for new enrollments, and to improve the experience for existing enrolled devices. For more information, see [Set up just in time registration in Microsoft Intune](../enrollment/set-up-just-in-time-registration.md). +You can now configure just-in-time (JIT) registration and JIT compliance remediation for all Apple iOS and iPadOS enrollments. These Intune-supported features improve the enrollment experience because they can take the place of the Intune Company Portal app for device registration and compliance checks. We recommend setting up JIT registration and compliance remediation for new enrollments, and to improve the experience for existing enrolled devices. For more information, see [Set up just in time registration in Microsoft Intune](../enrollment/set-up-just-in-time-registration.md). ### Device management @@ -688,7 +1029,7 @@ When frontline workers receive the devices, all they have to do is connect to Wi End users can now view the BitLocker Recovery Key for enrolled Windows devices from the Company Portal website. This capability can reduce helpdesk calls in the event the end user gets locked out of their corporate machines. End users can access the recovery key for an enrolled device by signing into the Company Portal website and selecting **Show recovery key**. This experience is similar to the MyAccount website, which also allows end users to see recovery keys. -You can prevent end users within your organization from accessing BitLocker recovery keys by configuring the Entra ID toggle **Restrict non-admin users from recovering the BitLocker key(s) for their owned device**. +You can prevent end users within your organization from accessing BitLocker recovery keys by configuring the Microsoft Entra toggle **Restrict non-admin users from recovering the BitLocker key(s) for their owned device**. For more information, see: @@ -1019,7 +1360,7 @@ Applies to ### Microsoft Intune Suite -#### New elevation type for Endpoint Privilege Management +#### New elevation type for Endpoint Privilege Management Endpoint Privilege Management has a new file elevation type, **support approved**. Endpoint Privilege Management is a feature component of the Microsoft Intune Suite and is also available as a standalone [Intune add-on](../fundamentals/intune-add-ons.md). @@ -1291,337 +1632,6 @@ The following protected apps are now available for Microsoft Intune: For more information about protected apps, see [Microsoft Intune protected apps](../apps/apps-supported-intune-apps.md). -## Week of March 3, 2024 - -### Device enrollment - -#### Role-based access control changes to enrollment settings for Windows Hello for Business - -We updated Role-based access control (RBAC) in the enrollment area for Windows Hello for Business. Enrollment settings related to Windows Hello for Business are read-only for all roles except the Intune Service Administrator. The Intune Service Administrator can create and edit Windows Hello for Business enrollment settings. - -For more information, see [Role-based access control](../protect/windows-hello.md#role-based-access-control) in the *Windows Hello at device enrollment* article. - -### Device security - -#### New enrollment configuration for Windows Hello for Business - -A new Windows Hello for Business enrollment setting, **Enable enhanced sign in security** is available in the Intune admin center. Enhanced sign-in security is a Windows Hello feature that prevents malicious users from gaining access to a user's biometrics through external peripherals. - -For more information about this setting, see [Create a Windows Hello for Business policy](../protect/windows-hello.md). - -#### HTML formatting supported in noncompliance email notifications - -Intune now supports HTML formatting in noncompliance email notifications for all platforms. You can use supported HTML tags to add formatting such as italics, URL links, and bulleted lists to your organization's messages. - -For more information, see [Create a notification message template](../protect/actions-for-noncompliance.md#create-a-notification-message-template). - -## Week of February 26, 2024 - -### Microsoft Intune Suite - -#### New Microsoft Cloud PKI service - -Use the Microsoft Cloud PKI service to simplify and automate certificate lifecycle management for Intune-managed devices. ​Microsoft Cloud PKI is a feature component of the Microsoft Intune Suite and is also available as a standalone [Intune add-on](../fundamentals/intune-add-ons.md). The cloud-based service provides a dedicated PKI infrastructure for your organization, and doesn't require on-premises servers, connectors, or hardware. Microsoft Cloud PKI automatically issues, renews, and revokes certificates for all OS platforms supporting the SCEP certificate device configuration profile. Issued certificates can be used for certificate-based authentication for Wi-Fi, VPN, and other services supporting certificate-based authentication. For more information, see [Overview of Microsoft Cloud PKI](../protect/microsoft-cloud-pki-overview.md). - -Applies to: - -- Windows -- Android -- iOS/iPadOS -- macOS - -### Intune apps - -#### Newly available protected app for Intune - -The following protected app is now available for Microsoft Intune: - -- Cinebody by Super 6 LLC - -For more information about protected apps, see [Microsoft Intune protected apps](../apps/apps-supported-intune-apps.md). - -## Week of February 19, 2024 (Service release 2402) - -### App management - -#### More app configuration permissions for Android apps - -There are six new permissions that can be configured for an Android app using an app configuration policy. They are: - -- Allow background body sensor data -- Media Video (read) -- Media Images (read) -- Media Audio (read) -- Nearby Wifi Devices -- Nearby Devices - -For more information about how to use app config policies for Android apps, see [Add app configuration policies for managed Android Enterprise devices](../apps/app-configuration-policies-use-android.md). - -#### Newly available protected apps for Intune - -The following protected apps are now available for Microsoft Intune: - -- Bob HR by Hi Bob Ltd -- ePRINTit SaaS by ePRINTit USA LLC -- Microsoft Copilot by Microsoft Corporation - -For more information about protected apps, see [Microsoft Intune protected apps](../apps/apps-supported-intune-apps.md). - -#### Update to Intune Management Extension on Windows - -To support expanded functionality and bug fixes, use .NET Framework 4.7.2 or higher with the Intune Management Extension on Windows clients. If a Windows client continues to use an earlier version of the .NET Framework, the Intune Management Extension continues to function. The .NET Framework 4.7.2 is available from Windows Update as of July 10, 2018, which is included in Windows 10 1809 (RS5) and newer. Multiple versions of the .NET Framework can coexist on a device. - -Applies to: - -- Windows 10 -- Windows 11 - -### Device configuration - -#### Use assignment filters on Endpoint Privilege Management (EPM) policies - -You can use assignment filters to assign a policy based on rules you create. A filter allows you to narrow the assignment scope of a policy, like targeting devices with a specific OS version or a specific manufacturer. - -You can use filters on Endpoint Privilege Management (EPM) policies. - -For more information, see: - -- [Use filters when assigning your apps, policies, and profiles in Intune](filters.md) -- [List of platforms, policies, and app types supported by filters in Intune](filters-supported-workloads.md) - -Applies to: - -- Windows 10 -- Windows 11 - -#### New settings available in the Apple settings catalog - -The [Settings Catalog](../configuration/settings-catalog.md) lists all the settings you can configure in a device policy, and all in one place. - -There are new settings in the Settings Catalog. To see these settings, in the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Devices** > **Manage devices** > **Configuration** > **Create** > **New policy** > **iOS/iPadOS** or **macOS** for platform > **Settings catalog** for profile type. - -##### iOS/iPadOS - -- **Restrictions** - - - Allow Live Voicemail - - Force Classroom Unprompted Screen Observation - - Force Preserve ESIM On Erase - -##### macOS - -- **Full Disk Encryption > FileVault** > Force Enable In Setup Assistant -- **Restrictions** > Force Classroom Unprompted Screen Observation - -For more information, see: - -- [Use FileVault disk encryption for macOS with Intune](../protect/encrypt-devices-filevault.md) -- [Create a policy using settings catalog](../configuration/settings-catalog.md) - -#### Import up to 20 custom ADMX and ADML administrative templates - -You can import custom ADMX and ADML administrative templates in Microsoft Intune. Previously, you could import up to 10 files. Now, you can upload up to 20 files. - -Applies to: - -- Windows 10 -- Windows 11 - -For more information on this feature, see [Import custom ADMX and ADML administrative templates into Microsoft Intune (public preview)](../configuration/administrative-templates-import-custom.md). - -#### New setting for updating MAC address randomization on Android Enterprise devices - -There's a new **MAC address randomization** setting on Android Enterprise devices (**Devices** > **Manage devices** > **Configuration** > **Create** > **New policy** > **Android Enterprise** for platform > **Fully Managed, Dedicated, and Corporate-Owned Work Profile** > **Wi-Fi** for profile type). - -Starting with Android 10, when connecting to a network, devices present a randomized MAC address instead of the physical MAC address. Using randomized MAC addresses is recommended for privacy, as it's harder to track a device by its MAC address. However, randomized MAC addresses break functionality that relies on a static MAC address, including network access control (NAC). - -Your options: - -- **Use device default**: Intune doesn't change or update this setting. By default, when connecting to a network, devices present a randomized MAC address instead of the physical MAC address. Any updates made by the user to the setting persist. - -- **Use randomized MAC**: Enables MAC address randomization on devices. When devices connect to a new network, devices present a randomized MAC address, instead of the physical MAC address. If the user changes this value on their device, it resets to **Use randomized MAC** on the next Intune sync. - -- **Use device MAC**: Forces devices to present their actual Wi-Fi MAC address instead of a random MAC address. This setting allows devices to be tracked by their MAC address. Only use this value when necessary, such as for network access control (NAC) support. If the user changes this value on their device, it resets to **Use device MAC** on the next Intune sync. - -Applies to: - -- Android 13 and newer - -For more information on the Wi-Fi settings you can configure, see [Add Wi-Fi settings for Android Enterprise dedicated and fully managed devices in Microsoft Intune](../configuration/wi-fi-settings-android-enterprise.md). - -#### Turn Off Copilot in Windows setting in the Windows settings catalog - -The [Settings Catalog](../configuration/settings-catalog.md) lists all the settings you can configure in a device policy, and all in one place. - -There's a new setting in the Settings Catalog. To see this setting, in the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Devices** > **Manage devices** > **Configuration** > **Create** > **New policy** > **Windows** for platform > **Settings catalog** for profile type. - -- **Windows AI > Turn Off Copilot in Windows (User)** - - - If you enable this policy setting, users can't use Copilot. The Copilot icon won't appear on the taskbar. - - If you disable or don't configure this policy setting, users can use Copilot when it's available to them. - -This setting uses the [Policy CSP - WindowsAI](/windows/client-management/mdm/policy-csp-windowsai). - -For more information about configuring Settings Catalog policies in Intune, including user scope vs. device scope, see [Create a policy using settings catalog](../configuration/settings-catalog.md). - -Applies to: - -- Windows 10 and later - -#### Windows Autopilot self-deploying mode is now generally available - -Windows Autopilot self-deploying mode is now generally available and out of preview. Windows Autopilot self-deploying mode enables you to deploy Windows devices with little to no user interaction. Once the device connects to network, the device provisioning process starts automatically: the device joins Microsoft Entra ID, enrolls in Intune, and syncs all device-based configurations targeted to the device. Self-deploying mode ensures that the user can't access desktop until all device-based configuration is applied. The Enrollment Status Page (ESP) is displayed during OOBE so users can track the status of the deployment. For more information, see: - -- [Windows Autopilot self-deploying mode](/autopilot/self-deploying) -- [Step by step tutorial for Windows Autopilot self-deploying mode in Intune](/autopilot/tutorial/self-deploying/self-deploying-workflow) - -This information is also published in [Windows Autopilot: What's new](/autopilot/whats-new). - -#### Windows Autopilot for pre-provisioned deployment is now generally available - -Windows Autopilot for pre-provisioned deployment is now generally available and out of preview. Windows Autopilot for pre-provisioned deployment is used by organizations that want to ensure devices are business-ready before the user accesses them. With pre-provisioning, admins, partners, or OEMs can access a technician flow from the Out-of-box experience (OOBE) and kick off device setup. Next, the device is sent to the user who completes provisioning in the user phase. Pre-provisioning delivers most the configuration in advance so the end user can get to the desktop faster. For more information, see: - -- [Windows Autopilot for pre-provisioned deployment](/autopilot/pre-provision). -- [Step by step tutorial for Windows Autopilot for pre-provisioned deployment Microsoft Entra join in Intune](/autopilot/tutorial/pre-provisioning/azure-ad-join-workflow) -- [Step by step tutorial for Windows Autopilot for pre-provisioned deployment Microsoft Entra hybrid join in Intune](/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-workflow). - -This information is also published in [Windows Autopilot: What's new](/autopilot/whats-new). - -### Device enrollment - -#### ESP setting to install required apps during Windows Autopilot pre-provisioning - -The setting **Only fail selected blocking apps in technician phase** is now generally available to configure in Enrollment Status Page (ESP) profiles. This setting only appears in ESP profiles that have *blocking apps* selected. - -For more information, see [Set up the Enrollment Status Page](../enrollment/windows-enrollment-status.md#create-new-profile). - -#### New local primary account configuration for macOS automated device enrollment - -Configure local primary account settings for Macs enrolling in Intune via Apple automated device enrollment. These settings, supported on devices running macOS 10.11 and later, are available in new and existing enrollment profiles under the new **Account Settings** tab. For this feature to work, the enrollment profile must be configured with user-device affinity and one of the following authentication methods: - -- Setup Assistant with modern authentication -- Setup Assistant (legacy) - -Applies to: - -- macOS 10.11 and later - -For more information about macOS account settings, see [Create an Apple enrollment profile in Intune](../enrollment/device-enrollment-program-enroll-macos.md#create-an-apple-enrollment-profile). - -#### Await final configuration for macOS automated device enrollment now generally available - -Now generally available, *await final configuration* enables a locked experience at the end of Setup Assistant to ensure that critical device configuration policies are installed on devices. The locked experience works on devices targeted with new and existing enrollment profiles, enrolling via one of these authentication methods: - -- Setup Assistant with modern authentication -- Setup Assistant (legacy) -- Without user device affinity - -Applies to: - -- macOS 10.11 and later - -For information about how to enable await final configuration, see [Create an Apple enrollment profile](../enrollment/device-enrollment-program-enroll-macos.md#create-an-apple-enrollment-profile). - -### Device management - -#### AOSP devices check for new tasks and notifications approximately every 15 minutes - -On devices enrolled with Android (AOSP) management, Intune attempts to check for new tasks and notifications approximately every 15 minutes. To use this feature, devices must be using the Intune app version 24.02.4 or newer. - -Applies to: - -- Android (AOSP) - -For more information, see: - -- [How to use Intune in environments without Google Mobile Services](../apps/manage-without-gms.md#some-tasks-can-be-delayed) -- [Policy refresh intervals in Intune](../configuration/device-profile-troubleshoot.md#policy-refresh-intervals) - -#### New device management experience for Government clouds in Microsoft Intune - -In government clouds, there's a new device management experience in the Intune admin center. The **Devices** area now has a more consistent UI, with more capable controls and an improved navigation structure so you can find what you need faster. - -If you want to try the new experience before your tenant is updated, go to **Devices** > **Overview**, select the **Preview upcoming changes to Devices and provide feedback** notification banner, and select **Try it now**. - -#### Bulk approval of drivers - -Bulk actions are now available for Windows Driver update policies. With bulk actions, multiple driver updates can be approved, paused, or declined at the same time, saving time and effort. - -When you bulk approve drivers, the date for when the drivers become available to applicable devices can also be set, enabling drivers to be installed together. - -Applies to: - -- Windows 10 -- Windows 11 - -For more information, see [Bulk driver updates](../protect/windows-driver-updates-policy.md#bulk-driver-updates). - -#### App Control for Business policy limitation is resolved - -A previously documented limitation for App Control for Business policy (WDAC), that limited the number of active policies per device to 32, is resolved by Windows. The issue involves a potential [Boot stop failure when more than 32 policies are active](/windows/security/application-security/application-control/windows-defender-application-control/operations/known-issues#boot-stop-failure-blue-screen-occurs-if-more-than-32-policies-are-active) on a device. - -This issue is resolved for devices that run Windows 10 1903 or later with a Windows security update released on or after March 12, 2024. Older versions of Windows can expect to receive this fix in future Windows security updates. - -Applies to: - -- Windows 10 version 1903 and later - -To learn more about App Control for Business policy for Intune, see [Manage approved apps for Windows devices with App Control for Business policy and Managed Installers for Microsoft Intune](../protect/endpoint-security-app-control-policy.md). - -### Tenant administration - -#### Customization pane support for excluding groups - -The Customization pane now supports selecting groups to exclude when assigning policies. You can find this setting in the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) by selecting **Tenant administration** > **Customization**. - -For more information, see [Assign policies in Microsoft Intune](../configuration/device-profile-assign.md). - -## Week of January 29, 2024 - -### Microsoft Intune Suite - -#### Microsoft Intune Enterprise Application Management - -Enterprise Application Management provides an Enterprise App Catalog of Win32 applications that are easily accessible in Intune. You can add these applications to your tenant by selecting them from the Enterprise App Catalog. When you add an Enterprise App Catalog app to your Intune tenant, default installation, requirements, and detection settings are automatically provided. You can modify these settings as well. Intune hosts Enterprise App Catalog apps in Microsoft storage. - -For more information, see: - -- [Use Intune Suite add-on capabilities](../fundamentals/intune-add-ons.md) -- [Microsoft Intune Enterprise Application Management](../apps/apps-enterprise-app-management.md) -- [Add an Enterprise App Catalog app to Microsoft Intune](../apps/apps-add-enterprise-app.md) - -#### Microsoft Intune Advanced Analytics - -Intune Advanced Analytics provides comprehensive visibility of the end-user experience in your organization and optimizes it with data driven insights. It includes near real-time data about your devices with Device query, increased visibility with custom device scopes, a battery health report and a detailed device timeline for troubleshooting device issues, and anomaly detection to help identify potential vulnerabilities or risks across your device estate. - -- **Battery health report** - - The battery health report provides visibility into the health of batteries in your organization's devices and its influence on user experience. The scores and insights in this report are aimed to help IT admins with asset management and purchase decisions that improve user experience while balancing hardware costs. - -- **Run on-demand device queries on single devices** - - Intune allows you to quickly gain on-demand information about the state of your device. When you enter a query on a selected device, Intune runs a query in real time. - - The data returned can then be used to respond to security threats, troubleshoot the device, or make business decisions. - - Applies to: - - - Windows devices - -Intune Advanced Analytics is part of the Microsoft Intune Suite. For added flexibility, this new set of capabilities, together with the existing Advanced Analytics features, is also now available as an individual add-on to Microsoft subscriptions that include Intune. - -To use Device query and battery health report in your tenant, or any of the existing Advanced Analytics capabilities, you must have a license for either: - -- The Intune Advanced Analytics add-on -- The Microsoft Intune Suite add-on - -For more information, see: - -- [Use Intune Suite add-on capabilities](../fundamentals/intune-add-ons.md) -- [Microsoft Intune Advanced Analytics](../../analytics/advanced-endpoint-analytics.md) -- [Battery health](../../analytics/battery-health.md) -- [Device query](../../analytics/device-query.md) - ## What's new archive diff --git a/memdocs/intune/fundamentals/windows-10-virtual-machines.md b/memdocs/intune/fundamentals/windows-10-virtual-machines.md index 774b2cad5a5..73be438c2bc 100644 --- a/memdocs/intune/fundamentals/windows-10-virtual-machines.md +++ b/memdocs/intune/fundamentals/windows-10-virtual-machines.md @@ -31,7 +31,7 @@ ms.collection: - M365-identity-device-management --- -# Using Windows 10 virtual machines with Intune +# Using Windows 10/11 virtual machines with Intune Intune supports managing virtual machines running Windows 10 Enterprise with certain limitations. Intune management doesn't depend on, or interfere with Azure Virtual Desktop management of the same virtual machine. @@ -41,9 +41,9 @@ Intune supports managing virtual machines running Windows 10 Enterprise with cer - Windows Autopilot Self-deploying and pre-provisioning deployment types aren't supported because they require a physical Trusted Platform Module (TPM). -- Out of Box Experience (OOBE) enrollment isn't supported on VMs that can only be accessed by using RDP (such as VMs that are hosted on Azure). +- Out of Box Experience (OOBE) enrollment isn't supported on non-persistent VMs that can only be accessed by using RDP (such as VMs that are hosted on Azure). This restriction means: - - Windows Autopilot and Commercial OOBE aren't supported. +- Windows Autopilot and Commercial OOBE aren't supported. - Enrollment Status Page isn't supported. ## Configuration diff --git a/memdocs/intune/fundamentals/windows-holographic-for-business.md b/memdocs/intune/fundamentals/windows-holographic-for-business.md index e715d71f882..65aea3b98de 100644 --- a/memdocs/intune/fundamentals/windows-holographic-for-business.md +++ b/memdocs/intune/fundamentals/windows-holographic-for-business.md @@ -6,7 +6,7 @@ keywords: author: MandiOhlinger ms.author: mandia manager: dougeby -ms.date: 10/17/2023 +ms.date: 08/19/2024 ms.topic: conceptual ms.service: microsoft-intune ms.subservice: fundamentals @@ -28,29 +28,31 @@ ms.collection: # Manage and use different device management features on Windows Holographic and HoloLens devices with Intune -Microsoft Intune includes many features to help manage devices that run Windows Holographic for Business, such as the [Microsoft HoloLens](/hololens/). Using Intune, you can confirm that devices are compliant with your organization's rules, and you can customize the device by adding a VPN or WiFi profile. Another key feature is to use the device as a Kiosk, and run a specific app, or a specific set of apps. +Microsoft Intune includes many features to help manage devices that run Windows Holographic for Business, like the [Microsoft HoloLens](/hololens/). Using Intune, you can confirm that devices are compliant with your organization's rules, and you can customize the device by adding a VPN or WiFi profile. Another key feature is to use the device as a Kiosk, and run a specific app, or a specific set of apps. The tasks in this article help you manage, customize, and secure your devices running Windows Holographic for Business, including software updates and using Windows Hello for Business. To use Windows Holographic devices with Intune, create an [Edition Upgrade](../configuration/edition-upgrade-configure-windows-10.md) profile. This upgrade profile upgrades the devices from Windows Holographic to Windows Holographic for Business. For the Microsoft HoloLens, you can buy the Commercial Suite to get the required license for the upgrade. For more information, go to [Upgrade devices running Windows Holographic to Windows Holographic for Business](../configuration/holographic-upgrade.md). +This article describes the different features and services you can use to manage devices running Windows Holographic for Business. + ## Microsoft Entra ID -Microsoft Entra ID is a great resource to help manage and control your devices running Windows Holographic for Business. Using Intune and Microsoft Entra ID, you can: +Microsoft Entra ID helps manage and control your devices running Windows Holographic for Business. When you use Intune and Microsoft Entra ID, you can: -- **[Join devices to Microsoft Entra ID](/azure/active-directory/devices/azureadjoin-plan)**: In Microsoft Entra ID, you can add your work-owned Windows 10/11 devices, including devices running Windows Holographic for Business. This feature allows Microsoft Entra ID to control the device. It helps confirm that users are accessing the company resources from devices that meet your security and compliance standards. +- **[Join devices to Microsoft Entra ID](/entra/identity/devices/device-join-plan)**: In Microsoft Entra ID, you can add your work-owned Windows 10/11 devices, including devices running Windows Holographic for Business. This feature allows Microsoft Entra ID to control the device. It helps confirm that users are accessing the company resources from devices that meet your security and compliance standards. - [Device management in Microsoft Entra ID](/azure/active-directory/devices/overview) provides more details. + For information, go to [Device identity in Microsoft Entra ID](/entra/identity/devices/overview). - **[Bulk enrollment for Windows devices](../enrollment/windows-bulk-enroll.md)**: You can join large numbers of new Windows devices to Microsoft Entra ID and Intune. This feature is called bulk enrollment, and uses provisioning packages. These packages join the devices running Windows Holographic for Business to your Microsoft Entra tenant, and enrolls them in Intune. ## Company Portal app -**[Configure the Company Portal app](../apps/company-portal-app.md)** +**[Configure the Company Portal app](../apps/company-portal-app.md)**. Intune provides the Company Portal app for users to access company data, enroll devices, install apps, contact their IT department, and more. You can customize the Company Portal app for your devices running Windows Holographic for Business. -Using the Company Portal app, you can also run the following actions: +In the Company Portal app, end users can run the following actions: - [Remove a device from Intune](../user-help/unenroll-your-device-from-intune-windows.md) using the Settings app or the Company Portal app - [Rename a device](../user-help/rename-your-device-cpapp.md) @@ -59,30 +61,29 @@ Using the Company Portal app, you can also run the following actions: ## Compliance policy -**[Create a device compliance policy](../protect/compliance-policy-create-windows.md)** +**[Create a device compliance policy](../protect/compliance-policy-create-windows.md)**. -Compliance policies are rules and settings that devices must meet to be compliant. Use these policies with Conditional Access to block access to company resources for devices that are not-compliant. In Intune, create compliance policies to allow or block access for devices running Windows Holographic for Business. For example, you can create a policy that requires BitLocker be enabled. +Compliance policies are rules and settings that devices must meet to be compliant. Use these policies with Conditional Access to block access to company resources for devices that are noncompliant. In Intune, create compliance policies to allow or block access for devices running Windows Holographic for Business. For example, you can create a policy that requires BitLocker. -See also **[Get started with compliance policies](../protect/device-compliance-get-started.md)**. +For more information, go to **[Get started with compliance policies](../protect/device-compliance-get-started.md)**. ## Deploy and manage apps -**[Add apps to Intune](../apps/apps-add.md)** +**[Add apps to Intune](../apps/apps-add.md)**. Using Intune, you can add apps to your devices running Windows Holographic for Business. There are many ways to deploy apps, including: - [Add Microsoft Store apps](../apps/store-apps-windows.md) -- [Add apps you create](../apps/lob-apps-windows.md) +- [Add line-of-business (LOB) you create](../apps/lob-apps-windows.md) - [Assign apps to groups](../apps/apps-deploy.md) -Microsoft Intune can deploy Universal Windows Apps (UWP) to Microsoft HoloLens devices running Windows Holographic for Business. You can directly upload your app packages in the Intune admin center, or deploy them from the Microsoft Store for Business. For more information about related areas, go to the following articles: +Microsoft Intune can deploy Universal Windows Apps (UWP) to Microsoft HoloLens devices running Windows Holographic for Business. You can directly upload and deploy your app packages using the Intune admin center. For more information, go to: - To deploy Line-of-Business (LOB) apps using the Intune admin center, go to [How to add Windows line-of-business apps to Microsoft Intune](../apps/lob-apps-windows.md). > [!NOTE] > Intune allows a maximum package size to 8 GB. This package size is only available for the LOB apps uploaded to Intune. -- To deploy apps using the Microsoft Store for Business, go to [How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune](../apps/windows-store-for-business.md). - To learn about app management with Microsoft Intune, go to [What is app management in Microsoft Intune](../apps/app-management.md). - To learn more about developing apps for Microsoft HoloLens, go to [Mixed reality apps for Microsoft HoloLens](https://www.microsoft.com/hololens/apps). @@ -99,41 +100,41 @@ When you manage devices running Windows Holographic for Business, the following - **[Retire](../remote-actions/devices-wipe.md#retire)**: The **Retire** action removes the device from Intune. It also removes managed app data, settings, and email profiles assigned by Intune. The user's personal data stays on the device. -- **[Sync devices to get the latest policies and actions](../remote-actions/device-sync.md)**: The **Sync** action forces the device to immediately check in with Intune. When a device checks in, the device immediately receives any pending actions or policies that are assigned. This feature helps you validate and troubleshoot policies you've assigned, without waiting for the next scheduled check-in. +- **[Sync devices to get the latest policies and actions](../remote-actions/device-sync.md)**: The **Sync** action forces the device to immediately check in with Intune. When a device checks in, the device receives any pending actions or policies that are assigned. This feature helps you validate and troubleshoot policies you assigned, without waiting for the next scheduled check-in. -**[What is Microsoft Intune device management?](../remote-actions/device-management.md)** is a good resource to learn about managing devices using the Intune admin center. +For information about managing devices using the Intune admin center, go to [What is Microsoft Intune device management?](../remote-actions/device-management.md). ## Device categories and groups -**[Categorize devices into groups](../enrollment/device-group-mapping.md)** +**[Categorize devices into groups](../enrollment/device-group-mapping.md)**. -Using Intune, you can create device categories to automatically add devices to groups based on categories that you create, such as Sales, Accounting, Human Resources, and so on. The idea is to make it easier to manage your devices running Windows Holographic for Business. +Using Intune, you can create device categories to automatically add devices to groups based on categories that you create, like Sales, Accounting, and Human Resources. The idea is to make it easier to manage your devices running Windows Holographic for Business. ## Device configuration profiles -**[Get started with configuration profiles](../configuration/device-profiles.md), and [profile overview](../configuration/device-profile-create.md)** +**[Get started with configuration profiles](../configuration/device-profiles.md) and [profile overview](../configuration/device-profile-create.md)**. -Intune includes settings and features that you can enable or disable on different devices within your organization. These settings and features are managed using profiles. For example, you can create a profile uses Microsoft Defender Smart Screen on your devices running Windows Holographic for Business. +Intune includes settings and features that you can enable or disable on different devices within your organization. These settings and features are managed using configuration profiles. For example, you can create a profile that uses Microsoft Defender Smart Screen on your devices running Windows Holographic for Business. In your profiles, you can use OMA-URI to customize some settings, create device restrictions, and configure a virtual private network (VPN) and Wi-Fi. ### [Custom device settings](../configuration/custom-settings-windows-holographic.md) -To configure OMA-URI (Open Mobile Alliance Uniform Resource Identifier) settings, you can create a custom profile in Intune. Use the OMA-URI settings to control different features on your Windows Holographic for Business devices, such as enabling VPN, or checking for updates on Microsoft Update. +To configure OMA-URI (Open Mobile Alliance Uniform Resource Identifier) settings, you can create a custom profile in Intune. Use the OMA-URI settings to control different features on your Windows Holographic for Business devices. Typically, custom profiles are used to configure settings that aren't built-in to Intune. -See a [HoloLens 2 devices example](../configuration/custom-profile-hololens.md) that uses the [Windows Defender Application Control (WDAC) CSP](/windows/client-management/mdm/applicationcontrol-csp) to allow or block apps from opening on HoloLens 2 devices. +The [HoloLens 2 devices example](../configuration/custom-profile-hololens.md) uses the [Windows Defender Application Control (WDAC) CSP](/windows/client-management/mdm/applicationcontrol-csp) to allow or block apps from opening on HoloLens 2 devices. ### [Configure kiosk mode](../configuration/kiosk-settings-holographic.md) -Using the shared or guest PC features available in Intune, you can configure Windows Holographic for Business devices to run as a kiosk. These devices can run one app (single-app kiosk mode), or run multiple apps (multi-app kiosk mode). +Using the shared or guest PC features available in Intune, you can configure Windows Holographic for Business devices to run as a kiosk. These devices can run one app (single-app kiosk mode), or run many apps (multi-app kiosk mode). ### [Device restrictions](../configuration/device-restrictions-windows-holographic.md) -Device restrictions let you control different settings and features on your devices. For example, you can require a password, install apps from [Microsoft Store](https://www.microsoft.com/store/apps/windows?icid=CNavAppsWindowsApps), enable Bluetooth, and more. These restrictions are created in an Intune profile. This profile can be applied to multiple devices running Windows Holographic for Business. +Device restrictions let you control different settings and features on your devices. For example, you can require a password, install apps from [Microsoft Store](https://www.microsoft.com/store/apps/windows?icid=CNavAppsWindowsApps), and enable Bluetooth. These restrictions are created in an Intune configuration profile. This profile can be applied to multiple devices running Windows Holographic for Business. ### [Configure VPN](../configuration/vpn-settings-configure.md) -Virtual private networks (VPNs) give your users secure remote access to your company network. In Intune, you can create a VPN profile that includes specific settings for your devices running Windows Holographic for Business. For example, you can create a VPN profile so all Windows Holographic for Business devices use Citrix VPN as the connection type. +Virtual private networks (VPNs) give your users secure remote access to your organization network. In Intune, you can create a VPN profile that includes specific settings for your devices running Windows Holographic for Business. For example, you can create a VPN profile so all Windows Holographic for Business devices use Citrix VPN as the connection type. > [!NOTE] > When assigning a VPN policy to Windows Holographic for Business devices, assign the profile to the device scope. Currently, Windows Holographic only supports the device scope. When the VPN profile is installed in the device context, it applies to all users on the device. If a user profile is deployed, it's treated as a device profile. @@ -144,28 +145,28 @@ You can also create a Wi-Fi profile in Intune to assign wireless network setting ## Shared multi-user devices -[Shared devices](../configuration/shared-user-device-settings-windows-holographic.md) +Devices that run Windows Holographic for Business, like the Microsoft HoloLens, can have multiple users. Intune includes settings to control different features on these shared devices, like power management, using the local storage, and account management. The configuration profiles can also be applied to devices with different operating systems. -Devices that run Windows Holographic for Business, such as the Microsoft HoloLens, can have multiple users. Intune includes settings to control different features on these shared devices, such as power management, using the local storage, and account management. The configuration profiles can also be applied to devices with different operating systems. +For more information, go to [Shared devices](../configuration/shared-user-device-settings-windows-holographic.md). ## Software updates -**[Manage software updates](../protect/windows-update-for-business-configure.md)** +**[Manage software updates](../protect/windows-update-for-business-configure.md)**. -Intune includes a feature called update rings for Windows client devices. These update rings include a group of settings that determine how updates are installed. For example, you can create a maintenance window to install updates, or choose to restart after updates are installed. An update ring can be applied to multiple devices running Windows Holographic for Business. +Intune has different feature that focus on updating Windows client devices. These options include that determine how updates are installed. For example, you can create a maintenance window to install updates, or choose to restart after updates are installed. Updates can be applied to multiple devices running Windows Holographic for Business. ## Terms and conditions -**[Set your company's terms and conditions for user access](../enrollment/terms-and-conditions-create.md)** +**[Set your company's terms and conditions for user access](../enrollment/terms-and-conditions-create.md)**. Before users enroll devices and access your company apps, including email, you can require that users accept your company's terms and conditions. In Intune, define how the terms and conditions are shown in the Company Portal app, and also assign these terms and conditions to devices running Windows Holographic for Business. ## Windows Hello for Business -**[Use Windows Hello for Business](../protect/windows-hello.md)** +**[Use Windows Hello for Business](../protect/windows-hello.md)**. Hello for Business is an alternative sign-in method that uses a Microsoft Entra account to replace a password, smart card, or a virtual smart card. With Hello for Business, your Windows Holographic for Business devices can sign in with a PIN with a minimum length set by you. -## Next steps +## Related content [Set up Intune](deployment-plan-setup.md). diff --git a/memdocs/intune/includes/android-device-administrator-support.md b/memdocs/intune/includes/android-device-administrator-support.md index 8a9ae2157a7..6338e8f11ff 100644 --- a/memdocs/intune/includes/android-device-administrator-support.md +++ b/memdocs/intune/includes/android-device-administrator-support.md @@ -14,4 +14,3 @@ ms.collection: > [!IMPORTANT] > Microsoft Intune is ending support for Android device administrator management on devices with access to Google Mobile Services (GMS) on December 31, 2024. After that date, device enrollment, technical support, bug fixes, and security fixes will be unavailable. If you currently use device administrator management, we recommend switching to another Android management option in Intune before support ends. For more information, see [Ending support for Android device administrator on GMS devices](https://techcommunity.microsoft.com/t5/intune-customer-success/microsoft-intune-ending-support-for-android-device-administrator/ba-p/3915443). - diff --git a/memdocs/intune/includes/app-protection-framework-level1.md b/memdocs/intune/includes/app-protection-framework-level1.md index fbb834b6b77..c45f6c059cf 100644 --- a/memdocs/intune/includes/app-protection-framework-level1.md +++ b/memdocs/intune/includes/app-protection-framework-level1.md @@ -59,7 +59,7 @@ The policies in level 1 enforce a reasonable data access level while minimizing | Setting | Setting description | Value / Action | Platform | Notes | |--------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------|---------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | App conditions | Max PIN attempts | 5 / Reset PIN | iOS/iPadOS, Android | | -| App conditions | Offline grace period | 1440 / Block access (minutes) | iOS/iPadOS, Android, Windows | | +| App conditions | Offline grace period | 10080 / Block access (minutes) | iOS/iPadOS, Android, Windows | | | App conditions | Offline grace period | 90 / Wipe data (days) | iOS/iPadOS, Android, Windows | | | Device conditions | Jailbroken/rooted devices | N/A / Block access | iOS/iPadOS, Android | | | Device conditions | SafetyNet device attestation | Basic integrity and certified devices / Block access | Android |

This setting configures Google Play’s device integrity check on end-user devices. Basic integrity validates the integrity of the device. Rooted devices, emulators, virtual devices, and devices with signs of tampering fail basic integrity.

Basic integrity and certified devices validates the compatibility of the device with Google's services. Only unmodified devices that have been certified by Google can pass this check.

| diff --git a/memdocs/intune/includes/app-protection-framework-level2.md b/memdocs/intune/includes/app-protection-framework-level2.md index 85bf9eb0df5..4bf218ae1d3 100644 --- a/memdocs/intune/includes/app-protection-framework-level2.md +++ b/memdocs/intune/includes/app-protection-framework-level2.md @@ -45,7 +45,7 @@ Level 2 is the data protection configuration recommended as a standard for devic | Device conditions | Required SafetyNet evaluation type | Hardware-backed key | Android | Hardware backed attestation enhances the existing Google's Play Integrity service check by applying a new evaluation type called [Hardware Backed](https://developer.android.com/training/safetynet/attestation#evaluation-types), providing a more robust root detection in response to newer types of rooting tools and methods that can't always be reliably detected by a software only solution.

As its name implies, hardware backed attestation uses a hardware-based component, which shipped with devices installed with Android 8.1 and later. Devices that were upgraded from an older version of Android to Android 8.1 are unlikely to have the hardware-based components necessary for hardware backed attestation. While this setting should be widely supported starting with devices that shipped with Android 8.1, Microsoft strongly recommends testing devices individually before enabling this policy setting broadly.

| | Device conditions | Require device lock | Medium/Block Access | Android | This setting ensures that Android devices have a device password that meets the minimum password requirements. | | Device conditions | Samsung Knox device attestation | Block Access | Android | Microsoft recommends configuring the **Samsung Knox device attestation** setting to **Block access** to ensure the user account is blocked from access if the device doesn't meet Samsung's Knox hardware-based verification of device health. This setting verifies all Intune MAM client responses to the Intune service were sent from a healthy device.

This setting applies to all devices targeted. To apply this setting only to Samsung devices, you can use "Managed apps" assignment filters. For more information on assignment filters, see [Use filters when assigning your apps, policies, and profiles in Microsoft Intune](/mem/intune/fundamentals/filters).| -| App conditions | Offline grace period | 21 / Wipe data (days) | Windows | | +| App conditions | Offline grace period | 30 / Wipe data (days) | iOS/iPadOS, Android, Windows | | > [!NOTE] -> Windows conditional launch settings are labeled as **Health Checks**. \ No newline at end of file +> Windows conditional launch settings are labeled as **Health Checks**. diff --git a/memdocs/intune/includes/app-protection-framework-level3.md b/memdocs/intune/includes/app-protection-framework-level3.md index b4d565cb69a..ed0dc76c4bb 100644 --- a/memdocs/intune/includes/app-protection-framework-level3.md +++ b/memdocs/intune/includes/app-protection-framework-level3.md @@ -53,4 +53,5 @@ Level 3 is the data protection configuration recommended as a standard for organ | Device conditions | Max OS version | *Format: Major.Minor.Build
Example: 15.0* / Block access | iOS/iPadOS | Microsoft recommends configuring the maximum iOS/iPadOS major version to ensure beta or unsupported versions of the operating system aren't used. See [Apple security updates](https://support.apple.com/en-us/HT201222) for Apple's latest recommendations | | Device conditions | Max OS version | *Format: Major.Minor
Example: 22631.* / Block access | Windows | Microsoft recommends configuring the maximum Windows major version to ensure beta or unsupported versions of the operating system aren't used. | | Device conditions | Samsung Knox device attestation | Wipe data | Android | Microsoft recommends configuring the **Samsung Knox device attestation** setting to **Wipe data** to ensure the org data is removed if the device doesn't meet Samsung's Knox hardware-based verification of device health. This setting verifies all Intune MAM client responses to the Intune service were sent from a healthy device.

This setting will apply to all devices targeted. To apply this setting only to Samsung devices, you can use "Managed apps" assignment filters. For more information on assignment filters, see [Use filters when assigning your apps, policies, and profiles in Microsoft Intune](/mem/intune/fundamentals/filters).| +| App conditions | Offline grace period | 30 / Block access (days) | iOS/iPadOS, Android, Windows | | diff --git a/memdocs/intune/includes/intune-notices.md b/memdocs/intune/includes/intune-notices.md index fca6cb783f9..8623c80e37b 100644 --- a/memdocs/intune/includes/intune-notices.md +++ b/memdocs/intune/includes/intune-notices.md @@ -12,6 +12,25 @@ ms.custom: include file These notices provide important information that can help you prepare for future Intune changes and features. +### Take Action: Enable multifactor authentication for your tenant before October 15, 2024 + +Starting on or after October 15, 2024, to further increase security, Microsoft will require admins to use multi-factor authentication (MFA) when signing into the Microsoft Azure portal, Microsoft Entra admin center, and Microsoft Intune admin center. To take advantage of the extra layer of protection MFA offers, we recommend enabling MFA as soon as possible. To learn more, review [Planning for mandatory multifactor authentication for Azure and admin portals](https://aka.ms/mfaforazure). + +> [!NOTE] +> This requirement also applies to any services accessed through the Intune admin center, such as Windows 365 Cloud PC. + +#### How does this affect you or your users? + +MFA must be enabled for your tenant to ensure admins are able to sign-in to the Azure portal, Microsoft Entra admin center and Intune admin center after this change. + +#### How can you prepare? + +- If you haven't already, [set up MFA](https://aka.ms/mfaforazure) before **October 15, 2024**, to ensure your admins can access the Azure portal, Microsoft Entra admin center, and Intune admin center. +- If you're unable to set up MFA before this date, you can [apply to postpone the enforcement date](https://aka.ms/managemfaforazure). +- If MFA hasn't been set up before the enforcement starts, admins will be prompted to register for MFA before they can access the Azure portal, Microsoft Entra admin center, or Intune admin center on their next sign-in. + +For more information, refer to: [Planning for mandatory multifactor authentication for Azure and admin portals](https://aka.ms/mfaforazure). + ### Plan for Change: Intune is moving to support iOS/iPadOS 16 and later Later this year, we expect iOS 18 and iPadOS 18 to be released by Apple. Microsoft Intune, including the Intune Company Portal and Intune app protection policies (APP, also known as MAM), will require [iOS 16/iPadOS 16 and higher](../fundamentals/supported-devices-browsers.md) shortly after the iOS/iPadOS 18 release. diff --git a/memdocs/intune/includes/mdm-supported-devices.md b/memdocs/intune/includes/mdm-supported-devices.md index 9e124761d4a..fe1ef1480ca 100644 --- a/memdocs/intune/includes/mdm-supported-devices.md +++ b/memdocs/intune/includes/mdm-supported-devices.md @@ -4,7 +4,7 @@ ms.author: erikje ms.service: microsoft-intune ms.subservice: fundamentals ms.topic: include -ms.date: 04/24/2024 +ms.date: 09/06/2024 ms.localizationpriority: high --- @@ -12,19 +12,19 @@ ms.localizationpriority: high - **User assigned devices** - devices enrolled with user affinity using Automated Device Enrollment or personally enrolled devices. - iOS/iPadOS 15.x and later - - macOS 12.0 and later + - macOS 13.0 and later - **User-less devices** - devices enrolled without user affinity using Automated Device Enrollment or Apple Configurator. - Supported: - - iOS/iPadOS 15.x and later - - macOS 12.0 and later + - iOS/iPadOS 16.x and later + - macOS 13.0 and later - Allowed to enroll: - - iOS/iPadOS 12.x and later + - iOS/iPadOS 13.x and later - macOS 10.14 and later > [!NOTE] > **Supported** versions include devices running the three most recent operating system versions. These devices can enroll and take advantage of all Intune functionality that is applicable, and all new eligible features will work on these devices. > -> **Allowed** versions includes devices running a non-supported version (within three versions of the supported versions). These devices can enroll and take advantage of Intune's eligible features but there is no guarantee that they will work as expected. +> **Allowed** versions includes devices running a non-supported version (within three versions of the supported versions). These devices can enroll and take advantage of Intune's eligible features but there is no guarantee that they will work as expected. > > Intune requires iOS 15.x or later for app protection policies and app configuration. diff --git a/memdocs/intune/includes/reports-credential-reqs.md b/memdocs/intune/includes/reports-credential-reqs.md index 2800a2eed5f..f646e8e3072 100644 --- a/memdocs/intune/includes/reports-credential-reqs.md +++ b/memdocs/intune/includes/reports-credential-reqs.md @@ -8,8 +8,7 @@ Authentication and authorization are based on Microsoft Entra credentials and In Requirements for accessing the Intune Data Warehouse (including the API) are: -- User must be one of: - - Microsoft Entra Global Administrator +- User must have a minimum of one of the following roles: - An Intune service administrator - User with role-based access to **Intune data warehouse** resource - User-less authentication using [application-only authentication](../developer/data-warehouse-app-only-auth.md) diff --git a/memdocs/intune/includes/tenant-attach-antivirus-prerequisites.md b/memdocs/intune/includes/tenant-attach-antivirus-prerequisites.md index e5b2a298be0..9d33aafa36f 100644 --- a/memdocs/intune/includes/tenant-attach-antivirus-prerequisites.md +++ b/memdocs/intune/includes/tenant-attach-antivirus-prerequisites.md @@ -4,7 +4,7 @@ description: include file author: brenduns ms.service: microsoft-intune ms.topic: include -ms.date: 04/08/2022 +ms.date: 08/19/2024 ms.author: brenduns ms.custom: include file --- @@ -15,7 +15,7 @@ Manage [Antivirus settings for Configuration Manager devices](../protect/antivir **Policy path**: -- Endpoint security > Antivirus > Windows 10, Windows 11, and Windows Server (ConfigMgr) +- Endpoint security > Antivirus > Windows (ConfigMgr) **Profiles**: diff --git a/memdocs/intune/includes/tenant-attach-asr-prerequisites.md b/memdocs/intune/includes/tenant-attach-asr-prerequisites.md index 3654a123006..5b5e943db0b 100644 --- a/memdocs/intune/includes/tenant-attach-asr-prerequisites.md +++ b/memdocs/intune/includes/tenant-attach-asr-prerequisites.md @@ -4,7 +4,7 @@ description: Include file author: brenduns ms.service: microsoft-intune ms.topic: include -ms.date: 04/08/2024 +ms.date: 08/19/2024 ms.author: brenduns ms.custom: include file --- @@ -17,7 +17,7 @@ Manage [attack surface reduction settings for Configuration Manager devices](../ **Policy path**: -- Endpoint security > Attach surface reduction > Windows 10 and later (ConfigMgr) +- Endpoint security > Attach surface reduction > Windows (ConfigMgr) **Profiles**: @@ -26,7 +26,6 @@ Manage [attack surface reduction settings for Configuration Manager devices](../ - Exploit Protection(ConfigMgr)(preview) - Web Protection (ConfigMgr)(preview) - **Required version of Configuration Manager**: - Configuration Manager current branch version 2006 or later diff --git a/memdocs/intune/includes/tenant-attach-edr-prerequisites.md b/memdocs/intune/includes/tenant-attach-edr-prerequisites.md index 79e36497fba..c413d8108cd 100644 --- a/memdocs/intune/includes/tenant-attach-edr-prerequisites.md +++ b/memdocs/intune/includes/tenant-attach-edr-prerequisites.md @@ -4,16 +4,16 @@ description: include file author: brenduns ms.service: microsoft-intune ms.topic: include -ms.date: 05/29/2024 +ms.date: 08/19/2024 ms.author: brenduns ms.custom: include file --- #### Endpoint detection and response -To manage Endpoint detection and response policy settings for Configuration Manager devices when you use tenant attach. +To manage Endpoint detection and response policy settings for Configuration Manager devices when you use tenant attach. -**Platform**: *Windows 10, Windows 11, and Windows Server (ConfigMgr)* +**Platform**: *Windows (ConfigMgr)* **Profile**: *Endpoint detection and response (ConfigMgr)* diff --git a/memdocs/intune/includes/tenant-attach-firewall-prerequisites.md b/memdocs/intune/includes/tenant-attach-firewall-prerequisites.md index fbc65ad53b8..d467815f96d 100644 --- a/memdocs/intune/includes/tenant-attach-firewall-prerequisites.md +++ b/memdocs/intune/includes/tenant-attach-firewall-prerequisites.md @@ -4,7 +4,7 @@ description: include file author: brenduns ms.service: microsoft-intune ms.topic: include -ms.date: 11/14/2023 +ms.date: 08/19/2024 ms.author: brenduns ms.custom: include file --- @@ -17,7 +17,7 @@ Manage [Firewall policy settings for Configuration Manager devices](../protect/e **Policy path**: -- Endpoint security > Firewall > Windows 10 and later +- Endpoint security > Firewall **Profiles**: diff --git a/memdocs/intune/industry/education/tutorial-school-deployment/images/dfci-profile-expanded.png b/memdocs/intune/industry/education/tutorial-school-deployment/images/dfci-profile-expanded.png deleted file mode 100644 index 3386f7673a3..00000000000 Binary files a/memdocs/intune/industry/education/tutorial-school-deployment/images/dfci-profile-expanded.png and /dev/null differ diff --git a/memdocs/intune/industry/education/tutorial-school-deployment/images/enroll-ppkg.png b/memdocs/intune/industry/education/tutorial-school-deployment/images/enroll-ppkg.png deleted file mode 100644 index 58d20dc3483..00000000000 Binary files a/memdocs/intune/industry/education/tutorial-school-deployment/images/enroll-ppkg.png and /dev/null differ diff --git a/memdocs/intune/industry/education/tutorial-school-deployment/images/intune-education-groups.png b/memdocs/intune/industry/education/tutorial-school-deployment/images/intune-education-groups.png deleted file mode 100644 index 87f4546e88b..00000000000 Binary files a/memdocs/intune/industry/education/tutorial-school-deployment/images/intune-education-groups.png and /dev/null differ diff --git a/memdocs/intune/media/icons/i-article.png b/memdocs/intune/media/icons/i-article.png deleted file mode 100644 index 5ebf820b048..00000000000 Binary files a/memdocs/intune/media/icons/i-article.png and /dev/null differ diff --git a/memdocs/intune/protect/advanced-threat-protection-configure.md b/memdocs/intune/protect/advanced-threat-protection-configure.md index 43d387ca76d..1b5618f4fb0 100644 --- a/memdocs/intune/protect/advanced-threat-protection-configure.md +++ b/memdocs/intune/protect/advanced-threat-protection-configure.md @@ -39,7 +39,7 @@ Use the information and procedures in this article to configure integration of M - **Use Intune policy to onboard devices with Microsoft Defender for Endpoint**. You onboard devices to configure them to communicate with Microsoft Defender for Endpoint and to provide data that helps assess their risk level. - **Use Intune device compliance policies to set the level of risk you want to allow**. Microsoft Defender for Endpoint reports a devices risk level. Devices that exceed the allowed risk level are identified as noncompliant. - **Use a conditional access policy** to block users from accessing corporate resources from devices that are noncompliant. -- **Use** [**app protection policies**](../protect/mtd-app-protection-policy.md) for Android and iOS/iPadOS, to set device risk levels. App protection polices work with both enrolled and unenrolled devices. +- **Use** [**app protection policies**](../protect/mtd-app-protection-policy.md) for Android and iOS/iPadOS, to set device risk levels. App protection policies work with both enrolled and unenrolled devices. In addition to managing settings for Microsoft Defender for Endpoint on devices that enroll with Intune, you can manage Defender for Endpoint security configurations on devices that aren’t enrolled with Intune. This scenario is called *Security Management for Microsoft Defender for Endpoint* and requires configuring the *Allow Microsoft Defender for Endpoint to enforce Endpoint Security Configurations* toggle to *On*. For more information, see [MDE Security Configuration Management](../protect/mde-security-integration.md). diff --git a/memdocs/intune/protect/advanced-threat-protection-manage-android.md b/memdocs/intune/protect/advanced-threat-protection-manage-android.md index a42e045d19d..16b89cd4a5a 100644 --- a/memdocs/intune/protect/advanced-threat-protection-manage-android.md +++ b/memdocs/intune/protect/advanced-threat-protection-manage-android.md @@ -1,13 +1,13 @@ --- # required metadata -title: Configure Defender for Endpoint Web protection on Android devices in Intune - Azure -description: Use Intune policy to manage Microsoft Defender for Endpoint web protection settings on Android devices managed by Microsoft Intune. +title: Configure Defender for Endpoint Web protection on Android devices in Microsoft Intune +description: Use Intune policy to manage Microsoft Defender for Endpoint web protection settings on Android devices managed by Microsoft Intune. keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 10/09/2023 +ms.date: 08/22/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -32,13 +32,13 @@ ms.collection: When you integrate [Microsoft Defender for Endpoint](../protect/advanced-threat-protection-configure.md) with Microsoft Intune, you can use device configuration profiles to modify some Defender for Endpoint settings on Android devices. -By default, Microsoft Defender for Endpoint for Android includes and enables the [Web protection](/windows/security/threat-protection/microsoft-defender-atp/web-protection-overview) feature that can help to secure devices against web threats and protect users from phishing attacks. +By default, Microsoft Defender for Endpoint for Android includes and enables the Microsoft Defender for Endpoint [Web protection](/windows/security/threat-protection/microsoft-defender-atp/web-protection-overview) feature that can help to secure devices against web threats and protect users from phishing attacks. -While this protection is enabled by default, there are valid reasons to disable it on some Android devices. For example, you might decide to use only the Defender for Endpoint app scan feature or to prevent web protection from using your VPN while it scans for harmful URLs. +While enabled by default, there are valid reasons to disable it on some Android devices. For example, you might decide to use only the Defender for Endpoint app scan feature or to prevent web protection from using your VPN while it scans for harmful URLs. With Intune device configuration policy, you can turn off all or part of the web protection feature. The method you use and the capabilities you can disable depend on how the Android device is enrolled with Intune: -- **Android device administrator**. Use a configuration profile to set custom OMA-URI settings on the device that disable the entire web protection feature or that disable only the use of VPNs. For general information about custom settings for Android devices, see [Custom settings](../configuration/custom-settings-android.md). +- **Android device administrator**. Use a configuration profile to set custom OMA-URI settings on the device that disable the entire web protection feature or that disable only the use of VPNs. For general information about custom settings for Android devices, see [Use custom settings for Android devices in Microsoft Intune](../configuration/custom-settings-android.md). - **Android Enterprise personally owned work profile**. Use an app configuration profile and the configuration designer to disable web protection. This method and enrollment type support disabling all web protection capabilities but don't support disabling only the use of VPNs. For general information about app configuration policies, see [Use the configuration designer](../apps/app-configuration-policies-use-android.md#use-the-configuration-designer). @@ -80,13 +80,13 @@ To configure web protection on devices, use the following procedures to create a - **Disable only the use of VPN by web protection**: - **Name**: Enter a unique name for this OMA-URI setting so you can find it easily. For example, **Disable Microsoft Defender for Endpoint web protection VPN**. - **Description**: (Optional) Enter a description that provides an overview of the setting and any other important details. - - **OMA-URI**: Enter `./Vendor/MSFT/DefenderATP/Vpn` + - **OMA-URI**: Enter `./Vendor/MSFT/DefenderATP/Vpn` - **Data type**: Select **Integer** in the drop-down list. - **Value**: To disable the VPN-based scan, set *Value* to **0**. To enable the VPN-based scan, enter **1**, which is the default. Select **Add** to save the OMA-URI settings configuration, and then select **Next** to continue. -6. In **Assignments**, specify the groups that will receive the profile. For more information on assigning profiles, see [Assign user and device profiles](../configuration/device-profile-assign.md). +6. In **Assignments**, specify the groups that receive the profile. For more information on assigning profiles, see [Assign user and device profiles](../configuration/device-profile-assign.md). 7. In **Review + create**, when you're done, select **Create**. The new profile is displayed in the list when you select the policy type for the profile you created. @@ -126,7 +126,7 @@ To configure web protection on devices, use the following procedures to create a Select **Next** to continue. -8. In **Assignments**, specify the groups that will receive the profile. For more information on assigning profiles, see [Assign user and device profiles](../configuration/device-profile-assign.md). +8. In **Assignments**, specify the groups that receive the profile. For more information on assigning profiles, see [Assign user and device profiles](../configuration/device-profile-assign.md). 9. In **Review + create**, when you're done, select **Create**. The new profile is displayed in the list when you select the policy type for the profile you created. @@ -149,14 +149,14 @@ To configure web protection on devices, use the following procedures to create a Select **Next** to continue. -2. In **Assignments**, specify the groups that will receive the profile. For more information on assigning profiles, see [Assign user and device profiles](../configuration/device-profile-assign.md). +2. In **Assignments**, specify the groups that receive the profile. For more information on assigning profiles, see [Assign user and device profiles](../configuration/device-profile-assign.md). 3. In **Review + create**, when you're done, select **Create**. The new profile is displayed in the list when you select the policy type for the profile you created. ## Next steps -- [Monitor compliance for risk levels](../protect/advanced-threat-protection-monitor.md) +- [Monitor device compliance status for risk levels](../protect/advanced-threat-protection-monitor.md) - [Use security tasks with Defender for Endpoints Vulnerability Management to remediate problems on devices](../protect/atp-manage-vulnerabilities.md) - Learn more from the Microsoft Defender for Endpoint documentation: diff --git a/memdocs/intune/protect/advanced-threat-protection.md b/memdocs/intune/protect/advanced-threat-protection.md index e1985409485..8b4d8a00323 100644 --- a/memdocs/intune/protect/advanced-threat-protection.md +++ b/memdocs/intune/protect/advanced-threat-protection.md @@ -75,7 +75,7 @@ For devices that run Android, you can use Intune policy to modify the configurat **Subscriptions**: To use Microsoft Defender for Endpoint with Intune, you must have the following subscriptions: -- **Microsoft Defender for Endpoint** - This subscription provides you access to the Microsoft Defender Security Center ([Microsoft Defender XDR](https://go.microsoft.com/fwlink/p/?linkid=2077139)). +- **Microsoft Defender for Endpoint** - This subscription provides you access to the Microsoft [Defender Security Center](https://go.microsoft.com/fwlink/p/?linkid=2077139). For Defender for Endpoint licensing options, see **Licensing requirements** in [Minimum requirements for Microsoft Defender for Endpoint](/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements) and [How to set up a Microsoft 365 E5 Trial Subscription](/microsoft-365/security/defender/setup-m365deval#enable-microsoft-365-trial-subscription). diff --git a/memdocs/intune/protect/blackberry-mtd-connector-integration.md b/memdocs/intune/protect/blackberry-mtd-connector-integration.md index 988ed764b0a..9879b182694 100644 --- a/memdocs/intune/protect/blackberry-mtd-connector-integration.md +++ b/memdocs/intune/protect/blackberry-mtd-connector-integration.md @@ -8,7 +8,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 11/17/2023 +ms.date: 08/27/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -81,10 +81,10 @@ For more information about consent and Microsoft Entra applications, see [Introd 8. Sign in with your Microsoft Entra account, and then follow the instructions in [Integrating UES with Intune to respond to mobile threats](https://docs.blackberry.com/en/unified-endpoint-security/blackberry-ues/setup/setup/Setting-up-BlackBerry-Protect/Integrating-EMM-to-respond-to-mobile-threats) (opens BlackBerry UES docs) to complete setup. 9. After you finish setup in the UES management console, return to your tab in the Microsoft Intune admin center. 10. Under **MDM Compliance Policy Settings**, turn on the following settings: - * **Connect Android devices to BlackBerry Protect Mobile** - * **Connect iOS devices to BlackBerry Protect Mobile** + - **Connect Android devices to BlackBerry Protect Mobile** + - **Connect iOS devices to BlackBerry Protect Mobile** These settings allow BlackBerry Protect Mobile to evaluate the devices in your organization. - 11. Select **Create** to save your connector configurations. +11. Select **Create** to save your connector configurations. ## Next steps diff --git a/memdocs/intune/protect/certificate-authority-add-scep-overview.md b/memdocs/intune/protect/certificate-authority-add-scep-overview.md index ed5a44f7659..0e3ba545384 100644 --- a/memdocs/intune/protect/certificate-authority-add-scep-overview.md +++ b/memdocs/intune/protect/certificate-authority-add-scep-overview.md @@ -133,7 +133,7 @@ As the administrator, create a SCEP certificate profile to target to users or de ## Removing certificates -When you unenroll or wipe the device, the certificates are removed. The certificates aren't revoked. +After you unenroll or wipe the device, the certificates are removed from the device by Intune and queued for revocations. Revocation on the certificate authority depends on API implementation by each third party. ## Third-party certification authority partners diff --git a/memdocs/intune/protect/checkpoint-sandblast-mobile-mobile-threat-defense-connector.md b/memdocs/intune/protect/checkpoint-sandblast-mobile-mobile-threat-defense-connector.md index 6ec9f1793c7..01fc7edc2a6 100644 --- a/memdocs/intune/protect/checkpoint-sandblast-mobile-mobile-threat-defense-connector.md +++ b/memdocs/intune/protect/checkpoint-sandblast-mobile-mobile-threat-defense-connector.md @@ -8,7 +8,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 11/17/2023 +ms.date: 08/22/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -49,12 +49,12 @@ You can configure Conditional Access policies based on Check Point Harmony Mobil - Microsoft Intune Plan 1 subscription -- Check Point Harmony Mobile Threat Defense subscription +- Check Point Harmony Mobile Threat Defense subscription - See the [CheckPoint Harmony website](https://www.checkpoint.com/harmony). ## How do Intune and Check Point Harmony Mobile help protect your company resources? -Check Point Harmony Mobile app for Android and iOS/iPadOS captures file system, network stack, device and application telemetry where available, then sends the telemetry data to the Check Point Harmony cloud service to assess the device's risk for mobile threats. +Check Point Harmony Mobile app for Android and iOS/iPadOS captures file system, network stack, and device and application telemetry where available, then sends the telemetry data to the Check Point Harmony cloud service to assess the device's risk for mobile threats. The Intune device compliance policy includes a rule for Check Point Harmony Mobile Threat Defense, which is based on the Check Point Harmony risk assessment. When this rule is enabled, Intune evaluates device compliance with the policy that you enabled. If the device is found noncompliant, users are blocked access to corporate resources like Exchange Online and SharePoint Online. Users also receive guidance from the Harmony Mobile Protect app installed in their devices to resolve the issue and regain access to corporate resources. diff --git a/memdocs/intune/protect/checkpoint-sandblast-mobile-mtd-connector-integration.md b/memdocs/intune/protect/checkpoint-sandblast-mobile-mtd-connector-integration.md index 0f13bb48e9e..916f69df091 100644 --- a/memdocs/intune/protect/checkpoint-sandblast-mobile-mtd-connector-integration.md +++ b/memdocs/intune/protect/checkpoint-sandblast-mobile-mtd-connector-integration.md @@ -1,14 +1,14 @@ --- # required metadata -title: Set up Check Point Harmony integration with Intune +title: Set up Check Point Harmony integration with Intune titleSuffix: Microsoft Intune description: How to set up CheckPoint Harmony Mobile Threat Defense (MTD) with Microsoft Intune to control mobile device access to your corporate resources. keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 11/17/2023 +ms.date: 08/27/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect diff --git a/memdocs/intune/protect/conditional-access-integrate-jamf.md b/memdocs/intune/protect/conditional-access-integrate-jamf.md index 6c64bf34fa8..788ab26e6a8 100644 --- a/memdocs/intune/protect/conditional-access-integrate-jamf.md +++ b/memdocs/intune/protect/conditional-access-integrate-jamf.md @@ -38,7 +38,7 @@ ms.collection: > > **Jamf macOS device support for Conditional Access is being deprecated**. > -> Beginning on September 1, 2024, the platform that Jamf Pro’s Conditional Access feature is built on will no longer be supported. +> Beginning on January 31, 2025, the platform that Jamf Pro’s Conditional Access feature is built on will no longer be supported. > > If you use Jamf Pro’s Conditional Access integration for macOS devices, follow Jamf’s documented guidelines to migrate your devices to Device Compliance integration at [***Migrating from macOS Conditional Access to macOS Device Compliance – Jamf Pro Documentation***](https://learn.jamf.com/bundle/jamf-pro-documentation-current/page/Conditional_Access.html#ariaid-title6). > diff --git a/memdocs/intune/protect/data-intune-sends-to-google.md b/memdocs/intune/protect/data-intune-sends-to-google.md index 7b18d18e3e0..3891bcf4399 100644 --- a/memdocs/intune/protect/data-intune-sends-to-google.md +++ b/memdocs/intune/protect/data-intune-sends-to-google.md @@ -50,5 +50,6 @@ The following table lists the data that Microsoft Intune sends to Google when de | Application Data | Originated in Intune when saving application policy. | | Application Name string. Example: app:com.microsoft.windowsintune.companyportal | | Enterprise Service Account | Originated in Google upon Intune request. | Used for authentication between Intune and Google for transactions involving this customer. | There are several parts:
**Enterprise Id**: documented previously.
**UPN**: generated UPN used in authentication on behalf of customer.
Example: w49d77900526190e26708c31c9e8a0@pfwp-commicrosoftonedfmdm2.google.com.iam.gserviceaccount.com
**Key**: Base64 encoded blob used in auth requests, stored encrypted in the service, but this is what the blob looks like:
Unique Identifier to represent the customer's key
Example: a70d4d53eefbd781ce7ad6a6495c65eb15e74f1f | | Registration Token | Originated in Google upon device enrollment. | Used to identify device when sending push notifications to the Company Portal app. | | +| User Principal Name (UPN) | Only the UPN of the user signed-in to the Intune console initiating the [process to connect Google and Intune](../enrollment/connect-intune-android-enterprise.md) is sent as a pre-filled hint. | Used to prefill the admin email address field of the Google enterprise signup form. | | To stop using Android enterprise device management with Microsoft Intune and delete the data, you must disable both Microsoft Intune Android enterprise device management and also delete your Google account. Refer to Google account how to perform account management. diff --git a/memdocs/intune/protect/derived-credentials.md b/memdocs/intune/protect/derived-credentials.md index 09774fae6e3..af288bed086 100644 --- a/memdocs/intune/protect/derived-credentials.md +++ b/memdocs/intune/protect/derived-credentials.md @@ -120,7 +120,7 @@ Depending on the issuer you choose, you might need staff to be available at the For example, you might use conditional access to block access to email for noncompliant devices. If you rely on email notifications to inform the user to start the derived credential enrollment process, your users might not receive those instructions until they're compliant with policy. -Similarly, some derived credential request workflows require the use of the device camera to scan an on-screen QR code. This code links that device to the authentication request that occurred against the derived credential issuer with the user's smart card credentials. If device configuration polices block camera use, the user can't complete the derived credential enrollment request. +Similarly, some derived credential request workflows require the use of the device camera to scan an on-screen QR code. This code links that device to the authentication request that occurred against the derived credential issuer with the user's smart card credentials. If device configuration policies block camera use, the user can't complete the derived credential enrollment request. **General information**: diff --git a/memdocs/intune/protect/device-protect.md b/memdocs/intune/protect/device-protect.md index 97b6e1672de..144fc42c2ce 100644 --- a/memdocs/intune/protect/device-protect.md +++ b/memdocs/intune/protect/device-protect.md @@ -8,7 +8,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 10/05/2023 +ms.date: 08/23/2024 ms.topic: overview ms.subservice: protect ms.service: microsoft-intune @@ -37,7 +37,7 @@ Microsoft Intune can help you keep your managed devices secure and up to date wh This article highlights many of Intune's built-in capabilities and partner technologies you can integrate with Intune. As you learn more about them, you can bring several together for more comprehensive solutions on your journey towards a zero-trust environment. -From the Microsoft Intune admin center, Intune [supports managed devices](../fundamentals/supported-devices-browsers.md#intune-supported-operating-systems) that run Android, iOS/iPad, Linux, macOS, and Windows 10 and Windows 11. +From the Microsoft Intune admin center, Intune [supports managed devices](../fundamentals/supported-devices-browsers.md#intune-supported-operating-systems) that run Android, iOS/iPad, Linux, macOS, and Windows. When you use Configuration Manager to manage on-premises devices, you can extend Intune policies to those devices by configuring [tenant attach](../protect/tenant-attach-intune.md) or [co-management](../../configmgr/comanage/overview.md). @@ -59,8 +59,6 @@ Deploy Intune's *endpoint security*, *device configuration*, and *device complia Following are a few of the security settings and tasks you can manage through available policies: -- **Device encryption** – Manage [BitLocker](../protect/encrypt-devices.md) on Windows 10 devices, and [FileVault](../protect/encrypt-devices-filevault.md) on macOS. - - **Authentication methods** – Configure how your devices authenticate to your organization's resources, email, and applications. - [Use certificates for authentication](../protect/certificates-configure.md) to applications, your organization's resources, and for signing and encryption of email using S/MIME. You can also set up [derived credentials](../protect/derived-credentials.md) when your environment requires the use of smartcards. @@ -68,9 +66,9 @@ Following are a few of the security settings and tasks you can manage through av - Configure settings that help limit risk, like: - Require multi-factor-authentication (MFA) to add an extra layer of authentication for users. - Set PIN and password requirements that must be met before gaining access to resources. - - Enable [Windows Hello for Business](../protect/windows-hello.md) for Windows 10 devices. + - Enable [Windows Hello for Business](../protect/windows-hello.md) for Windows devices. -- **Virtual private networks (VPNs)** – With VPN profiles, assign VPN settings to devices so they can easily connect to your organization's network. Intune supports several [VPN connection types](../configuration/vpn-settings-configure.md#vpn-connection-types) and apps that include both built-in capabilities for some platforms and both first and third-party VPN apps for devices. +- **Device encryption** – Manage [BitLocker](../protect/encrypt-devices.md) on Windows devices, and [FileVault](../protect/encrypt-devices-filevault.md) on macOS. - **Software updates** – Manage how and when devices get software updates. The following are supported: @@ -79,19 +77,26 @@ Following are a few of the security settings and tasks you can manage through av - [Zebra LifeGuard Over-the-Air (LG OTA)](../protect/zebra-lifeguard-ota-integration.md) - Manage firmware updates for supported Zebra devices through the Intune admin center. - [iOS](../protect/software-updates-ios.md) - Manage device operating system versions, and when devices check for and install updates. - [macOS](../protect/software-updates-macos.md) - Manage software updates for macOS devices that enrolled as supervised devices. - - [Windows 10](../protect/windows-update-for-business-configure.md), you can manage the Windows Update experience for devices. You can configure when devices scan or install updates, hold a set of your managed devices at specific feature versions, and more. + - [Windows](../protect/windows-update-for-business-configure.md)- To manage the Windows Update experience for devices, you can configure when devices scan or install updates, hold a set of your managed devices at specific feature versions, and more. + +- **Security baselines** – Deploy [security baselines](../protect/security-baselines.md) to establish a core security posture on your Windows devices. Security baselines are preconfigured groups of Windows settings that come recommended by the relevant product teams. You can use baselines as provided or edit instances of them to meet your security goals for targeted groups of devices. + +- **Virtual private networks (VPNs)** – With VPN profiles, assign VPN settings to devices so they can easily connect to your organization's network. Intune supports several [VPN connection types](../configuration/vpn-settings-configure.md#vpn-connection-types) and apps that include both built-in capabilities for some platforms and both first and third-party VPN apps for devices. -- **Security baselines** – Deploy [security baselines](../protect/security-baselines.md) to establish a core security posture on your Windows 10 devices. Security baselines are preconfigured groups of Windows settings that come recommended by the relevant product teams. You can use baselines as provided or edit instances of them to meet your security goals for targeted groups of devices. +- **Windows Local Administrator Password Solution (LAPS)** - With [Windows LAPS policy](../protect/windows-laps-overview.md), you can: + - Enforce password requirements for local admin accounts + - Back up a local admin account from devices to your Active Directory (AD) or Microsoft Entra + - Schedule rotation of those account passwords to help keep them safe. ## Protect data through policies Intune-managed apps and Intune's [app protection policies](../apps/app-protection-policy.md) can help stop data leaks and keep your organization's data safe. These protections can apply to devices that are enrolled with Intune and to devices that aren't. -- **Intune-managed apps** (or *managed apps* for short), are apps that have been integrated with the [Intune App SDK](../developer/app-sdk.md) or wrapped by the [Intune App Wrapping Tool](../developer/apps-prepare-mobile-application-management.md). These apps can be managed using Intune app protection policies. To view a list of publicly available managed apps, see [Intune protected apps](../apps/apps-supported-intune-apps.md). +- **Intune-managed apps** (or *managed apps* for short), are apps that integrate the [Intune App SDK](../developer/app-sdk.md) or are wrapped by the [Intune App Wrapping Tool](../developer/apps-prepare-mobile-application-management.md). These apps can be managed using Intune app protection policies. To view a list of publicly available managed apps, see [Intune protected apps](../apps/apps-supported-intune-apps.md). Users can use managed apps to work with both your organization's data, and their own personal data. However, when app protection policies require the use of a managed app, the managed app is the only app that can be used to access your organization's data. App protection rules don't apply to a user's personal data. -- **App protection policies** are rules that ensure an organization's data remains safe or contained in a managed app. The rules identify the managed app that must be used and define what can be done with the data while the app is in use. +- **App protection policies** are rules that ensure an organization's data remains safe or contained in a managed app. The rules identify the managed app that must be used, and define what can be done with the data while the app is in use. The following are examples of protections and restrictions you can set with app protection policies and managed apps: @@ -103,7 +108,7 @@ The following are examples of protections and restrictions you can set with app From the Microsoft Intune admin center, you can run [device actions](../remote-actions/device-management.md#available-remote-actions) that help keep a selected device protected. You can run a subset of these actions as [bulk device actions](../remote-actions/bulk-device-actions.md) to affect multiple devices at the same time. And several [remote actions from Intune](../../configmgr/comanage/quickstart-remote-actions.md) can also be used with co-managed devices. -Device actions aren't policy and take effect a single time when invoked. They apply either immediately if the device is accessible on-line, or when the device next boots up or checks in with Intune. Considered these actions as supplemental to the use of policies that configure and maintain security configurations for a population of devices. +Device actions aren't policy and take effect a single time when invoked. They apply either immediately if the device is accessible on-line, or when the device next boots up or checks in with Intune. Considered these actions as supplemental to the use of policies that configure and maintain security configurations for a population of devices. Following are examples of actions you can run that help secure devices and data: @@ -111,7 +116,7 @@ Following are examples of actions you can run that help secure devices and data: - BitLocker key rotation (Windows only) - Disable Activation Lock (iOS only) -- Full or Quick scan (Windows 10 only) +- Full or Quick scan (Windows only) - Remote lock - Retire (which removes your organization's data from the device while leaving personal data intact) - Update Microsoft Defender Security Intelligence @@ -124,18 +129,18 @@ Following are examples of actions you can run that help secure devices and data: - Sync (force a device to immediately check in with Intune to find new policies or pending actions) ## Integrate with other products and partner technologies - + Intune supports integration with partner apps from both first-party and third-party sources, which expand on its built-in capabilities. You can also integrate Intune with several Microsoft technologies. ### Compliance partners -Learn about using [device compliance partners](../protect/device-compliance-partners.md) with Intune. When you manage a device with a mobile device management partner other than Intune, you can integrate that compliance data with Microsoft Entra ID. When integrated, Conditional Access policies can use the partner data along-side compliance data from Intune. +Learn about using [device compliance partners](../protect/device-compliance-partners.md) with Intune. When you manage a device with a mobile device management partner other than Intune, you can integrate that compliance data with Microsoft Entra ID. When integrated, Conditional Access policies can use the partner data alongside compliance data from Intune. ### Configuration Manager You can use many Intune policies and device actions to [protect the devices you manage with Configuration Manager](../protect/endpoint-security-manage-devices.md). To support those devices, configure [co-management](../../configmgr/comanage/overview.md) or [tenant attach](../../configmgr/tenant-attach/device-sync-actions.md). You can also [use both together](../../configmgr/comanage/faq.yml#should-i-use-co-management-or-tenant-attach-) with Intune. -- With *Co-management*, you can concurrently manage a Windows 10 device with both Configuration Manager and Intune. You install the Configuration Manager client and enroll the device to Intune. The device communicates with both services. +- With *Co-management*, you can concurrently manage a Windows device with both Configuration Manager and Intune. You install the Configuration Manager client and enroll the device to Intune. The device communicates with both services. - With *Tenant attach*, you set up synchronization between your Configuration Manager site and your Intune tenant. This synchronization provides you with a single view for all devices that you manage with Microsoft Intune. @@ -144,7 +149,7 @@ After a connection between Intune and Configuration Manager is established, devi Some of the protections you can apply include: - Deploy certificates to devices by using Intune *Simple Certificate Enrollment Protocol* (SCEP) or *private and public key pair* (PKCS) certificate profiles. -- Use compliance policy. +- Use compliance policy. - Use endpoint security policies, like *Antivirus*, *Endpoint detection and response*, and *Firewall* rules. - Apply security baselines. - Manage Windows Updates. @@ -158,7 +163,7 @@ Use threat-level data with policies for device compliance, app protection, and C With an integrated MTD app: - For [enrolled devices](../protect/mtd-device-compliance-policy-create.md): - - Use Intune to deploy and then manage the MTD app on devices. + - Use Intune to deploy and then manage the MTD app on devices. - Deploy device compliance policies that use the devices reported threat level to evaluate compliance. - Define Conditional Access policies that consider a devices threat level. - Define app protection policies to determine when to block or allow access to data, based on the threat level of the device. @@ -177,17 +182,17 @@ On its own, Microsoft Defender for Endpoint provides several security focused be - **Support for Microsoft Tunnel** - On Android devices, Microsoft Defender for Endpoint is the client application you use with [Microsoft Tunnel](../protect/microsoft-tunnel-overview.md), a VPN gateway solution for Intune. When used as the Microsoft Tunnel client app, you don't need a subscription for Microsoft Defender for Endpoint. - **Security tasks** – With [security tasks](../protect/atp-manage-vulnerabilities.md), Intune admins can take advantage of Microsoft Defender for Endpoint's [threat and vulnerability management](/windows/security/threat-protection/windows-defender-atp/next-gen-threat-and-vuln-mgt) capabilities. How it works: - + - Your Defender for Endpoint team identifies at-risk-devices and create the security tasks for Intune in the Defender for Endpoint security center. - - Those tasks show up in Intune with mitigation advice that Intune admins can use to mitigate the risk. + - Those tasks show up in Intune with mitigation advice that Intune admins can use to mitigate the risk. - When a task is resolved in Intune, that status passes back to the Defender for Endpoint security center where the results of the mitigation can be evaluated. - **Endpoint security policies** – The following Intune endpoint security policies require integration with Microsoft Defender for Endpoint. When you use [tenant attach](../protect/tenant-attach-intune.md), you can deploy these policies to devices you manage with either Intune or Configuration Manager. - - [Antivirus policy](../protect/endpoint-security-antivirus-policy.md) - Manage the settings for *Microsoft Defender Antivirus* and the *Windows Security experience* on supported devices, like Windows 10 and macOS. + - [Antivirus policy](../protect/endpoint-security-antivirus-policy.md) - Manage the settings for *Microsoft Defender Antivirus* and the *Windows Security experience* on supported devices, like Windows and macOS. - [Endpoint detection and response policy](../protect/endpoint-security-edr-policy.md) – Use this policy to configure endpoint detection and response (EDR), which is a capability of Microsoft Defender for Endpoint. - + ### Conditional Access Conditional Access is a Microsoft Entra capability that [works with Intune](../protect/conditional-access.md) to help protect devices. For devices that register with Microsoft Entra ID, Conditional Access policies can use device and compliance details from Intune to enforce access decisions for users and devices. @@ -220,4 +225,4 @@ For more information, see [Endpoint Privilege Management](../protect/epm-overvie ## Next steps -Plan to use Intune's capabilities to support your journey towards a zero-trust environment by protecting your data and securing devices. Beyond the previous in-line links to learn more about those capabilities, learn about [data security and sharing in Intune](../protect/privacy-data-secure-share.md). +Plan to use Intune's capabilities to support your journey towards a zero-trust environment by protecting your data and securing devices. Beyond the previous in-line links to learn more about those capabilities, learn about [data security and sharing in Intune](../protect/privacy-data-secure-share.md). diff --git a/memdocs/intune/protect/endpoint-security-account-protection-policy.md b/memdocs/intune/protect/endpoint-security-account-protection-policy.md index e2eac6d23e7..728137004e5 100644 --- a/memdocs/intune/protect/endpoint-security-account-protection-policy.md +++ b/memdocs/intune/protect/endpoint-security-account-protection-policy.md @@ -7,7 +7,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 07/18/2024 +ms.date: 08/19/2024 ms.topic: conceptual ms.service: microsoft-intune ms.subservice: protect @@ -57,8 +57,9 @@ For guidance on assigning the right level of permissions and rights to manage In ## Account protection profiles -**Windows 10/11 profiles**: +Platform: **Windows**: +Profiles: - **Account protection** – Settings for account protection policies help you protect user credentials. The account protection policy is focused on settings for Windows Hello for Business that include both *device-scoped* and *user-scoped* settings, and Credential Guard, which is part of Windows identity and access management. - *Windows Hello for Business* replaces passwords with strong two-factor authentication on PCs and mobile devices. diff --git a/memdocs/intune/protect/endpoint-security-antivirus-policy.md b/memdocs/intune/protect/endpoint-security-antivirus-policy.md index cbc611ff74b..846d315fe68 100644 --- a/memdocs/intune/protect/endpoint-security-antivirus-policy.md +++ b/memdocs/intune/protect/endpoint-security-antivirus-policy.md @@ -7,7 +7,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 06/17/2024 +ms.date: 08/19/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: protect @@ -56,8 +56,8 @@ Applies to: - Any supported version of macOS - For Intune to manage antivirus settings on a device, Microsoft Defender for Endpoint must be installed on that device. See. [Microsoft Defender for Endpoint for macOS](/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-mac) (In the Microsoft Defender for Endpoint documentation) -- **Windows 10, Windows 11, and Windows Server** - - No additional prerequisites are required. +- **Windows** + - No additional prerequisites are required. **Support for Configuration Manager clients**: @@ -98,13 +98,13 @@ Prerequisites to support tamper protection for devices managed by Intune: Profiles for *Antivirus* policy that support tamper protection for [devices managed by Microsoft Intune](#devices-managed-by-microsoft-intune): -- Platform: **Windows 10, Windows 11, and Windows Server** +- Platform: **Windows** - Profile: **Windows Security experience** > [!NOTE] - > Beginning on April 5, 2022, the *Windows 10 and later* platform was replaced by the *Windows 10, Windows 11, and Windows Server* platform. + > Beginning on April 5, 2022, the *Windows 10 and later* platform was replaced by the *Windows 10, Windows 11, and Windows Server* platform that is now named more simply as *Windows*. > - > The *Windows 10, Windows 11, and Windows Server* platform supports devices communicating with Intune through Microsoft Intune or Microsoft Defender for Endpoint. These profiles also add support for the Windows Server platform which is not supported through Microsoft Intune natively. + > The *Windows* platform supports devices communicating with Intune through Microsoft Intune or Microsoft Defender for Endpoint. These profiles also add support for the Windows Server platform which is not supported through Microsoft Intune natively. > > Profiles for this new platform use the settings format as found in the Settings Catalog. Each new profile template for this new platform includes the same settings as the older profile template it replaces. With this change you can no longer create new versions of the old profiles. Your existing instances of the old profile remain available to use and edit. @@ -121,7 +121,7 @@ Prerequisites to support managing tamper protection with these profiles: Profiles for *Antivirus* policy that support tamper protection for [devices managed by Configuration Manager](#devices-managed-by-configuration-manager): -- Platform: **Windows 10, Windows 11, and Windows Server (ConfigMgr)** +- Platform: **Windows (ConfigMgr)** - Profile: **Windows Security experience (preview)** ## Antivirus profiles @@ -140,13 +140,13 @@ The following profiles are supported for devices you manage with Intune: **Windows**: -- Platform: **Windows 10, Windows 11, and Windows Server** +- Platform: **Windows** Profiles for this platform can be used with devices enrolled with Intune, and devices managed through [Security Management for Microsoft Defender for Endpoint](../protect/mde-security-integration.md). > [!NOTE] - > Beginning on April 5, 2022, the *Windows 10 and later* platform was replaced by the *Windows 10, Windows 11, and Windows Server* platform. + > Beginning on April 5, 2022, the *Windows 10 and later* platform was replaced by the *Windows 10, Windows 11, and Windows Server* platform that is now named more simply as *Windows*. > - > The *Windows 10, Windows 11, and Windows Server* platform supports devices communicating with Intune through Microsoft Intune or Microsoft Defender for Endpoint. These profiles also add support for the Windows Server platform which is not supported through Microsoft Intune natively. + > The *Windows* platform supports devices communicating with Intune through Microsoft Intune or Microsoft Defender for Endpoint. These profiles also add support for the Windows Server platform which is not supported through Microsoft Intune natively. > > Profiles for this new platform use the settings format as found in the Settings Catalog. Each new profile template for this new platform includes the same settings as the older profile template it replaces. With this change you can no longer create new versions of the old profiles. Your existing instances of the old profile remain available to use and edit. @@ -242,7 +242,7 @@ The information for this report is based on details available from the following [Configure Endpoint security policies](../protect/endpoint-security-policy.md#create-an-endpoint-security-policy) -View details for the Windows settings in the deprecated profiles for the *Windows 10 and later* platform: +View details for the Windows settings in the deprecated profiles for the deprecated *Windows 10 and later* platform: - [Antivirus policy settings](../protect/antivirus-microsoft-defender-settings-windows.md) - [Antivirus exclusions](../protect/antivirus-microsoft-defender-settings-windows.md#microsoft-defender-antivirus-exclusions) diff --git a/memdocs/intune/protect/endpoint-security-app-control-policy.md b/memdocs/intune/protect/endpoint-security-app-control-policy.md index 861bba1adf8..ba79d597475 100644 --- a/memdocs/intune/protect/endpoint-security-app-control-policy.md +++ b/memdocs/intune/protect/endpoint-security-app-control-policy.md @@ -218,13 +218,13 @@ To run this script, you can use Intune to run [PowerShell scripts](../apps/intun #### Remove all AppLocker policies from a device (optional) -To remove *all* Windows AppLocker policies from a device, you can use the **CatCleanAll.ps1** PowerShell script. This script removes not only the Intune Management Extension as a managed installer, but *all* managed installers and *all* policies based on Windows AppLocker from a device. Before using this script, be sure you understand your organizations use of AppLocker policies. +To remove *all* Windows AppLocker policies from a device, you can use the **CatCleanAll.ps1** PowerShell script. This script removes not only the Intune Management Extension as a managed installer, but *all* policies based on Windows AppLocker from a device. Before using this script, be sure you understand your organizations use of AppLocker policies. 1. Download the **CatCleanAll.ps1** PowerShell script. This script is available at [https://aka.ms/intune_WDAC/CatCleanAll]( https://aka.ms/intune_WDAC/CatCleanAll) from *download.microsoft.com*. -2. Run this script on devices that have the Intune Management Extension set as a managed installer. This script removes only the Intune Management Extension as a managed installer. +2. Run this script on devices that have the Intune Management Extension set as a managed installer. This script removes the Intune Management Extension as a managed installer and AppLocker policies from the device. -3. Restart the Intune Management Extension service for the above changes to take effect. +3. Restart the Intune Management Extension service for the above changes to take effect. To run this script, you can use Intune to run [PowerShell scripts](../apps/intune-management-extension.md), or other methods of your choice. diff --git a/memdocs/intune/protect/endpoint-security-asr-policy.md b/memdocs/intune/protect/endpoint-security-asr-policy.md index 8a683b61d0a..c21937acd2c 100644 --- a/memdocs/intune/protect/endpoint-security-asr-policy.md +++ b/memdocs/intune/protect/endpoint-security-asr-policy.md @@ -7,7 +7,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 06/17/2024 +ms.date: 08/19/2024 ms.topic: conceptual ms.service: microsoft-intune ms.subservice: protect @@ -43,7 +43,7 @@ You can use attack surface reduction (ASR) policies to reduce the attack surface For more information, see [Overview of attack surface reduction]( /windows/security/threat-protection/microsoft-defender-atp/overview-attack-surface-reduction) in the Windows Threat protection documentation. - Attack surface reduction polices are found in the **Endpoint security** node of the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). + Attack surface reduction policies are found in the **Endpoint security** node of the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). Applies to: @@ -87,7 +87,7 @@ The available profiles for attack surface reduction policy depend on the platfor ### Devices managed by Intune -**Platform: Windows 10, Windows 11, and Windows Server**: +**Platform: Windows**: Profiles for this platform are supported on Windows 10 and Windows 11 devices enrolled with Intune. @@ -127,10 +127,6 @@ Available profiles for this platform include: - [Deploy and manage device control with Microsoft Intune](/microsoft-365/security/defender-endpoint/device-control-deploy-manage-intune) - [Device control walkthroughs](/microsoft-365/security/defender-endpoint/device-control-walkthroughs) -**Platform: Windows 10 and later**: - -Profiles for this platform are supported on Windows 10 and Windows 11 devices enrolled with Intune. Profiles include: - - **App and browser isolation** – Manage settings for Windows Defender Application Guard (Application Guard), as part of Defender for Endpoint. Application Guard helps to prevent old and newly emerging attacks and can isolate enterprise-defined sites as untrusted while defining what sites, cloud resources, and internal networks are trusted. To learn more, see [Application Guard](/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview) in the Microsoft Defender for Endpoint documentation. @@ -155,7 +151,7 @@ Profiles for this platform are supported on Windows 10 and Windows 11 devices en ### Devices managed by Defender for Endpoint security settings management -When you use the [Security Management for Microsoft Defender for Endpoint](../protect/mde-security-integration.md) scenario to support devices managed by Defender that aren't enrolled with Intune, you can use the *Windows 10, Windows 11, and Windows Server* platform to manage settings on devices that run Windows 10, Windows 11, and Windows Server. For more information, see [ASR rules supported operating systems](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference#asr-rules-supported-operating-systems) in the Windows Threat protection documentation. +When you use the [Security Management for Microsoft Defender for Endpoint](../protect/mde-security-integration.md) scenario to support devices managed by Defender that aren't enrolled with Intune, you can use the *Windows* platform to manage settings on devices that run Windows 10, Windows 11, and Windows Server. For more information, see [ASR rules supported operating systems](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference#asr-rules-supported-operating-systems) in the Windows Threat protection documentation. Profiles supported for this scenario include: @@ -174,7 +170,7 @@ Profiles supported for this scenario include: ### Reusable settings groups for Device control profiles -In public preview, Device control profiles support use of [reusable settings groups](../protect/reusable-settings-groups.md) to help manage settings for the following settings groups on devices for the *Windows 10, Windows 11, and Windows Server* platform: +In public preview, Device control profiles support use of [reusable settings groups](../protect/reusable-settings-groups.md) to help manage settings for the following settings groups on devices for the *Windows* platform: - Printer device: The following device control profile settings are available for *printer device*: diff --git a/memdocs/intune/protect/endpoint-security-disk-encryption-policy.md b/memdocs/intune/protect/endpoint-security-disk-encryption-policy.md index 28af8ff3fe7..2b471c34208 100644 --- a/memdocs/intune/protect/endpoint-security-disk-encryption-policy.md +++ b/memdocs/intune/protect/endpoint-security-disk-encryption-policy.md @@ -7,7 +7,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 06/17/2024 +ms.date: 08/19/2024 ms.topic: conceptual ms.service: microsoft-intune ms.subservice: protect @@ -64,11 +64,11 @@ For guidance on assigning the right level of permissions and rights to manage In > [!NOTE] > - > Beginning on June 19, 2023, the BitLocker profile for Windows 10 and later was updated to use the settings format as found in the Settings Catalog. The new profile format includes the same settings as the older profile. With this change you can no longer create new versions of the old profiles. Your existing instances of the old profile remain available to use and edit. + > Beginning on June 19, 2023, the BitLocker profile for Windows was updated to use the settings format as found in the Settings Catalog. The new profile format includes the same settings as the older profile. With this change you can no longer create new versions of the old profiles. Your existing instances of the old profile remain available to use and edit. > > With the new profile format, we no longer publish a dedicated list of settings as found in the profile. Instead, use the *Learn more* link in the UI while viewing information for a setting, to open [BitLocker CSP](/windows/client-management/mdm/bitlocker-csp) in the Windows documentation, where the setting is detailed in full. - > - > You can continue to find a list of settings from the original BitLocker profile at [BitLocker settings](../protect/endpoint-security-disk-encryption-profile-settings.md#bitlocker) in the Intune documentation. + > + > You can continue to find a list of settings in the original BitLocker profiles created before June 19, 2023, at [BitLocker settings](../protect/endpoint-security-disk-encryption-profile-settings.md#bitlocker) in the Intune documentation. To create a BitLocker profile, see [Use BitLocker disk encryption for Windows](../protect/encrypt-devices.md). diff --git a/memdocs/intune/protect/endpoint-security-disk-encryption-profile-settings.md b/memdocs/intune/protect/endpoint-security-disk-encryption-profile-settings.md index ef087ec691d..cc5ffd585c8 100644 --- a/memdocs/intune/protect/endpoint-security-disk-encryption-profile-settings.md +++ b/memdocs/intune/protect/endpoint-security-disk-encryption-profile-settings.md @@ -7,7 +7,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 05/13/2024 +ms.date: 08/19/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: protect @@ -33,6 +33,14 @@ ms.reviewer: aanavath View the settings you can configure in profiles for *Disk Encryption* policy in the Endpoint security node of Intune as part of an [Endpoint security policy](../protect/endpoint-security-policy.md). +> [!NOTE] +> +> Beginning on June 19, 2023, the BitLocker profile for Windows was updated to use the settings format as found in the Settings Catalog. The new profile format includes the same settings as the older profile, but due to the new format, settings names in the Intune admin center have updated. With this change you can no longer create new versions of the old profile. Your existing instances of the old profile remain available to use and edit. +> +> The settings details in this article apply only to BitLocker profiles created before June 19, 2023. +> +> With the new profile format, we no longer publish a dedicated list of settings as found in the profile. Instead, use the *Learn more* link in the UI while viewing information for a setting, to open [BitLocker CSP](/windows/client-management/mdm/bitlocker-csp) in the Windows documentation, where the setting is detailed in full. + Applies to: - macOS diff --git a/memdocs/intune/protect/endpoint-security-edr-policy.md b/memdocs/intune/protect/endpoint-security-edr-policy.md index e09707b4a75..7949fbcc36b 100644 --- a/memdocs/intune/protect/endpoint-security-edr-policy.md +++ b/memdocs/intune/protect/endpoint-security-edr-policy.md @@ -7,7 +7,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 06/17/2024 +ms.date: 08/19/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -61,7 +61,7 @@ Based on the platform a policy targets, EDR policies for devices you manage with > [!TIP] > In addition to EDR policy, you can use [device configuration](../protect/advanced-threat-protection-configure.md) policy to onboard devices to Microsoft Defender for Endpoint. However, device configuration policies don't support tenant attached devices. > -> When using multiple polices or policy types like *device configuration* policy and *endpoint detection and response* policy to manage the same device settings (such as onboarding to Defender for Endpoint), you can create policy conflicts for devices. To learn more about conflicts, see [Manage conflicts](../protect/endpoint-security-policy.md#manage-conflicts) in the *Manage security policies* article. +> When using multiple policies or policy types like *device configuration* policy and *endpoint detection and response* policy to manage the same device settings (such as onboarding to Defender for Endpoint), you can create policy conflicts for devices. To learn more about conflicts, see [Manage conflicts](../protect/endpoint-security-policy.md#manage-conflicts) in the *Manage security policies* article. ## Prerequisites for EDR policies @@ -78,7 +78,7 @@ Based on the platform a policy targets, EDR policies for devices you manage with To set up tenant attach, including the synchronization of Configuration Manager collections to the Microsoft Intune admin center and enabling them to work with policies for endpoint security, see [Configure tenant attach to support endpoint protection policies](../protect/tenant-attach-intune.md). - For more information about using EDR polices with tenant attached devices, see [Set up Configuration Manager to support EDR policy](#set-up-configuration-manager-to-support-edr-policy) in this article. + For more information about using EDR policies with tenant attached devices, see [Set up Configuration Manager to support EDR policy](#set-up-configuration-manager-to-support-edr-policy) in this article. ## Role-based access controls (RBAC) @@ -149,7 +149,7 @@ The EDR onboarding status tab includes: To learn more about Defender for Endpoint settings that are available for macOS, see [Set preferences for Microsoft Defender for Endpoint on macOS](/microsoft-365/security/defender-endpoint/mac-preferences#device-tags) in the Defender documentation. -**Windows** - To manage EDR for Windows devices, select the **Windows 10, Windows 11, and Windows Server** platform. The following profile is available: +**Windows** - To manage EDR for Windows devices, select the **Windows** platform. The following profile is available: - **Endpoint detection and response** - Intune deploys the policy to devices in your assigned groups. This profile supports use with: @@ -158,9 +158,9 @@ The EDR onboarding status tab includes: > [!NOTE] > - > Beginning on April 5, 2022, the *Windows 10 and later* platform was replaced by the *Windows 10, Windows 11, and Windows Server* platform. + > Beginning on April 5, 2022, the *Windows 10 and later* platform was replaced by the *Windows 10, Windows 11, and Windows Server* platform that is now named more simply as *Windows*. > - > The *Windows 10, Windows 11, and Windows Server* platform supports devices communicating through Microsoft Intune or Microsoft Defender for Endpoint. These profiles also add support for the Windows Server platform which is not supported through Microsoft Intune natively. + > The *Windows* platform supports devices communicating through Microsoft Intune or Microsoft Defender for Endpoint. These profiles also add support for the Windows Server platform which is not supported through Microsoft Intune natively. > > Profiles for this new platform use the settings format as found in the Settings Catalog. Each new profile template for this new platform includes the same settings as the older profile template it replaces. With this change you can no longer create new versions of the old profiles. Your existing instances of the old profile remain available to use and edit. @@ -230,7 +230,7 @@ To enable tenant attach when co-management isn’t enabled, you’ll need to sig The following are supported for devices you manage with Intune: -- Platform: **Windows 10, Windows 11, and Windows Server** - Intune deploys the policy to devices in your Microsoft Entra groups. +- Platform: **Windows** - Intune deploys the policy to devices in your Microsoft Entra groups. - Profile: **Endpoint detection and response** ## Use a preconfigured EDR policy @@ -258,11 +258,11 @@ To create the policy: 2. On the **Create a profile** page, specify one of the following combinations, and then select **Create**: - For devices managed by Intune: - - Platform = **Windows 10, Windows 11, and Windows Server** + - Platform = **Windows** - Profile = **Endpoint detection and response** - For devices managed through the [tenant attach scenario](../protect/tenant-attach-intune.md): - - Platform = **Windows 10, Windows 11, and Windows Server (ConfigMgr)** + - Platform = **Windows (ConfigMgr)** - Profile = **Endpoint detection and response (ConfigMgr)** > [!IMPORTANT] @@ -305,11 +305,11 @@ This option is found near the top of the page, above the Windows Devices onboard - Intune - Intune deploys the policy to devices in your assigned groups. When you create the policy, select: - - Platform: **Linux**, **macOS**, or **Windows 10, Windows 11, and Windows Server** + - Platform: **Linux**, **macOS**, or **Windows** - Profile: **Endpoint detection and response** - Configuration Manager - Configuration Manager deploys the policy to devices in your Configuration Manager collections. When you create the policy, select: - - Platform: **Windows 10, Windows 11, and Windows Server (ConfigMgr)** + - Platform: **Windows (ConfigMgr)** - Profile: **Endpoint detection and response (ConfigMgr)** 4. Select **Create**. @@ -380,12 +380,12 @@ You can view details about the EDR policies you use in the endpoint deployment a For policy details, in the admin center, go to **Endpoint security** > **Endpoint deployment and response** > **Summary** tab, and select the policy for which you want to view compliance details: -- For policies that target the **Linux**, **macOS**, or **Windows 10, Windows 11, and Windows Server** platforms (Intune), Intune displays an overview of compliance to the policy. You can also select the chart to view a list of devices that received the policy, and drill-in to individual devices for more details. +- For policies that target the **Linux**, **macOS**, or **Windows** platforms (Intune), Intune displays an overview of compliance to the policy. You can also select the chart to view a list of devices that received the policy, and drill-in to individual devices for more details. - For Windows devices, the chart for **Windows devices onboarded to Defender for Endpoint** displays the count of devices that have successfully onboarded to Microsoft Defender for Endpoint and that have yet to onboard. To ensure you have full representation of your devices in this chart, deploy the onboarding profile to all your devices. Devices that onboard to Microsoft Defender for Endpoint by external means, like Group Policy or PowerShell, are counted as **Devices without the Defender for Endpoint sensor**. -- For policies that target the **Windows 10, Windows 11, and Windows Server (ConfigMgr)** platform (Configuration Manager), Intune displays an overview of compliance to the policy that doesn't support drill-in to view additional details. The view is limited because the admin center receives limited status details from Configuration Manager, which manages the deployment of the policy to Configuration Manager devices. +- For policies that target the **Windows (ConfigMgr)** platform (Configuration Manager), Intune displays an overview of compliance to the policy that doesn't support drill-in to view additional details. The view is limited because the admin center receives limited status details from Configuration Manager, which manages the deployment of the policy to Configuration Manager devices. To view details for individual devices, go to **Endpoint security** > **Endpoint deployment and response** > **EDR Onboarding Status** tab, and select a device from the list to view additional device-specific details. diff --git a/memdocs/intune/protect/endpoint-security-edr-profile-settings.md b/memdocs/intune/protect/endpoint-security-edr-profile-settings.md index 01f5a1b9e5c..43af6d82078 100644 --- a/memdocs/intune/protect/endpoint-security-edr-profile-settings.md +++ b/memdocs/intune/protect/endpoint-security-edr-profile-settings.md @@ -35,7 +35,7 @@ ms.reviewer: mattcall > > The information in this article applies only to the settings in the Endpoint detection and response profile for the *Windows 10 and later* platform for endpoint security Endpoint detection and response policy. > -> Beginning on April 5, 2022, the *Windows 10 and later* platform was replaced by the *Windows 10, Windows 11, and Windows Server* platform. Although you can no longer create a new instance of this older profile, you can continue to edit and use an existing instances of this profile. The settings details in this article apply only to the deprecated profiles. +> Beginning on April 5, 2022, the *Windows 10 and later* platform was replaced by the *Windows 10, Windows 11, and Windows Server* platform that is now named more simply as *Windows*. Although you can no longer create a new instance of this older profile, you can continue to edit and use an existing instances of this profile. The settings details in this article apply only to the deprecated profiles. View the settings you can configure in profiles for [Endpoint detection and response policy](../protect/endpoint-security-edr-policy.md) in the endpoint security node of Intune. diff --git a/memdocs/intune/protect/endpoint-security-firewall-policy.md b/memdocs/intune/protect/endpoint-security-firewall-policy.md index 1655e3f33d2..5546622d8eb 100644 --- a/memdocs/intune/protect/endpoint-security-firewall-policy.md +++ b/memdocs/intune/protect/endpoint-security-firewall-policy.md @@ -68,14 +68,14 @@ For guidance on assigning the right level of permissions and rights to manage In - **macOS firewall** – Enable and configure settings for the built-in firewall on macOS. -**Platform: Windows 10, Windows 11, and Windows Server**: +**Platform: Windows**: For information about configuring settings in the following profiles, see the [Firewall configuration service provider (CSP)](/windows/client-management/mdm/firewall-csp). > [!NOTE] -> Beginning on April 5, 2022, the *Windows 10 and later* platform was replaced by the *Windows 10, Windows 11, and Windows Server* platform. +> Beginning on April 5, 2022, the *Windows 10 and later* platform was replaced by the *Windows 10, Windows 11, and Windows Server* platform that is now named more simply as *Windows*. > -> The *Windows 10, Windows 11, and Windows Server* platform supports devices communicating through Microsoft Intune or Microsoft Defender for Endpoint. These profiles also add support for the Windows Server platform which is not supported through Microsoft Intune natively. +> The *Windows* platform supports devices communicating through Microsoft Intune or Microsoft Defender for Endpoint. These profiles also add support for the Windows Server platform which is not supported through Microsoft Intune natively. > > Profiles for this new platform use the settings format as found in the Settings Catalog. Each new profile template for this new platform includes the same settings as the older profile template it replaces. With this change you can no longer create new versions of the old profiles. Your existing instances of the old profile remain available to use and edit. @@ -94,7 +94,8 @@ For guidance on assigning the right level of permissions and rights to manage In In public preview, Windows Firewall rule profiles support use of [reusable settings groups](../protect/reusable-settings-groups.md) for the following platforms: -- *Windows 10 and Windows 11* +- Windows 10 +- Windows 11 The following firewall rule profile settings are available in reusable settings groups: @@ -210,6 +211,6 @@ Additional common firewall rule issues: [Configure Endpoint security policies](../protect/endpoint-security-policy.md#create-an-endpoint-security-policy) -View details for the settings in the deprecated Firewall profiles for the *Windows 10 and later* platform: +View details for the settings in the deprecated Firewall profiles for the deprecated *Windows 10 and later* platform: - [Firewall profile settings](../protect/endpoint-security-Firewall-profile-settings.md). diff --git a/memdocs/intune/protect/endpoint-security-firewall-profile-settings-tenant-attach.md b/memdocs/intune/protect/endpoint-security-firewall-profile-settings-tenant-attach.md index 72948e1e01e..d685e997615 100644 --- a/memdocs/intune/protect/endpoint-security-firewall-profile-settings-tenant-attach.md +++ b/memdocs/intune/protect/endpoint-security-firewall-profile-settings-tenant-attach.md @@ -7,7 +7,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 11/14/2023 +ms.date: 08/19/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: protect diff --git a/memdocs/intune/protect/endpoint-security-firewall-profile-settings.md b/memdocs/intune/protect/endpoint-security-firewall-profile-settings.md index 025b6ffd977..640a73ee494 100644 --- a/memdocs/intune/protect/endpoint-security-firewall-profile-settings.md +++ b/memdocs/intune/protect/endpoint-security-firewall-profile-settings.md @@ -7,7 +7,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 03/26/2024 +ms.date: 08/19/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: protect @@ -41,7 +41,7 @@ Applies to: > [!NOTE] > -> Beginning on April 5, 2022, the Firewall profiles for the *Windows 10 and later* platform were replaced by the *Windows 10, Windows 11, and Windows Server* platform and new instances of those same profiles. Profiles created after that date use a new settings format as found in the Settings Catalog. With this change you can no longer create new versions of the old profile and they are no longer being developed. Although you can no longer create new instances of the older profile, you can continue to edit and use instances of it that you previously created. +> Beginning on April 5, 2022, the Firewall profiles for the *Windows 10 and later* platform were replaced by the *Windows* platform and new instances of those same profiles. Profiles created after that date use a new settings format as found in the Settings Catalog. With this change you can no longer create new versions of the old profile and they are no longer being developed. Although you can no longer create new instances of the older profile, you can continue to edit and use instances of it that you previously created. > > For profiles that use the new settings format, Intune no longer maintains a list of each setting by name. Instead, the name of each setting, its configuration options, and its explanatory text you see in the Microsoft Intune admin center are taken directly from the settings authoritative content. That content can provide more information about the use of the setting in its proper context. When viewing a settings information text, you can use its *Learn more* link to open that content. > @@ -508,7 +508,7 @@ Specifies the local and remote addresses to which this rule applies: Manage local address ranges for this rule. You can: - **Add** one or more addresses as a comma-separated list of local addresses that are covered by the rule. - - **Import** a .csv file that contains a list of addresses to use as local address ranges. + - **Import** a .csv file containing a list of local IP addresses ranges using the 'LocalAddressRanges' header. - **Export** your current list of local address ranges as a .csv file. Valid entries (tokens) include the following options: @@ -529,7 +529,7 @@ Specifies the local and remote addresses to which this rule applies: Manage remote address ranges for this rule. You can: - **Add** one or more addresses as a comma-separated list of remote addresses that are covered by the rule. - - **Import** a .csv file that contains a list of addresses to use as remote address ranges. + - **Import** a .csv file containing a list of remote IP addresses ranges using the 'RemoteAddressRanges' header. - **Export** your current list of remote address ranges as a .csv file. Valid entries (tokens) include the following and aren't case-sensitive: diff --git a/memdocs/intune/protect/endpoint-security-firewall-rule-tool.md b/memdocs/intune/protect/endpoint-security-firewall-rule-tool.md deleted file mode 100644 index d98be6d111d..00000000000 --- a/memdocs/intune/protect/endpoint-security-firewall-rule-tool.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -# required metadata - -title: Endpoint security firewall rule migration tool for Microsoft Intune -description: Learn about the endpoint security firewall rule migration tool for Microsoft Intune. -keywords: -author: brenduns -ms.author: brenduns -manager: dougeby -ms.date: 06/07/2024 -ms.topic: overview -ms.service: microsoft-intune -ms.subservice: protect -ms.localizationpriority: high -# optional metadata - -ROBOTS: NOINDEX -#audience: - -ms.suite: ems -search.appverid: MET150 -#ms.tgt_pltfrm: -ms.custom: intune-azure -ms.collection: -- tier3 -- M365-identity-device-management -- ContentEnagagementFY24 -- sub-secure-endpoints - -ms.reviewer: ---- - -# Endpoint security firewall rule migration tool overview - -> [!IMPORTANT] -> -> In June 2024, a change to MSGraph affected the operation of the Intune endpoint security Firewall Rule migration tool. With this change, the tool is unable to successfully create new firewall rule profiles and is therefore no longer supported or offered for download. Compounding the issue, the tool was capable of creating profiles for only the *Windows 10 and later* platform, a platform that has deprecated and [replaced by a new platform for firewall rule profiles](../protect/endpoint-security-firewall-policy.md) that supports the current Intune settings format. -> ->The challenges affecting the tool are not issues that can be resolved in the short term. -> -> We are evaluating options to offer a new tool for firewall rule migration. However, it is not yet known if or when a new tool could be available. Should we be able to provide a new tool, we will announce its availability in the [What’s New in Microsoft Intune](../fundamentals/whats-new.md) article at that time. diff --git a/memdocs/intune/protect/endpoint-security-policy.md b/memdocs/intune/protect/endpoint-security-policy.md index 81dea9f6b3f..354b89c77f4 100644 --- a/memdocs/intune/protect/endpoint-security-policy.md +++ b/memdocs/intune/protect/endpoint-security-policy.md @@ -72,7 +72,7 @@ To manage Intune endpoint security policies, you must use an account that includ > [!NOTE] > -> Before June of 2024, Intune endpoint security polices were managed through rights provided by the *Security baselines* permission. Beginning in June of 2024, Intune began to release granular permissions to manage individual endpoint security workloads. +> Before June of 2024, Intune endpoint security policies were managed through rights provided by the *Security baselines* permission. Beginning in June of 2024, Intune began to release granular permissions to manage individual endpoint security workloads. > > Each time a new granular permission for an endpoint security workload is added to Intune, those same rights are removed from the *Security baselines* permission. If you use custom roles with the *Security baselines* permission, the new RBAC permission is assigned automatically to your custom roles with the same rights that were granted through the *Security baseline* permission. This auto-assignment ensures your admins continue to have the same permissions they have today. @@ -183,8 +183,9 @@ After creating the new policy, review and edit the policy to make changes to its ### To duplicate a policy 1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). -2. Select the policy that you want to copy. Next, select **Duplicate**. If *Duplicate* isn't available, select the ellipsis (**…**) to the right of the policy and then select **Duplicate**. -3. Provide a **New name** for the policy, and then select **Save**. +2. Locate the policy that you want to copy from the policy list, and then select the ellipsis (**…**) for that line to open the *Context menu*. +3. Select **Duplicate**. +4. Provide a **New name** for the policy, and then select **Save**. ### To edit a policy diff --git a/memdocs/intune/protect/epm-data-collection.md b/memdocs/intune/protect/epm-data-collection.md index e9fd7f6cdb5..e797baf6ca8 100644 --- a/memdocs/intune/protect/epm-data-collection.md +++ b/memdocs/intune/protect/epm-data-collection.md @@ -1,5 +1,5 @@ --- -title: Review the data that Endpoint Privilege Management collects when used with Microsoft Intune +title: Review the type of data that Microsoft Intune Endpoint Privilege Management collects description: View details about the type of data Endpoint Privilege Management can collect and store when used with Microsoft Intune. keywords: author: brenduns @@ -49,7 +49,7 @@ Endpoint Privilege Management on devices can be configured to report on the foll - Diagnostic data - Usage data -When configuring EPM, you configure the *Send elevation data for reporting* and *Reporting scope* settings in a [Windows elevation settings policies](../protect/epm-policies.md#about-windows-elevation-settings-policy) to determine which data is reported to Microsoft. +When configuring EPM, you configure the *Send elevation data for reporting* and *Reporting scope* settings in an Intune [Windows elevation settings policy](../protect/epm-policies.md#about-windows-elevation-settings-policy) to determine which data is reported to Microsoft. ## Diagnostic Data @@ -57,7 +57,11 @@ Diagnostic data is event data that is used by Microsoft to monitor the health of ## Usage Data -Usage data is elevation data that is used by customers to determine what elevations have occurred in their environment. This data is stored with your Intune infrastructure and is used to populate the elevation reports. When configuring *reporting scope*, you have the ability to configure what scope of data is collected. You can choose between none, only elevations completed by EPM, or all elevations that take place on a device. +Usage data is elevation data that is used by customers to determine what elevations have occurred in their environment. This data is stored with your Intune infrastructure and is used to populate the [elevation reports](../protect/epm-reports.md). When configuring *reporting scope*, you configure what scope of data is collected and can choose between: + +- *Diagnostic data* only +- *Diagnostic data and all endpoint elevations* that take place on a device +- *Diagnostic data and managed elevations only* ### Data collection reference @@ -97,10 +101,10 @@ Usage data is elevation data that is used by customers to determine what elevati ||Operation Type|Type of policy application, used for policy application operations | ||Cancellation Action Type|Type of cancellation generated by the Administrator| - ## Next steps - [Learn about Endpoint Privilege Management](../protect/epm-overview.md) - [Guidance for creating Elevation Rules](../protect/epm-guidance-for-creating-rules.md) - [Configure policies for Endpoint Privilege Management](../protect/epm-policies.md) - [Reports for Endpoint Privilege Management](../protect/epm-reports.md) +- [Deployment considerations and frequently asked questions](../protect/epm-deployment-considerations-ki.md) \ No newline at end of file diff --git a/memdocs/intune/protect/epm-policies.md b/memdocs/intune/protect/epm-policies.md index fc5f4fa49d7..1753d2f5700 100644 --- a/memdocs/intune/protect/epm-policies.md +++ b/memdocs/intune/protect/epm-policies.md @@ -5,7 +5,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 06/18/2024 +ms.date: 08/21/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -63,6 +63,7 @@ Use *Windows elevation settings policy* when you want to: - **Default elevation response** - Set a default response for an *elevation request* of any file that isn't managed by a *Windows elevation rule policy*. For this setting to have an effect, no rule can exist for the application **AND** an end user must *explicitly request* elevation through the *Run with elevated access* right-click menu. By default, this option isn't configured. If no setting is delivered, the EPM components fall back to their built-in default, which is to **deny all requests**. Options include: + - **Deny all requests** - This option blocks the *elevate request* action for files that aren't defined in a Windows elevation rules policy. - **Require user confirmation** - When user confirmation is required, you can choose from the same validation options as found for Windows elevation rules policy. - **Require support approval** - When support approval is required, an administrator must approve elevation requests without a matching rule prior to the elevation being required. @@ -74,6 +75,7 @@ Use *Windows elevation settings policy* when you want to: - **Validation options** - Set validation options when the default elevation response is defined as *Require user confirmation*. Options include: + - **Business justification** - This option requires the end user to provide a justification before completing an elevation that is facilitated by the default elevation response. - **Windows authentication** - This option requires the end user to authenticate before completing an elevation that is facilitated by the default elevation response. @@ -85,12 +87,14 @@ Use *Windows elevation settings policy* when you want to: Diagnostic data is used by Microsoft to measure the health of the EPM client components. Usage data is used to show you elevations that happen within your tenant. For more information about the types of data and how it's stored, see [Data collection and privacy for Endpoint Privilege Management](../protect/epm-data-collection.md). Options include: + - **Yes** - This option sends data to Microsoft based on the *Reporting Scope* setting. - **No** - This option does not send data to Microsoft. - **Reporting Scope** - This setting controls the amount of data being sent to Microsoft when *Send elevation data for reporting* is set to *Yes*. By default, *Diagnostic data and all endpoint elevations* is selected. Options include: + - **Diagnostic data and managed elevations only** - This option sends diagnostic data to Microsoft about the health of the client components **AND** data about elevations being facilitated by Endpoint Privilege Management. - **Diagnostic data and all endpoint elevations** - This option sends diagnostic data to Microsoft about the health of the client components **AND** data about *all* elevations happening on the endpoint. - **Diagnostic data only** - This option sends only the diagnostic data to Microsoft about the health of the client components. @@ -107,12 +111,16 @@ The following types of files are supported: Each elevation rule instructs EPM on how to: - **Identify the file using**: + - *File name (including extension).* The rule also supports optional conditions like a minimum build version, product name, or internal name. Optional conditions are used to further validate the file when elevation is attempted. - *Certificate.* Certificates can be added directly to a rule, or by using a reusable settings group. When a certificate is used in a rule, it's also required to be valid. We recommend the use of reusable settings groups as they can be more efficient and simplify a future change to the certificate. For more information, see the next section [Reusable settings groups](#reusable-settings-group). + - **Validate the file**: + - *File hash.* A file hash is required for automatic rules. For user confirmed rules, you can choose to either use a certificate or a file hash, in which case the file hash becomes optional. - *Certificate.* If a certificate is provided Windows API's are used to validate the certificate and revocation status. - *Additional Properties.* Any additional properties specified in the rules must match. + - **Configure the files elevation type.** Elevation type identifies what happens when an elevation request is made for the file. By default, this option is set to *User confirmed*, which is our recommendation for elevations. - **User confirmed** (Recommended): A user confirmed elevation always requires the user to click on a confirmation prompt to run the file. There are more user confirmations you can add. One requires users to authenticate using their organization credentials. Another option requires the user to enter a business justification. While the text entered for a justification is up to the user, EPM can collect and report it when the device is configured to report elevation data as part of its Windows elevation settings policy. @@ -155,7 +163,7 @@ A device must have an elevation settings policy that enables support for EPM bef ### Create a Windows elevation settings policy 1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and go to **Endpoint security** > **Endpoint Privilege Management** > select the **Policies** tab > and then select **Create Policy**. - Set the *Platform* to **Windows 10 and later**, *Profile* to **Windows elevation settings policy**, and then select **Create**. + Set the *Platform* to **Windows**, *Profile* to **Windows elevation settings policy**, and then select **Create**. 2. On **Basics**, enter the following properties: @@ -188,9 +196,7 @@ A device must have an elevation settings policy that enables support for EPM bef 4. On the **Scope tags** page, select any desired scope tags to apply, then select **Next**. -5. For **Assignments**, select the groups that receive the policy. For more information on assigning profiles, see [Assign user and device profiles](../configuration/device-profile-assign.md). - - Select **Next**. +5. For **Assignments**, select the groups that receive the policy. For more information on assigning profiles, see [Assign user and device profiles](../configuration/device-profile-assign.md). Select **Next**. 6. For **Review + create**, review your settings and then select **Create**. When you select *Create*, your changes are saved, and the profile is assigned. The policy is also shown in the policy list. @@ -203,10 +209,65 @@ Deploy a *Windows elevation rules policy* to users or devices to deploy one or m - Specifies if the elevation type of the file as automatic (silently) or requiring user confirmation. With user confirmation, you can add additional user actions that must be completed before the file is run. In addition to this policy, a device must also be assigned a Windows elevation settings policy that enables Endpoint Privilege Management. -### Create a Windows elevation rules policy +Use either of the following methods to create new elevation rules, which are added to elevation rules policy: + +- [**Automatically configure elevation rules**](#automatically-configure-elevation-rules-for-windows-elevation-rules-policy) – Use this method to save time when creating an elevation rule by auto-populating the file detection details that Intune has already collected. The file details are identified by Intune from either The *[Elevation report](../protect/epm-reports.md#elevation-report)* or from a *[support approved](../protect/epm-support-approved.md)* elevation requests record. + + With this method, you: + + - Select the file for which you want to create an elevation rule from the Elevation report or *support approved* elevation request. + - Choose to add the new elevation rule to an existing elevation rules policy or create a new elevation rules policy that includes the new rule. + - When added to an existing policy, the new rule is immediately available to the policies assigned groups. + - When a new policy is created, you must edit that policy to assign groups before it becomes available for use. + +- [**Manually configure elevation rules**](#manually-configure-elevation-rules-for-windows-elevation-rules-policy) – This method requires you to have identified the file details you want to use for detection and to manually enter them as part of the rule creation workflow. For information about detection criteria, see [Defining rules for use with Endpoint Privilege Management](../protect/epm-guidance-for-creating-rules.md#defining-rules-for-use-with-endpoint-privilege-management). + + With this method, you: + + - Manually determine the file details to use and then add them to the elevation rule for file identification. + - Configure all aspects of the policy during policy creation, including assigning the policy to groups for use. + +### Automatically configure elevation rules for Windows elevation rules policy + +1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and go to **Endpoint security** > **Endpoint Privilege Management**. To select a file to use for an elevation rule, choose one of the following starting paths: + + **Start from a Report:** + + 1. Select the **Reports** tab and then the **Elevation report** tile. Locate the file you want to create a rule for in the *File* column. + 2. Select the linked name of the file to open that files **Elevation detail** pane. + + **Start from a support approved elevation request:** + + 1. Select the **Elevation request** tab. + 2. From the *File* column, select the file that you want to use for the elevation rule, which opens that files **Elevation detail** pane. + + The status of the elevation request doesn’t matter. You can use a pending request or one that was previously approved or denied. + +2. On the **Elevation detail** pane, review the file details. This information is used by the elevation rule to identify the correct file. When ready, select **Create a rule with these file details**. + + :::image type="content" source="./media/epm-policies/elevation-detail-pane.png" alt-text="Image from the admin center UI of a file selected from the Elevation report." lightbox="./media/epm-policies/elevation-detail-pane.png"::: + +3. Select a policy option for the new elevation rule you're creating: + + **Create a new policy:** + This option creates a new policy that includes an elevation rule for the file you selected. + + 1. For the rule, configure the **Type** and **Child process behavior**, and then select **OK** to create the policy. + 2. When prompted, provide a **Policy name** for the new policy and confirm creation of what will be a new and unassigned elevation rules policy. + 3. After the policy is created, you can edit the policy to assign it and add additional configurations if needed. + + **Add to an existing policy:** + With this option, use the drop-down list and select an existing elevation policy to which the new elevation rule is added. + + 1. For the rule, configure the elevation **Type** and **Child process behavior**, and then select **OK**. The policy is updated with the new rule. + 2. After the rule is added to the policy, you can edit the policy to gain access to the rule and then modify it to make additional configurations if needed. + + :::image type="content" source="./media/epm-policies/create-a-rule.png" alt-text="Image from the admin center UI of the create a rule pane." lightbox="./media/epm-policies/create-a-rule.png"::: + +### Manually configure elevation rules for Windows elevation rules policy 1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and go to **Endpoint security** > **Endpoint Privilege Management** > select the **Policies** tab > and then select **Create Policy**. - Set the *Platform* to **Windows 10 and later**, *Profile* to **Windows elevation rules policy**, and then select **Create**. + Set the *Platform* to **Windows**, *Profile* to **Windows elevation rules policy**, and then select **Create**. 2. On **Basics**, enter the following properties: @@ -229,8 +290,10 @@ In addition to this policy, a device must also be assigned a Windows elevation s - **Elevation type**: By default, this option is set to *User confirmed*, which is the elevation type we recommend for most files. - **User confirmed**: We recommend this option for most rules. When a file is run, the user receives a simple prompt to confirm their intent to run the file. The rule can also include other prompts that are available from the *Validation* drop down: + - *Business justification*: Require the user to enter a justification for running the file. There's no required format for the entry. The user input is saved and can be reviewed through logs if the *Reporting scope* includes collection of endpoint elevations. - *Windows authentication*: This option requires the user to authenticate using their organization credentials. + - **Automatic**: This elevation type automatically runs the file in question with elevated permissions. Automatic elevation is transparent to the user, without prompting for confirmation or requiring justification or authentication by the user. > [!CAUTION] @@ -255,9 +318,10 @@ In addition to this policy, a device must also be assigned a Windows elevation s - **Use a certificate file in reusable settings** (Default): This option uses a certificate file that has been added to a reusable settings group for Endpoint Privilege Management. You must [create a reusable settings group](#reusable-settings-groups) before you can use this option. - To identify the *Certificate*, select *Add or remove a certificate*, and then select the reusable group that contains the correct certificate. Then, specify the *Certificate type* of *Publisher* or *Certificate authority*. + To identify the *Certificate*, select *Add or remove a certificate*, and then select the reusable group that contains the correct certificate. Then, specify the *Certificate type* of *Publisher* or *Certificate authority*. - **Upload a certificate file**: Add a certificate file directly to the elevation rule. For *File upload*, specify a **.cer** file that can validate the integrity of the file that this rule applies to. Then, specify the *Certificate type* of *Publisher* or *Certificate authority*. + - **Not configured**: Use this option when you don't want to use a certificate to validate the integrity of the file. When no certificate is used, you must provide a *file hash*. - **File hash**: The file hash is required when Signature source is set to *Not configured*, and optional when set to use a certificate. @@ -270,8 +334,7 @@ In addition to this policy, a device must also be assigned a Windows elevation s 4. On the **Scope tags** page, select any desired scope tags to apply, then select **Next**. -5. For **Assignments**, select the groups that receive the policy. For more information on assigning profiles, see [Assign user and device profiles](../configuration/device-profile-assign.md). - Select **Next**. +5. For **Assignments**, select the groups that receive the policy. For more information on assigning profiles, see [Assign user and device profiles](../configuration/device-profile-assign.md). Select **Next**. 6. In **Review + create**, review your settings and then select **Create**. When you select *Create*, your changes are saved, and the profile is assigned. The policy is also shown in the policy list. @@ -314,7 +377,7 @@ If a device receives two rules targeting the same application, both rules are co - Rules deployed to a user take precedence over rules deployed to a device. - Rules with a hash defined are always deemed the most *specific* rule. - If more than one rule applies (with no hash defined), the rule with the most defined attributes wins (most *specific*). -- If applying the above logic results in more than one rule, the following order determines the elevation behavior: User Confirmed, Support Approved, and then Automatic. +- If applying the proceeding logic results in more than one rule, the following order determines the elevation behavior: User Confirmed, Support Approved, and then Automatic. > [!NOTE] > If a rule does not exist for an elevation and that elevation was requested through the *Run with elevated access* right-click context menu, then the *Default Elevation Behavior* will be used. diff --git a/memdocs/intune/protect/epm-support-approved.md b/memdocs/intune/protect/epm-support-approved.md index 2f27e4b4763..241a511c097 100644 --- a/memdocs/intune/protect/epm-support-approved.md +++ b/memdocs/intune/protect/epm-support-approved.md @@ -101,7 +101,7 @@ For more information about all the permissions for managing EPM, see [Role-based ## Create policy for support approved file elevations -To create support-approved elevation policy, use the same workflow for creating other EPM elevation rule policies. See [Create a Windows elevation rules policy](../protect/epm-policies.md#create-a-windows-elevation-rules-policy) in *Configure policies for Endpoint Privilege Management*. +To create support-approved elevation policy, use the same workflow for creating other EPM elevation rule policies. See [Windows elevation rules policy](../protect/epm-policies.md#windows-elevation-rules-policy) in *Configure policies for Endpoint Privilege Management*. ## Manage pending elevation requests @@ -112,22 +112,22 @@ Use the following procedure as guidance for reviewing and managing elevation req 1. The elevation request details include the following information: 1. **General details**: - 1. **File** - The name of the file that was requested for elevation. - 1. **Publisher** - The name of the publisher that signed the file that was requested for elevation. The name of the publisher is a link that retrieves the certificate chain for the file for download. - 1. **Device** - The device where the elevation was requested from. The device name is a link that opens the device object in the admin center. - 1. **Intune compliant** - The Intune compliance state of the device. + - **File** - The name of the file that was requested for elevation. + - **Publisher** - The name of the publisher that signed the file that was requested for elevation. The name of the publisher is a link that retrieves the certificate chain for the file for download. + - **Device** - The device where the elevation was requested from. The device name is a link that opens the device object in the admin center. + - **Intune compliant** - The Intune compliance state of the device. 1. **Request details**: - 1. **Status** - Status of the request. Requests start as *Pending* and can be either *approved* or *denied* by an administrator. - 1. **By** - The account of the administrator who *approved* or *denied* the request. - 1. **Last modified** - The last time the request entry was modified. - 1. **User's justification** - The justification provided by the user for the elevation request. - 1. **Approval expiration** - The time that the approval expires. Until this expiry time is reached, elevation of the approved file is allowed. - 1. **Admin's reason** - Justification provided by the admin when an *approval* or *denial* is completed. + - **Status** - Status of the request. Requests start as *Pending* and can be either *approved* or *denied* by an administrator. + - **By** - The account of the administrator who *approved* or *denied* the request. + - **Last modified** - The last time the request entry was modified. + - **User's justification** - The justification provided by the user for the elevation request. + - **Approval expiration** - The time that the approval expires. Until this expiry time is reached, elevation of the approved file is allowed. + - **Admin's reason** - Justification provided by the admin when an *approval* or *denial* is completed. 1. **File information** - Specifics of the metadata for the file that was requested for approval. - :::image type="content" source="./media/epm-support-approved/sample-request-detail.png" alt-text="Image that displays the detail of an elevation request." lightbox="./media/epm-support-approved/sample-request-detail.png"::: + :::image type="content" source="./media/epm-support-approved/sample-request-detail.png" alt-text="Image that displays the detail of an elevation request." lightbox="./media/epm-support-approved/sample-request-detail.png"::: 1. After an admin reviews a request, they can select **Approve** or **Deny**. With either selection, they're presented with the **justification** dialog where they can provide a *Reason* with detail about their decision. Providing a reason is optional. The following displays the approval dialog: diff --git a/memdocs/intune/protect/includes/mtd-mam-note.md b/memdocs/intune/protect/includes/mtd-mam-note.md new file mode 100644 index 00000000000..347500c4abc --- /dev/null +++ b/memdocs/intune/protect/includes/mtd-mam-note.md @@ -0,0 +1,29 @@ +--- +author: brenduns +ms.author: brenduns +ms.reviewer: demerson + +ms.service: microsoft-intune +ms.subservice: protect +ms.topic: include +ms.date: 08/20/2024 + +--- + + + +> [!NOTE] +> +> This article applies to all Mobile Threat Defense partners that support app protection policies: +> +> - Better Mobile (Android, iOS/iPadOS) +> - BlackBerry Mobile (CylancePROTECT for Android, iOS/iPadOS) +> - Check Point Harmony Mobile (Android, iOS/iPadOS) +> - Jamf (Android, iOS/iPadOS) +> - Lookout for Work (Android, iOS/iPadOS) +> - Microsoft Defender for Endpoint (Android, iOS/iPadOS, Windows) +> - SentinelOne (Android, iOS/iPadOS) +> - Symantec Endpoint Security (Android, iOS/iPadOS) +> - Trellix Mobile Security (Android, iOS/iPadOS) +> - Windows Security Center (Windows) - *For information about the Windows versions that support this connector, see [Data protection for Windows MAM](../../apps/protect-mam-windows.md).* +> - Zimperium (Android, iOS/iPadOS) \ No newline at end of file diff --git a/memdocs/intune/protect/jamf-managed-device-compliance-with-entra-id.md b/memdocs/intune/protect/jamf-managed-device-compliance-with-entra-id.md index e7e1af4892b..71023dfbca6 100644 --- a/memdocs/intune/protect/jamf-managed-device-compliance-with-entra-id.md +++ b/memdocs/intune/protect/jamf-managed-device-compliance-with-entra-id.md @@ -3,7 +3,7 @@ title: Jamf Managed Device Compliance with Microsoft Entra ID titleSuffix: Microsoft Intune -description: Configure a new integration to report Jamf device compliance to Microsoft Intune and Microsoft Entra ID. +description: Integrate Jamf Pro with Microsoft Intune to report device compliance to Microsoft Entra ID. author: jeffducasse ms.author: lanewsad manager: dougeby @@ -39,7 +39,7 @@ The process to establish integration between Jamf Pro and Microsoft Intune is ev > > **Jamf macOS device support for Conditional Access is being deprecated**. > -> Beginning on September 1, 2024, the platform that Jamf Pro's Conditional Access feature is built on will no longer be supported. +> Beginning on January 31, 2025, the platform that Jamf Pro's Conditional Access feature is built on will no longer be supported. > > If you use Jamf Pro's Conditional Access integration for macOS devices, follow Jamf's documented guidelines to migrate your devices to Device Compliance integration at [***Migrating from macOS Conditional Access to macOS Device Compliance – Jamf Pro Documentation***](https://learn.jamf.com/bundle/jamf-pro-documentation-current/page/Conditional_Access.html#ariaid-title6). > @@ -53,11 +53,26 @@ The process to establish integration between Jamf Pro and Microsoft Intune is ev - Configure the Intune Connector. - Prepare Microsoft Entra ID required components. -To complete the procedures in this article, your account must have the following permissions: +## Account permissions -- **Jamf Pro Administrator** or a **Jamf Pro user account** with **Device Compliance Privileges** -- **Intune administrator** -- **Microsoft Entra Global Administrator** +To complete the procedures in this article, you must have: + +- A Jamf Pro user account with device compliance privileges or a Jamf Pro administrator account. + +- A Microsoft Entra account, assigned a role with sufficient permissions. Available built-in roles include: + + - Intune Administrator - This role can perform all steps in this article. + + >[!TIP] + > The Intune Administrator is a highly privileged role with full access in Microsoft Intune. When you delegate roles to other accounts, consider assigning a built-in role with fewer privileges. + + - Groups Administrator - This role can create the required device groups. + + - Conditional Access Administrator - This role can create and update the Microsoft Entra Conditional Access policies that enable user-device registration. + + - Application Administrator - This role can create apps that communicate with JAMF about the device compliance state. + + For more information about these roles, see [Microsoft Entra built-in roles](/entra/identity/role-based-access-control/permissions-reference). diff --git a/memdocs/intune/protect/lookout-mtd-connector-integration.md b/memdocs/intune/protect/lookout-mtd-connector-integration.md index 8a7641565c9..a654e1d033a 100644 --- a/memdocs/intune/protect/lookout-mtd-connector-integration.md +++ b/memdocs/intune/protect/lookout-mtd-connector-integration.md @@ -75,7 +75,7 @@ To enable your Lookout Mobile Endpoint Security subscription integration with In :::image type="content" source="./media/lookout-mtd-connector-integration/azure-ad-group-id.png" alt-text="Microsoft Entra group Object ID"::: - After you gather this information, contact Lookout support (email: enterprisesupport@lookout.com). Lookout Support works with your primary contact to onboard your subscription and create your Lookout Enterprise account, using the information that you provide. + After you gather this information, contact Lookout support. Lookout Support works with your primary contact to onboard your subscription and create your Lookout Enterprise account, using the information that you provide. ## Configure your Lookout subscription diff --git a/memdocs/intune/protect/managed-software-updates-ios-macos.md b/memdocs/intune/protect/managed-software-updates-ios-macos.md index 400322ad431..b74d79f5da1 100644 --- a/memdocs/intune/protect/managed-software-updates-ios-macos.md +++ b/memdocs/intune/protect/managed-software-updates-ios-macos.md @@ -7,7 +7,7 @@ keywords: author: Smritib17 ms.author: smbhardwaj manager: dougeby -ms.date: 06/17/2024 +ms.date: 08/21/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -125,23 +125,27 @@ Managed software updates have precedence over other policies that configure soft :::image type="content" source="./media/managed-software-updates-ios-macos/ddm-software-update-category.png" alt-text="Screenshot that shows the settings catalog software update settings for Apple devices in Microsoft Intune."::: -1. Configure the settings: +7. Configure the settings: - **Details URL**: Enter a web page URL that has more information on the update. Typically, this URL is a web page hosted by your organization that users can select if they need organization-specific help with the update. - **Target Build Version**: Enter the target build version to update the device to, like `20A242`. The build version can include a supplemental version identifier, like `20A242a`. If the build version you enter isn't consistent with the **Target OS Version** value you enter, then the **Target OS Version** value takes precedence. - - **Target Date Time (UTC)**: Select or manually enter the date and the time that specifies when to force the installation of the software update. + - **Target Date Time**: Select or manually enter the date and the time that specifies when to force the installation of the software update. + + > [!NOTE] + > In a future release, the **UTC** text is being removed from the **Target Date Time** setting in the settings catalog UI. - The **Target Date Time (UTC)** setting schedules the update using the UTC timezone. This will take the configured time and convert it to UTC before sending the policy to be scheduled in the device's local timezone. For example, an Admin located in Eastern US configures an update to install at 2PM. The Eastern US timezone is 5 hours behind UTC, so the time would be converted to 5 hours after 2PM (EST) which is 7PM (UTC). Then, the policy will schedule the update to happen at 7PM in the local timezone of devices that receive the policy. - + The **Target Date Time** setting schedules the update using the local timezone of the device. For example, an admin configures an update to install at 2PM. The policy schedules the update to happen at 2PM in the local timezone of devices that receive the policy. + - If the user doesn't trigger the software update before this time, then a one-minute countdown prompt is shown to the user. When the countdown ends, the device force installs the update and forces a restart. - If the device is powered off when the deadline is met, when the device powers back on, there's a one hour grace period. When the grace period ends, the device force installs the update and forces a restart. > [!IMPORTANT] - > If you create a policy using this setting before the January 2024 release, then this setting shows *Invalid Date* for the value. The updates are still scheduled correctly and use the values you originally configured, even though it shows *Invalid Date*. - > To configure a new date and time, you can delete the *Invalid Date* values, and select a new date and time. Or, you can create a new policy. If you create a new policy, to help avoid future confusion, remove the values in the original policy. + > If you create a policy using this setting before the January 2024 release, then this setting shows **Invalid Date** for the value. The updates are still scheduled correctly and use the values you originally configured, even though it shows **Invalid Date**. + > + > To configure a new date and time, you can delete the **Invalid Date** values, and select a new date and time. Or, you can create a new policy. If you create a new policy, to help avoid future confusion, remove the values in the original policy. - **Target OS Version**: Select or manually enter the target OS version to update the device to. This value is the OS version number, like `16.1`. You can also include a supplemental version identifier, like `16.1.1`. @@ -162,7 +166,7 @@ Managed software updates have precedence over other policies that configure soft ## Monitoring managed software updates -Managed software updates use the same reporting as device configuration policies. For more information, go to [Monitor device configuration policies.](../configuration/device-profile-monitor.md). +Managed software updates use the same reporting as device configuration policies. For more information, go to [Monitor device configuration policies](../configuration/device-profile-monitor.md). > [!IMPORTANT] > A policy that reports Success only means that the configuration successfully installed on the device. Monitor the OS version of targeted devices to ensure that they update. After devices have updated to a later OS version than configured in the policy, the policy will report error as the device sees this as an attempt to downgrade. It's recommended to remove the older OS version policy from devices in this state. diff --git a/memdocs/intune/protect/mde-security-integration.md b/memdocs/intune/protect/mde-security-integration.md index 4246eb69117..49ba232c778 100644 --- a/memdocs/intune/protect/mde-security-integration.md +++ b/memdocs/intune/protect/mde-security-integration.md @@ -97,6 +97,9 @@ To confirm the version of the Defender agent, in the Defender portal go to the d *Known issue*: With the Defender agent version **101.23052.0009**, Linux devices fail to enroll when they're missing the following filepath: `/sys/class/dmi/id/board_vendor`. +*Known issue*: When a Linux device performs synthetic registration the Device Entra ID (formerly known as Device AAD ID) will not be visible in the Defender portal. This information can be viewed from the Intune or Entra portals. Administrators will still be able to manage devices with policies in this manner. + + **macOS**: With [Microsoft Defender for Endpoint for macOS](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint-mac#system-requirements) agent version **101.23052.0004** or later, security settings management supports the following macOS versions: @@ -110,6 +113,8 @@ To confirm the version of the Defender agent, in the Defender portal go to the d *Known issue*: With the Defender agent version **101.23052.0004**, macOS devices that are registered in Microsoft Entra ID before enrolling with security settings management receive a duplicate Device ID in Microsoft Entra ID, which is a synthetic registration. When you create a Microsoft Entra group for targeting policy, you must use the synthetic Device ID created by security settings management. In Microsoft Entra ID, the *Join Type* column for the synthetic Device ID is blank. +*Known issue*: When a macOS device performs synthetic registration the Device Entra ID (formerly known as Device AAD ID) will not be visible in the Defender portal. This information can be viewed from the Intune or Entra portals. Administrators will still be able to manage devices with policies in this manner. + **Windows**: - Windows 10 Professional/Enterprise (with [KB5023773](https://support.microsoft.com/topic/march-21-2023-kb5023773-os-builds-19042-2788-19044-2788-and-19045-2788-preview-5850ac11-dd43-4550-89ec-9e63353fef23)) @@ -173,7 +178,7 @@ The following diagram is a conceptual representation of the Microsoft Defender f ### What to expect in the Microsoft Defender portal -You can use the Microsoft Defender XDR *Device inventory* to confirm a device is using the security settings management capability in Defender for Endpoint, by reviewing the devices status in the **Managed by** column. The *Managed by* information is also available on the devices side-panel or device page. *Managed by* should consistently indicate that its managed by **MDE**.  +You can use the Microsoft Defender for Endpoint *Device inventory* to confirm a device is using the security settings management capability in Defender for Endpoint, by reviewing the devices status in the **Managed by** column. The *Managed by* information is also available on the devices side-panel or device page. *Managed by* should consistently indicate that its managed by **MDE**.  You can also confirm a device is enrolled in *security settings management* successfully by confirming that the device-side panel or device page display **MDE Enrollment status** as **Success**. @@ -246,9 +251,9 @@ The following policy types support the *macOS* platform. | Antivirus | Microsoft Defender Antivirus exclusions | ![Supported](./media/mde-security-integration/green-check.png) | ![Supported](./media/mde-security-integration/green-check.png) | | Endpoint detection and response | Endpoint detection and response | ![Supported](./media/mde-security-integration/green-check.png) | ![Supported](./media/mde-security-integration/green-check.png) | -### Windows 10, Windows 11, and Windows Server +### Windows -To support use with Microsoft Defender security settings management, your policies for Windows devices must use the *Windows 10, Windows 11, and Windows Server* platform. Each profile for the *Windows 10, Windows 11, and Windows Server* platform can apply to devices that are managed by Intune and to devices that are managed by security settings management. +To support use with Microsoft Defender security settings management, your policies for Windows devices must use the *Windows* platform. Each profile for the *Windows* platform can apply to devices that are managed by Intune and to devices that are managed by security settings management. | Endpoint security policy | Profile | Defender for Endpoint security settings management | Microsoft Intune | |---------|----------|-----------|----------| diff --git a/memdocs/intune/protect/media/actions-for-noncompliance/actions-for-noncompliance-1.png b/memdocs/intune/protect/media/actions-for-noncompliance/actions-for-noncompliance-1.png deleted file mode 100644 index 7cc5dc7d816..00000000000 Binary files a/memdocs/intune/protect/media/actions-for-noncompliance/actions-for-noncompliance-1.png and /dev/null differ diff --git a/memdocs/intune/protect/media/actions-for-noncompliance/actions-for-noncompliance-2.png b/memdocs/intune/protect/media/actions-for-noncompliance/actions-for-noncompliance-2.png deleted file mode 100644 index 8144f8161d3..00000000000 Binary files a/memdocs/intune/protect/media/actions-for-noncompliance/actions-for-noncompliance-2.png and /dev/null differ diff --git a/memdocs/intune/protect/media/actions-for-noncompliance/actions-for-noncompliance-4.png b/memdocs/intune/protect/media/actions-for-noncompliance/actions-for-noncompliance-4.png deleted file mode 100644 index 8e16af2dde5..00000000000 Binary files a/memdocs/intune/protect/media/actions-for-noncompliance/actions-for-noncompliance-4.png and /dev/null differ diff --git a/memdocs/intune/protect/media/compliance-policy-monitor/idc-10.png b/memdocs/intune/protect/media/compliance-policy-monitor/idc-10.png deleted file mode 100644 index 2cbc2d26108..00000000000 Binary files a/memdocs/intune/protect/media/compliance-policy-monitor/idc-10.png and /dev/null differ diff --git a/memdocs/intune/protect/media/compliance-policy-monitor/idc-8.png b/memdocs/intune/protect/media/compliance-policy-monitor/idc-8.png deleted file mode 100644 index dd0b397872b..00000000000 Binary files a/memdocs/intune/protect/media/compliance-policy-monitor/idc-8.png and /dev/null differ diff --git a/memdocs/intune/protect/media/encrypt-devices-filevault/force-enable-in-setup-assistant.png b/memdocs/intune/protect/media/encrypt-devices-filevault/force-enable-in-setup-assistant.png deleted file mode 100644 index 51f45b6ec16..00000000000 Binary files a/memdocs/intune/protect/media/encrypt-devices-filevault/force-enable-in-setup-assistant.png and /dev/null differ diff --git a/memdocs/intune/protect/media/endpoint-security-firewall-rule-tool/downloadtool.png b/memdocs/intune/protect/media/endpoint-security-firewall-rule-tool/downloadtool.png deleted file mode 100644 index 05ab5af4147..00000000000 Binary files a/memdocs/intune/protect/media/endpoint-security-firewall-rule-tool/downloadtool.png and /dev/null differ diff --git a/memdocs/intune/protect/media/epm-policies/create-a-rule.png b/memdocs/intune/protect/media/epm-policies/create-a-rule.png new file mode 100644 index 00000000000..d9c381426f2 Binary files /dev/null and b/memdocs/intune/protect/media/epm-policies/create-a-rule.png differ diff --git a/memdocs/intune/protect/media/epm-policies/elevation-detail-pane.png b/memdocs/intune/protect/media/epm-policies/elevation-detail-pane.png new file mode 100644 index 00000000000..3914dc6c11e Binary files /dev/null and b/memdocs/intune/protect/media/epm-policies/elevation-detail-pane.png differ diff --git a/memdocs/intune/protect/media/microsoft-cloud-pki-delete/image-10.png b/memdocs/intune/protect/media/microsoft-cloud-pki-delete/image-10.png deleted file mode 100644 index 8d0a7692fe8..00000000000 Binary files a/memdocs/intune/protect/media/microsoft-cloud-pki-delete/image-10.png and /dev/null differ diff --git a/memdocs/intune/protect/media/microsoft-cloud-pki/cloud-pki-byoca-certificate-flow.png b/memdocs/intune/protect/media/microsoft-cloud-pki/cloud-pki-byoca-certificate-flow.png deleted file mode 100644 index a860cc56ad6..00000000000 Binary files a/memdocs/intune/protect/media/microsoft-cloud-pki/cloud-pki-byoca-certificate-flow.png and /dev/null differ diff --git a/memdocs/intune/protect/media/microsoft-cloud-pki/cloud-pki-byoca-workflow.png b/memdocs/intune/protect/media/microsoft-cloud-pki/cloud-pki-byoca-workflow.png deleted file mode 100644 index 903a0df199f..00000000000 Binary files a/memdocs/intune/protect/media/microsoft-cloud-pki/cloud-pki-byoca-workflow.png and /dev/null differ diff --git a/memdocs/intune/protect/media/microsoft-cloud-pki/create-cloud-pki-basics.png b/memdocs/intune/protect/media/microsoft-cloud-pki/create-cloud-pki-basics.png deleted file mode 100644 index d83aca0180a..00000000000 Binary files a/memdocs/intune/protect/media/microsoft-cloud-pki/create-cloud-pki-basics.png and /dev/null differ diff --git a/memdocs/intune/protect/microsoft-cloud-pki-configure-byoca.md b/memdocs/intune/protect/microsoft-cloud-pki-configure-byoca.md index 9437ecbfcd9..d8698c2357b 100644 --- a/memdocs/intune/protect/microsoft-cloud-pki-configure-byoca.md +++ b/memdocs/intune/protect/microsoft-cloud-pki-configure-byoca.md @@ -349,5 +349,8 @@ Create an SCEP certificate profile for each OS platform you're targeting, like y - **Extended Key Usage**: Microsoft Cloud PKI doesn't support the **Any Purpose** option. + > [!NOTE] + > Make sure the EKU(s) you select is configured on the Cloud PKI issuing certificate authority (CA). If you select an EKU that isn't present on the Cloud PKI issuing CA, then an error occurs with the SCEP profile. And, a certificate isn't issued to the device. + - **SCEP Server URLs**: Don't combine NDES/SCEP URLs with Microsoft Cloud PKI issuing CA SCEP URLs. 1. Assign and review the profile. When you're ready to finalize everything, select **Create**. diff --git a/memdocs/intune/protect/microsoft-cloud-pki-configure-ca.md b/memdocs/intune/protect/microsoft-cloud-pki-configure-ca.md index 93f2424886d..688c965017a 100644 --- a/memdocs/intune/protect/microsoft-cloud-pki-configure-ca.md +++ b/memdocs/intune/protect/microsoft-cloud-pki-configure-ca.md @@ -246,7 +246,10 @@ Just like you did for the trusted certificate profiles, create an SCEP certifica 1. Configure the remaining settings, following these best practices: - **Subject name format**: Ensure the variables specified are available on the user or device object in Microsoft Entra ID. For example, if the target user of this profile doesn't have an email address attribute but the email address in this profile is filled in, the certificate won't be issued. An error also appears in the SCEP certificate profile report. - - **Extended Key Usage**: Microsoft Cloud PKI doesn't support the **Any Purpose** option. + - **Extended Key Usage** (EKU): Microsoft Cloud PKI doesn't support the **Any Purpose** option. + + > [!NOTE] + > Make sure the EKU(s) you select is configured on the Cloud PKI issuing certificate authority (CA). If you select an EKU that isn't present on the Cloud PKI issuing CA, then an error occurs with the SCEP profile. And, a certificate isn't issued to the device. - **SCEP Server URLs**: Don't combine NDES and SCEP URLs with Microsoft Cloud PKI issuing CA SCEP URLs. diff --git a/memdocs/intune/protect/microsoft-cloud-pki-delete.md b/memdocs/intune/protect/microsoft-cloud-pki-delete.md index 503ad4fe533..44d76241484 100644 --- a/memdocs/intune/protect/microsoft-cloud-pki-delete.md +++ b/memdocs/intune/protect/microsoft-cloud-pki-delete.md @@ -34,7 +34,7 @@ ms.collection: Delete an issuing and root certification authority (CA) from the Microsoft Cloud PKI service in Microsoft Intune. You can use the following actions in the Microsoft Intune admin center to manage certification authorities (CAs) in your tenant: * Pause CA - Pause the CA to stop use of it. -* Revoke CA - Revoke the CA and its active leaf certificates. +* Revoke CA - Revoke all active leaf certificates and then revoke the CA. * Delete CA - Delete and remove the CA from Microsoft Intune. A root CA can't be deleted until all anchored issuing CAs are deleted. If you change your mind after you pause a CA, you can unpause it to resume use. However, revoking and deleting a CA are permanent actions and can't be undone. diff --git a/memdocs/intune/protect/microsoft-cloud-pki-overview.md b/memdocs/intune/protect/microsoft-cloud-pki-overview.md index 8e9025637a4..c9f5d0b5a81 100644 --- a/memdocs/intune/protect/microsoft-cloud-pki-overview.md +++ b/memdocs/intune/protect/microsoft-cloud-pki-overview.md @@ -179,5 +179,4 @@ For the latest changes and additions, see [What's new in Microsoft Intune](../fu * Cloud PKI Root CA * Cloud PKI Issuing CA * BYOCA Issuing CA -* There isn't a way in the admin center to delete or disable a CA from your Intune tenant. We're actively working to provide these actions. Until they become available, we recommend making an Intune support request to delete a CA. * In the admin center, when you select **View all certificates** for an issuing CA, Intune only shows the first 1000 issued certificates. We're actively working to address this limitation. As a workaround, go to **Devices** > **Monitor**. Then select **Certificates** to view all issued certificates. diff --git a/memdocs/intune/protect/microsoft-tunnel-configure.md b/memdocs/intune/protect/microsoft-tunnel-configure.md index 0ca70672298..6ad9c4650c7 100644 --- a/memdocs/intune/protect/microsoft-tunnel-configure.md +++ b/memdocs/intune/protect/microsoft-tunnel-configure.md @@ -137,11 +137,11 @@ However, if you plan to install the Microsoft Tunnel Gateway to a rootless Podma For example, to use **wget** and log details to *mstunnel-setup* during the download, run `wget --output-document=mstunnel-setup https://aka.ms/microsofttunneldownload` -2. To start the server installation, run the script as **root**. For example, you might use the following command line: `sudo chmod +x ./mstunnel-setup`. The script always installs the [most recent version](microsoft-tunnel-upgrade.md#microsoft-tunnel-update-history) of Microsoft Tunnel. +2. To start the server installation, run the script as **root**. For example, you might use the following command line: `sudo ./mstunnel-setup`. The script always installs the [most recent version](microsoft-tunnel-upgrade.md#microsoft-tunnel-update-history) of Microsoft Tunnel. > [!IMPORTANT] > - > If you are installing Tunnel to a [rootless Podman container](#use-a-rootless-podman-container), use the the following modified command-line to start the script: `chmod mst_rootless_mode=1 ./mstunnel-setup` + > If you are installing Tunnel to a [rootless Podman container](#use-a-rootless-podman-container), use the the following modified command-line to start the script: `mst_rootless_mode=1 ./mstunnel-setup` To see detailed console output during the tunnel and installation agent enrollment process: @@ -152,7 +152,7 @@ However, if you plan to install the Microsoft Tunnel Gateway to a rootless Podma > [!IMPORTANT] > **For the U.S. government cloud**, the command line must reference the government cloud environment. To do so, run the following commands to add *intune_env=FXP* to the command line: > - > 1. Run `sudo chmod +x ./mstunnel-setup` + > 1. Run `sudo ./mstunnel-setup` > 2. Run `sudo intune_env=FXP ./mstunnel-setup` > [!TIP] diff --git a/memdocs/intune/protect/microsoft-tunnel-mam-android.md b/memdocs/intune/protect/microsoft-tunnel-mam-android.md index 4394fa8fa22..b40f957f9c8 100644 --- a/memdocs/intune/protect/microsoft-tunnel-mam-android.md +++ b/memdocs/intune/protect/microsoft-tunnel-mam-android.md @@ -67,7 +67,7 @@ Users of devices that aren't enrolled with Intune must install the following app **Line of Business apps**: -For your Line of Business (LOB) apps, integrate them with the MAM SDK. Later, you can [add your LOB apps](#configure-line-of-business-applications) to your app protection policy and app configuration polices for MAM Tunnel. See [Getting started with MAM for Android](../developer/app-sdk-android-phase3.md). +For your Line of Business (LOB) apps, integrate them with the MAM SDK. Later, you can [add your LOB apps](#configure-line-of-business-applications) to your app protection policy and app configuration policies for MAM Tunnel. See [Getting started with MAM for Android](../developer/app-sdk-android-phase3.md). > [!NOTE] > Make sure your Android LOB applications support direct proxy or Proxy Auto-Configuration (PAC) for both MDM and MAM. @@ -106,7 +106,7 @@ Create an App configuration policy to configure Microsoft Defender for Endpoint > [!NOTE] > Ensure only a single Defender app configuration policy targets the unenrolled device. Targeting more than 1 app configuration policy with different tunnel settings for Defender for Endpoint will create tunnel connection issues on the device. -1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and go to **Apps** > **App Configuration polices** > **Add** > **Managed Apps**. +1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and go to **Apps** > **App Configuration policies** > **Add** > **Managed Apps**. 2. On the *Basics* tab: @@ -156,7 +156,7 @@ The new policy appears in the list of App configuration policies. Create an App configuration policy for Microsoft Edge. This policy configures Microsoft Edge to support identity-switch, providing the ability to automatically connect the VPN Tunnel when signing-in or switching to a Microsoft "Work or school" account, and automatically disconnect the VPN tunnel when switching to a Microsoft personal account. -1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and go to **Apps** > **App Configuration polices** > **Add** > **Managed Apps**. +1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and go to **Apps** > **App Configuration policies** > **Add** > **Managed Apps**. 2. On the *Basics* tab: diff --git a/memdocs/intune/protect/microsoft-tunnel-mam-ios.md b/memdocs/intune/protect/microsoft-tunnel-mam-ios.md index 71c59fe7a43..27385a16ee2 100644 --- a/memdocs/intune/protect/microsoft-tunnel-mam-ios.md +++ b/memdocs/intune/protect/microsoft-tunnel-mam-ios.md @@ -100,7 +100,7 @@ Microsoft Tunnel for MAM iOS uses the following Intune policies and profiles: Create an app configuration policy for apps that use Tunnel for MAM. This policy configures an app to use a specific Microsoft Tunnel Gateway Site, proxy, and trusted certificate(s) for Edge and line-of-business (LOB) apps. These resources are used when connecting to on-premises resources. -1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and go to **Apps** > **App Configuration polices** > **Add** > **Managed Apps**. +1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and go to **Apps** > **App Configuration policies** > **Add** > **Managed Apps**. 2. On the *Basics* tab, enter a *Name* for the policy and a *Description* (optional). @@ -161,7 +161,7 @@ Create an App configuration policy for Microsoft Edge. This policy configures Ed > [!NOTE] > If you already have an app configuration policy created for your LOB App, you can edit that policy to include Edge and the required *key/value pair* settings. -1. In the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Apps** > **App Configuration polices** > **Add** > **Managed Apps**. +1. In the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Apps** > **App Configuration policies** > **Add** > **Managed Apps**. 2. On the *Basics* tab: diff --git a/memdocs/intune/protect/microsoft-tunnel-monitor.md b/memdocs/intune/protect/microsoft-tunnel-monitor.md index 2a8478be6ba..8b1b6c0536c 100644 --- a/memdocs/intune/protect/microsoft-tunnel-monitor.md +++ b/memdocs/intune/protect/microsoft-tunnel-monitor.md @@ -124,7 +124,7 @@ Default values for server health metrics: - **Server logs** – Determines if logs have been uploaded to the server within the last 60 minutes. - *Healthy* - Server logs were uploaded within the last 60 minutes. - - *Unhealthy* - Server logs were uploaded within the last 60 minutes. + - *Unhealthy* - Server logs have not been uploaded in the last 60 minutes. ## Manage health status thresholds diff --git a/memdocs/intune/protect/microsoft-tunnel-prerequisites.md b/memdocs/intune/protect/microsoft-tunnel-prerequisites.md index 84e293c8d3a..78756e9d0bd 100644 --- a/memdocs/intune/protect/microsoft-tunnel-prerequisites.md +++ b/memdocs/intune/protect/microsoft-tunnel-prerequisites.md @@ -5,7 +5,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 03/19/2024 +ms.date: 09/06/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -257,14 +257,14 @@ When creating the Server configuration for the tunnel, you can specify a differe **More requirements**: -- To access the security token service and Azure storage for logs, provide access to the following FQDNs: - - - Security Token Service: `*.sts.windows.net` - - Azure storage for tunnel logs: `*.blob.core.windows.net` - - Other storage endpoint urls: `*.blob.storage.azure.net` - -- The Tunnel shares the same requirements as [Network endpoints for Microsoft Intune](../fundamentals/intune-endpoints.md), with the addition of port TCP 22, and graph.microsoft.com. +To access the security token service and Azure storage for logs, provide access to the following FQDNs: +- Security Token Service: `*.sts.windows.net` +- Azure storage for tunnel logs: `*.blob.core.windows.net` +- Other storage endpoint urls: `*.blob.storage.azure.net` +- Microsoft Intune: `*.manage.microsoft.com` +- Microsoft authentication: `login.microsoftonline.com` +- Microsoft Graph: `graph.microsoft.com` - Configure firewall rules to support the configurations detailed in [Microsoft Artifact Registry (MAR) Client Firewall Rules Configuration](https://github.com/microsoft/containerregistry/blob/main/docs/client-firewall-rules.md). ## Proxy @@ -379,7 +379,7 @@ You can configure Podman to use the proxy to download (pull) updated images for `systemctl edit --force mstunnel_monitor` -2. Add the following four lines to the file. Replace each instance of *[address]* with your proxy DN or address, and then save the file: +2. Add the following three lines to the file. Replace each instance of *[address]* with your proxy DN or address, and then save the file: ``` [Service] @@ -486,7 +486,7 @@ To use the readiness tool: 2. To validate your network and Linux configuration, run the script with the following commands. These commands set the run permissions for the script, validate the Tunnel can connect to the correct endpoints, and then check for the presence of utilities that Tunnel uses: - - `sudo chmod +x ./mst-readiness` + - `sudo ./mst-readiness` - `sudo ./mst-readiness network` - This command runs the following actions and then reports success or error for both: diff --git a/memdocs/intune/protect/microsoft-tunnel-upgrade.md b/memdocs/intune/protect/microsoft-tunnel-upgrade.md index 8dcd28b8398..1f71c9fffc2 100644 --- a/memdocs/intune/protect/microsoft-tunnel-upgrade.md +++ b/memdocs/intune/protect/microsoft-tunnel-upgrade.md @@ -129,6 +129,20 @@ The Microsoft Tunnel version for a server isn’t available in the Intune UI at > > Container releases take place in stages. If you notice that your container images are not the most recent, please be assured that they will be updated and delivered within the following week. +### August 12, 2024 + +Image hash values: + +- **agentImageDigest**: sha256:4d16b1f458c69c3423626906b0b577cb42c8d22f4240205299355c6217e08a6b + +- **serverImageDigest**: sha256:66559e142d489491ca8f090b50f4a444a3394f850a5ec09fb9f3e6f986d93c46 + +Changes in this release: +- Support customizing container registry during installation +- Support customizing container creation options during installation +- Security updates on the base image + + ### June 20, 2024 Image hash values: diff --git a/memdocs/intune/protect/mobile-threat-defense.md b/memdocs/intune/protect/mobile-threat-defense.md index e9e88b32ab2..263e4c7410c 100644 --- a/memdocs/intune/protect/mobile-threat-defense.md +++ b/memdocs/intune/protect/mobile-threat-defense.md @@ -8,7 +8,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 04/22/2024 +ms.date: 08/21/2024 ms.topic: conceptual ms.service: microsoft-intune ms.subservice: protect @@ -20,7 +20,7 @@ ms.assetid: ac77b590-a7ec-45a0-9516-ebf5243b6210 #ROBOTS: #audience: -ms.reviewer: aanavath +ms.reviewer: demerson ms.suite: ems search.appverid: MET150 #ms.tgt_pltfrm: @@ -41,9 +41,18 @@ Intune can integrate data from a Mobile Threat Defense (MTD) vendor as an inform Intune can use this same data as a source for unenrolled devices using Intune app protection policies. As such, admins can use this information to help protect corporate data within a [Microsoft Intune protected app](../apps/apps-supported-intune-apps.md), and issue a block or selective wipe. -> [!NOTE] -> -> Intune for GCC High only supports the Mobile Threat Defense (MTD) connector for Android and iOS devices with MTD vendors that also have support in this environment. You will see connectors enabled for those specific vendors when you log in with a GCC-H tenant. Learn more about [Microsoft Intune for US Government GCC High support](/enterprise-mobility-security/solutions/ems-intune-govt-service-description). +## Government cloud support + +Mobile Threat Defense (MTD) connectors for Android and iOS/iPadOS devices are available in the following sovereign clouds, provided that the MTD partners also support these environments. Upon logging into your tenant, you'll be able to view the available connectors in that specific environment: + +- U.S. Government Community Cloud (GCC) High +- 21Vianet + +Learn more about Intune and government clouds: + +- [Microsoft Intune for US Government GCC High support](/enterprise-mobility-security/solutions/ems-intune-govt-service-description) +- [Microsoft Intune for US Government GCC High and DoD service description](../fundamentals/intune-govt-service-description.md) +- [Microsoft Intune operated by 21Vianet in China](../fundamentals/china.md) ## Protect corporate resources @@ -64,7 +73,7 @@ Once you add a Mobile Threat Defense connector to your tenant, the status displa | Connector status | Definition | Device threat messages blocked? | AppSync request messages blocked? | |--------------|-----------|------------|------------| | **Unavailable**| Connector is/was deprovisioned. The MTD partner needs to talk to Intune to provision it once more. | Yes (starting 2308) | Yes (starting 2308) | -| **Not Set Up**| Connector setup isn't complete. There may be additional steps or permissions required within Intune or the MTD partner for this status to change to **Available** | Yes (starting 2309) | Yes (starting 2309) | +| **Not Set Up**| Connector setup isn't complete. There may be additional steps or permissions required within Intune or the MTD partner for this status to change to **Available** | Yes (starting 2309) | Yes (starting 2309) | | **Available**| Connector setup is complete. At least one platform toggle must be turned on for this status to change to **Enabled**. | No | No | | **Enabled**| Connector setup is complete, and at least one platform toggle is currently turned on for this connector. | No | No | | **Unresponsive**| Connector isn't responsive. If the connector status continues to be unresponsive for the days defined in **Number of days until partner is unresponsive**, Intune ignores the compliance state.| No | No | @@ -121,19 +130,18 @@ Access is granted when the device is remediated:
Learn how to protect access to company resource based on device, network, and application risk with: -- [Better Mobile](better-mobile-threat-defense-connector.md) -- [BlackBerry Protect Mobile](blackberry-mobile-threat-defense-connector.md) -- [Check Point Harmony Mobile](checkpoint-sandblast-mobile-mobile-threat-defense-connector.md) -- [CrowdStrike Falcon for Mobile](crowdstrike-falcon-defense-connector.md) -- [Jamf Mobile Threat Defense](jamf-mtd-connector.md) -- [Lookout for Work](lookout-mobile-threat-defense-connector.md) -- [Microsoft Defender for Endpoint](../protect/advanced-threat-protection.md) -- [Pradeo](pradeo-mobile-threat-defense-connector.md) -- [SentinelOne](Sentinelone-mobile-threat-defense-connector.md) -- [Sophos Mobile](sophos-mtd-connector.md) -- [Symantec Endpoint Protection Mobile](skycure-mobile-threat-defense-connector.md) -- [Trellix Mobile Security](trellix-mobile-threat-defense-connector.md) -- [Trend Micro Mobile Security as a Service](trend-micro-mobile-threat-defense-connector.md) -- [Windows Security Center](../apps/protect-mam-windows.md) *(Supports integration with Windows MAM)* -- [Zimperium](zimperium-mobile-threat-defense-connector.md) - +- [Better Mobile](better-mobile-threat-defense-connector.md) - *(Android, iOS/iPadOS)* +- [BlackBerry Protect Mobile](blackberry-mobile-threat-defense-connector.md) - *(Android, iOS/iPadOS)* +- [Check Point Harmony Mobile](checkpoint-sandblast-mobile-mobile-threat-defense-connector.md) - *(Android, iOS/iPadOS)* +- [CrowdStrike Falcon for Mobile](crowdstrike-falcon-defense-connector.md) - *(Android, iOS/iPadOS)* +- [Jamf Mobile Threat Defense](jamf-mtd-connector.md) - *(Android, iOS/iPadOS)* +- [Lookout for Work](lookout-mobile-threat-defense-connector.md) - *(Android, iOS/iPadOS)* +- [Microsoft Defender for Endpoint](../protect/advanced-threat-protection.md) - *(Android, iOS/iPadOS, Windows)* +- [Pradeo](pradeo-mobile-threat-defense-connector.md) - *(Android, iOS/iPadOS)* +- [SentinelOne](Sentinelone-mobile-threat-defense-connector.md) - *(Android, iOS/iPadOS)* +- [Sophos Mobile](sophos-mtd-connector.md) - *(Android, iOS/iPadOS)* +- [Symantec Endpoint Protection Mobile](skycure-mobile-threat-defense-connector.md) - *(Android, iOS/iPadOS)* +- [Trellix Mobile Security](trellix-mobile-threat-defense-connector.md) - *(Android, iOS/iPadOS)* +- [Trend Micro Mobile Security as a Service](trend-micro-mobile-threat-defense-connector.md) - *(Android, iOS/iPadOS)* +- [Windows Security Center](../apps/protect-mam-windows.md) - *(Windows)* - *For information about the Windows versions that support this connector, see [Data protection for Windows MAM](../apps/protect-mam-windows.md).* +- [Zimperium](zimperium-mobile-threat-defense-connector.md) - *(Android, iOS/iPadOS)* diff --git a/memdocs/intune/protect/mtd-add-apps-unenrolled-devices.md b/memdocs/intune/protect/mtd-add-apps-unenrolled-devices.md index 7f9dff51636..69e05bbab1f 100644 --- a/memdocs/intune/protect/mtd-add-apps-unenrolled-devices.md +++ b/memdocs/intune/protect/mtd-add-apps-unenrolled-devices.md @@ -8,7 +8,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 01/23/2024 +ms.date: 08/20/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -20,7 +20,7 @@ ms.assetid: #ROBOTS: #audience: -ms.reviewer: aanavath +ms.reviewer: demerson ms.suite: ems search.appverid: MET150 #ms.tgt_pltfrm: @@ -39,19 +39,7 @@ End users need the Microsoft Authenticator (iOS) to register their device, and t Optionally, you can use Intune to add and deploy the Microsoft Authenticator, and Mobile Threat Defense (MTD) apps as well. -> [!NOTE] -> This article applies to all Mobile Threat Defense partners that support app protection policies: -> -> - Microsoft Defender for Endpoint (Android, iOS/iPadOS) -> - Better Mobile (Android, iOS/iPadOS) -> - BlackBerry Mobile (CylancePROTECT for Android, iOS/iPadOS) -> - Check Point Harmony Mobile (Android, iOS/iPadOS) -> - Jamf (Android, iOS/iPadOS) -> - Lookout for Work (Android, iOS/iPadOS) -> - SentinelOne (Android, iOS/iPadOS) -> - Symantec Endpoint Security (Android, iOS/iPadOS) -> - Trellix Mobile Security (Android, iOS/iPadOS) -> - Zimperium (Android, iOS/iPadOS) +[!INCLUDE [mtd-mam-note](../../intune/protect/includes/mtd-mam-note.md)] > > For unenrolled devices, you **do not need an iOS app configuration policy** that sets up the Mobile Threat Defense for iOS app you use with Intune. This is a key difference compared to Intune enrolled devices. @@ -142,21 +130,6 @@ However, should you wish to make the app available to end users via the Intune C - **iOS** - See the instructions for [adding iOS store apps to Microsoft Intune](../apps/store-apps-ios.md). Use this [Zimperium - App Store URL](https://itunes.apple.com/us/app/zimperium-zips/id1030924459?mt=8) when completing the **Configure app information** section. - - - - - ## Next steps - [Enable the Mobile Threat Defense connector in Intune for unenrolled devices](mtd-enable-unenrolled-devices.md) diff --git a/memdocs/intune/protect/mtd-app-protection-policy.md b/memdocs/intune/protect/mtd-app-protection-policy.md index 649eaab817b..af25f09e869 100644 --- a/memdocs/intune/protect/mtd-app-protection-policy.md +++ b/memdocs/intune/protect/mtd-app-protection-policy.md @@ -8,7 +8,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 01/23/2024 +ms.date: 08/20/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -20,7 +20,7 @@ ms.assetid: #ROBOTS: #audience: -ms.reviewer: aanavath +ms.reviewer: demerson ms.suite: ems search.appverid: MET150 #ms.tgt_pltfrm: @@ -35,21 +35,8 @@ ms.collection: Intune with Mobile Threat Defense (MTD) helps you detect threats and assess risk on mobile and Windows devices. You can create an Intune app protection policy that assesses risk to determine if the application is allowed to access corporate data or not. -> [!NOTE] -> This article applies to all Mobile Threat Defense partners that support app protection policies: -> -> - Better Mobile (Android, iOS/iPadOS) -> - BlackBerry Mobile (Android, iOS/iPadOS) -> - Check Point Harmony Mobile (Android, iOS/iPadOS) -> - Jamf (Android, iOS/iPadOS) -> - Microsoft Defender for Endpoint (Android, iOS/iPadOS) -> - Lookout for Work (Android, iOS/iPadOS) -> - Trellix Mobile Security (Android, iOS/iPadOS) -> - SentinelOne (Android, iOS/iPadOS) -> - Symantec Endpoint Security (Android, iOS/iPadOS) -> - Windows Security Center (Windows) -> - Zimperium (Android, iOS/iPadOS) - +[!INCLUDE [mtd-mam-note](../../intune/protect/includes/mtd-mam-note.md)] + ## Before you begin As part of the MTD setup, in the MTD partner console, you created a policy that classifies various threats as high, medium, and low. You now need to set the Mobile Threat Defense level in the Intune app protection policy. diff --git a/memdocs/intune/protect/mtd-apps-ios-app-configuration-policy-add-assign.md b/memdocs/intune/protect/mtd-apps-ios-app-configuration-policy-add-assign.md index de94afb7430..760eeaf4080 100644 --- a/memdocs/intune/protect/mtd-apps-ios-app-configuration-policy-add-assign.md +++ b/memdocs/intune/protect/mtd-apps-ios-app-configuration-policy-add-assign.md @@ -176,7 +176,7 @@ Use the same Microsoft Entra account previously configured in the [Symantec Endp ### Sophos Mobile app configuration policy -Create the iOS app configuration policy as described in the [using iOS app configuration policy](../apps/app-configuration-policies-use-ios.md) article. For more information, see [Sophos Intercept X for Mobile iOS - Available managed settings](https://support.sophos.com/support/s/article/KB-000038801) in the Sophos knowledge base. +Create the iOS app configuration policy as described in the [using iOS app configuration policy](../apps/app-configuration-policies-use-ios.md) article. For more information, see [Sophos Intercept X for Mobile iOS - Available managed settings](https://support.sophos.com/support/s/article/KBA-000006738) in the Sophos knowledge base. ### Trellix Mobile Security app configuration policy diff --git a/memdocs/intune/protect/mtd-device-compliance-policy-create.md b/memdocs/intune/protect/mtd-device-compliance-policy-create.md index 862aa70957f..b01e390470e 100644 --- a/memdocs/intune/protect/mtd-device-compliance-policy-create.md +++ b/memdocs/intune/protect/mtd-device-compliance-policy-create.md @@ -8,7 +8,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 11/01/2023 +ms.date: 08/22/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -52,13 +52,13 @@ With integration complete and the partner policy in place, you can then create I 1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). -2. Select **Endpoint security** > **Device Compliance** > **Create policy**. +2. Select **Endpoint security** > **Device compliance** > **Create policy**. 3. Select the **Platform**: - For most platforms, the *Profile type* is automatically set. If not automatically set, select the appropriate Profile type. - To continue, select **Create**. -4. On **Basics**, specify a device compliance policy **Name**, and **Description** (optional). Select **Next** to continue. +4. On **Basics**, specify a device compliance policy **Name**, and **Description** (optional). Select **Next** to continue. 5. On **Compliance settings**, expand and configure **Device Health**. Choose a threat-level from the drop-down list for **Require the device to be at or under the Device Threat Level**. @@ -74,7 +74,7 @@ With integration complete and the partner policy in place, you can then create I 6. On the **Actions for noncompliance** tab, specify a sequence of actions to apply automatically to devices that don't meet this compliance policy. - You can add multiple actions and configure schedules and other details for some actions. For example, you might change the schedule of the default action *Mark device noncompliant* to occur after one day. You can then add an action to send an email to the user when the device isn't compliant to warn them of that status. You can also add actions that lock or retire devices that remain noncompliant. + You can add multiple actions and configure schedules and other details for some actions. For example, you might change the schedule of the default action *Mark device noncompliant* to occur after one day. You can then add an action to send an email to the user when the device isn't compliant to warn them of that status. You can also add actions that lock or retire devices that remain noncompliant. For information about the actions you can configure, see [Add actions for noncompliant devices](actions-for-noncompliance.md), including how to create notification emails to send to your users. @@ -88,7 +88,7 @@ With integration complete and the partner policy in place, you can then create I ## Monitoring risk score sent by Mobile Threat Defense partner -Your Mobile Threat Defense partner can send a risk score for each device for which the MTD app is installed. You can view this under **Reports** > **Device compliance** > **Reports** > **Device Compliance**. Make sure **Device threat level** is selected when opening the **Columns** tab, this may require you to hit **Generate** first. +Your Mobile Threat Defense partner can send a risk score for each device for which the MTD app is installed. You can view this under **Reports** > **Device compliance** > **Reports** > **Device Compliance**. Make sure **Device threat level** is selected when opening the **Columns** tab, this may require you to hit **Generate** first. > [!IMPORTANT] > diff --git a/memdocs/intune/protect/mtd-enable-unenrolled-devices.md b/memdocs/intune/protect/mtd-enable-unenrolled-devices.md index 8b8cc2be3a2..4348ba1e34f 100644 --- a/memdocs/intune/protect/mtd-enable-unenrolled-devices.md +++ b/memdocs/intune/protect/mtd-enable-unenrolled-devices.md @@ -8,7 +8,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 07/09/2024 +ms.date: 08/20/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -20,7 +20,7 @@ ms.assetid: #ROBOTS: #audience: -ms.reviewer: aanavath +ms.reviewer: demerson ms.suite: ems search.appverid: MET150 #ms.tgt_pltfrm: @@ -35,18 +35,7 @@ ms.collection: During Mobile Threat Defense (MTD) setup, you've configured a policy for classifying threats in your Mobile Threat Defense partner console and you've created the app protection policy in Intune. If you've already configured the Intune connector in the MTD partner console, you can now enable the MTD connection for MTD partner applications. -> [!NOTE] -> This article applies to all Mobile Threat Defense partners that support app protection policies: -> -> - BlackBerry Mobile (Android, iOS/iPadOS) -> - Better Mobile (Android,iOS/iPadOS) -> - Check Point Harmony Mobile Protect (Android, iOS/iPadOS) -> - Jamf (Android, iOS/iPadOS) -> - Lookout for Work (Android, iOS/iPadOS) -> - SentinelOne (Android,iOS/iPadOS) -> - Symantec Endpoint Security (Android, iOS/iPadOS) -> - Trellix Mobile Security (Android,iOS/iPadOS) -> - Zimperium (Android,iOS/iPadOS) +[!INCLUDE [mtd-mam-note](../../intune/protect/includes/mtd-mam-note.md)] ## Classic conditional access policies for Mobile Threat Defense (MTD) apps diff --git a/memdocs/intune/protect/network-access-control-integrate.md b/memdocs/intune/protect/network-access-control-integrate.md index b8d93c11321..49d1995a26f 100644 --- a/memdocs/intune/protect/network-access-control-integrate.md +++ b/memdocs/intune/protect/network-access-control-integrate.md @@ -7,7 +7,7 @@ keywords: author: lenewsad ms.author: lanewsad manager: dougeby -ms.date: 07/24/2023 +ms.date: 08/21/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -36,7 +36,7 @@ ms.collection: Intune integrates with network access control (NAC) partners to help organizations secure corporate data when devices try to access on-premises resources. >[!NOTE] -> A new NAC service (CR service) was released in July 2021 and many of our NAC partners are transitioning to this new service. While we have extended the timeline for supporting the legacy NAC service through **March 31, 2024**, we recommend you to migrate to the new CR service to avoid service disruption.Currently, the following NAC partner product supports the new NAC service: +> The *compliance retrieval service* was released in July 2021 and replaced the previous Intune NAC service. Microsoft Intune is providing support for the legacy Intune NAC service through March 31, 2024. Our NAC partners are transitioning to the compliance retrieval service and include: > > - ExtremeCloud Universal ZTNA > - Extreme Networks ExtremeCloud IQ-Site Engine version 24.2 @@ -52,7 +52,7 @@ Intune integrates with network access control (NAC) partners to help organizatio > - Forescout eyeExtend Microsoft Module v1.0.1 and later > - Portnox Cloud > -> Contact your NAC partner if you have questions on the impact of this transition. For more information, see our [blog post on the new compliance retrieval service](https://aka.ms/new-compliance-retrieval-api/). +> We will be deprecating the Intune NAC service in the future, so we recommend that you migrate to the compliance retrieval service to avoid service disruption. Contact your NAC solution provider if you have questions about the compliance retrieval service or impact to your tenant. For more information and updates about the compliance retrieval service and NAC partners, see [Microsoft Tech Community: New Microsoft Intune service for network access control](https://techcommunity.microsoft.com/t5/intune-customer-success/new-microsoft-intune-service-for-network-access-control/ba-p/2544696). ## How do Intune and NAC solutions help protect your organization resources? @@ -98,16 +98,16 @@ The following list is an overview on how NAC integration works when integrated w ## Enable NAC -To enable use of NAC and the *compliance retrieval service* that became available in July 2021, reference your NAC product's most recent documentation for enabling NAC integration with Intune. This integration might require you to make changes after you upgrade to their new NAC product or version. +To enable use of NAC and the compliance retrieval service, reference your NAC product's most recent documentation for enabling NAC integration with Intune. This integration might require you to make changes after you upgrade to a new NAC product or version. The compliance retrieval service requires certificate-based authentication and the use of the *Intune device ID* as the subject alternative name of the certificates. For Simple Certificate Enrollment Protocol (SCEP) and Private and public key pair (PKCS) certificates, you can add an attribute of the **URI** type with a value defined by your NAC provider. For example, your NAC provider's instructions might say to include `IntuneDeviceId://{{DeviceID}}`as the **Subject alternative name**. Other NAC products might require you include a device ID when using NAC with iOS VPN profiles. -> [!NOTE] -> We have now added support for querying devices based on Mac addresses for customers who are unable to use certificate-based authentication. However, our recommendation is to use certificate-based authentication with Intune device id wherever possible. +> [!TIP] +> We recommend using certificate-based authentication with the Intune device ID wherever possible. If you're unable to use certificate-based authentication, Intune supports querying devices based on MAC addresses. -To learn more about certificate profiles, see: [Use SCEP certificate profiles with Microsoft Intune](../protect/certificates-profile-scep.md) and [Use a PKCS certificate profile to provision devices with certificates in Microsoft Intune](../protect/certificates-pfx-configure.md) +For more information about certificate profiles, see [Use SCEP certificate profiles with Microsoft Intune](../protect/certificates-profile-scep.md) and [Use a PKCS certificate profile to provision devices with certificates in Microsoft Intune](../protect/certificates-pfx-configure.md). ## Data shared with NAC partners diff --git a/memdocs/intune/protect/pradeo-mobile-threat-defense-connector.md b/memdocs/intune/protect/pradeo-mobile-threat-defense-connector.md index e2d03fa9ad3..8a0435073c9 100644 --- a/memdocs/intune/protect/pradeo-mobile-threat-defense-connector.md +++ b/memdocs/intune/protect/pradeo-mobile-threat-defense-connector.md @@ -8,7 +8,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 11/17/2023 +ms.date: 08/27/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect diff --git a/memdocs/intune/protect/pradeo-mtd-connector-integration.md b/memdocs/intune/protect/pradeo-mtd-connector-integration.md index 93f5343ae34..99b5f20e879 100644 --- a/memdocs/intune/protect/pradeo-mtd-connector-integration.md +++ b/memdocs/intune/protect/pradeo-mtd-connector-integration.md @@ -1,14 +1,14 @@ --- # required metadata -title: Set up the Pradeo integration with Intune +title: Set up Pradeo Mobile Threat Defense to integrate with Intune titleSuffix: Intune on Azure description: How to set up the Pradeo Mobile Threat Protection solution with Microsoft Intune to control mobile device access to your corporate resources. keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 11/17/2023 +ms.date: 08/27/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect diff --git a/memdocs/intune/protect/reusable-settings-groups.md b/memdocs/intune/protect/reusable-settings-groups.md index 7e00b3964d5..ad90f4b98ec 100644 --- a/memdocs/intune/protect/reusable-settings-groups.md +++ b/memdocs/intune/protect/reusable-settings-groups.md @@ -7,7 +7,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 04/08/2024 +ms.date: 08/19/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -62,11 +62,11 @@ The following profiles support use of reusable settings groups: **Endpoint security policy** - **Firewall** > **Windows Firewall rules**: - - Platforms: Windows 10, Windows 11, and Windows Server + - Platforms: Windows - Windows versions: Devices must run Windows 10 20H2 or later, or Windows 11 - **Attack surface reduction** > **Device control**: - - Platforms: Windows 10, Windows 11, and Windows Server + - Platforms: Windows **Endpoint Privilege Management** diff --git a/memdocs/intune/protect/security-baseline-settings-defender.md b/memdocs/intune/protect/security-baseline-settings-defender.md index 96e14b68150..63c246d31b5 100644 --- a/memdocs/intune/protect/security-baseline-settings-defender.md +++ b/memdocs/intune/protect/security-baseline-settings-defender.md @@ -7,7 +7,7 @@ description: View the settings in the Microsoft Intune security baseline for Mic author: brenduns ms.author: brenduns manager: dougeby -ms.date: 07/01/2024 +ms.date: 09/10/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: protect @@ -86,12 +86,12 @@ This baseline is optimized for physical devices and isn't recommended for use on Baseline default: *Enabled* [Learn more](/windows/client-management/mdm/policy-csp-deviceinstallation?WT.mc_id=Portal-fx#preventinstallationofmatchingdevicesetupclasses) + - **Prevented Classes** + Baseline default: *d48179be-ec20-11d1-b6b8-00c04fa372a7* + - **Also apply to matching devices that are already installed.** Baseline default: *False* - - **Prevented Classes** - Baseline default: *d48179be-ec20-11d1-b6b8-00c04fa372a7* - ### Windows Components > BitLocker Drive Encryption - **Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later)** @@ -161,22 +161,22 @@ This baseline is optimized for physical devices and isn't recommended for use on - **Omit recovery options from the BitLocker setup wizard** Baseline default: *True* + - **Allow data recovery agent** + Baseline default: *True* + Value: *Allow 256-bit recovery key* - - **Save BitLocker recovery information to AD DS for operating system drives** - Baseline default: *True* + - **Configure storage of BitLocker recovery information to AD DS:** + Baseline default: *Store recovery passwords and key packages* - **Do not enable BitLocker until recovery information is stored to AD DS for operating system drives** Baseline default: *True* - - **Configure user storage of BitLocker recovery information:** - Baseline default: *Allow 48-digit recovery password* - - - **Allow data recovery agent** + - **Save BitLocker recovery information to AD DS for operating system drives** Baseline default: *True* - - **Configure storage of BitLocker recovery information to AD DS:** - Baseline default: *Store recovery passwords and key packages* + - **Configure user storage of BitLocker recovery information:** + Baseline default: *Allow 48-digit recovery password* - **Enable use of BitLocker authentication requiring preboot keyboard input on slates** Baseline default: *Enabled* @@ -196,12 +196,12 @@ This baseline is optimized for physical devices and isn't recommended for use on - **Configure TPM startup key and PIN:** Baseline default: *Do not allow startup key and PIN with TPM* - - **Allow BitLocker without a compatible TPM (requires a password or a startup key on a USB flash drive)** - Baseline default: *False* - - **Configure TPM startup:** Baseline default: *Allow TPM* + - **Allow BitLocker without a compatible TPM (requires a password or a startup key on a USB flash drive)** + Baseline default: *False* + - **Configure TPM startup PIN:** Baseline default: *Allow startup PIN with TPM* @@ -340,40 +340,40 @@ This baseline is optimized for physical devices and isn't recommended for use on Baseline default: *Block* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) - - **Block JavaScript or VBScript from launching downloaded executable content** + - **Block Adobe Reader from creating child processes** Baseline default: *Block* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) - - **Block Webshell creation for Servers** + - **Block credential stealing from the Windows local security authority subsystem** Baseline default: *Block* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) - - **Block untrusted and unsigned processes that run from USB** + - **Block JavaScript or VBScript from launching downloaded executable content** Baseline default: *Block* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) - - **Block Adobe Reader from creating child processes** + - **Block Webshell creation for Servers** Baseline default: *Block* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) - - **Block credential stealing from the Windows local security authority subsystem** + - **Block untrusted and unsigned processes that run from USB** Baseline default: *Block* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) - - **Block abuse of exploited vulnerable signed drivers (Device)** - Baseline default: *Block* + - **Block persistence through WMI event subscription** + Baseline default: *Audit* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) - - **Block persistence through WMI event subscription** + - **[PREVIEW] Block use of copied or impersonated system tools** Baseline default: *Block* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) - - **[PREVIEW] Block use of copied or impersonated system tools** + - **Block abuse of exploited vulnerable signed drivers (Device)** Baseline default: *Block* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) - **Block process creations originating from PSExec and WMI commands** - Baseline default: *Block* + Baseline default: *Audit* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) - **Block Office applications from creating executable content** @@ -490,29 +490,29 @@ This baseline is optimized for physical devices and isn't recommended for use on Baseline default: *True* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoredomainprofileenablefirewall) - - **Disable Stealth Mode Ipsec Secured Packet Exemption** + - **Allow Local Ipsec Policy Merge** Baseline default: *True* - [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoredomainprofiledisablestealthmodeipsecsecuredpacketexemption) + [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoredomainprofileallowlocalipsecpolicymerge) - **Disable Stealth Mode** Baseline default: *False* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoredomainprofiledisablestealthmode) - - **Allow Local Ipsec Policy Merge** - Baseline default: *True* - [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoredomainprofileallowlocalipsecpolicymerge) - - **Disable Inbound Notifications** Baseline default: *True* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoredomainprofiledisableinboundnotifications) + - **Disable Unicast Responses To Multicast Broadcast** + Baseline default: *False* + [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoredomainprofiledisableunicastresponsestomulticastbroadcast) + - **Global Ports Allow User Pref Merge** Baseline default: *True* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoredomainprofileglobalportsallowuserprefmerge) - - **Disable Unicast Responses To Multicast Broadcast** - Baseline default: *False* - [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoredomainprofiledisableunicastresponsestomulticastbroadcast) + - **Disable Stealth Mode Ipsec Secured Packet Exemption** + Baseline default: *True* + [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoredomainprofiledisablestealthmodeipsecsecuredpacketexemption) - **Allow Local Policy Merge** Baseline default: *True* @@ -520,6 +520,7 @@ This baseline is optimized for physical devices and isn't recommended for use on - **Enable Packet Queue** Baseline default: *Configured* + Value: *Disabled* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoreglobalenablepacketqueue) - **Enable Private Network Firewall** @@ -527,7 +528,7 @@ This baseline is optimized for physical devices and isn't recommended for use on [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoreprivateprofileenablefirewall) - **Default Inbound Action for Private Profile** - Baseline default: *True* + Baseline default: *Block* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoreprivateprofiledefaultinboundaction) - **Disable Unicast Responses To Multicast Broadcast** @@ -550,6 +551,10 @@ This baseline is optimized for physical devices and isn't recommended for use on Baseline default: *True* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoreprivateprofiledisablestealthmodeipsecsecuredpacketexemption) + - **Disable Inbound Notifications** + Baseline default: *True* + [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoreprivateprofiledisableinboundnotifications) + - **Allow Local Policy Merge** Baseline default: *True* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoreprivateprofileallowlocalpolicymerge) @@ -562,10 +567,6 @@ This baseline is optimized for physical devices and isn't recommended for use on Baseline default: *True* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoreprivateprofileauthappsallowuserprefmerge) - - **Disable Inbound Notifications** - Baseline default: *True* - [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoreprivateprofiledisableinboundnotifications) - - **Enable Public Network Firewall** Baseline default: *True* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofileenablefirewall) @@ -586,30 +587,30 @@ This baseline is optimized for physical devices and isn't recommended for use on Baseline default: *True* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofiledisablestealthmodeipsecsecuredpacketexemption) - - **Default Inbound Action for Public Profile** - Baseline default: *Block* - [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofiledefaultinboundaction) - - - **Global Ports Allow User Pref Merge** - Baseline default: *True* - [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofileglobalportsallowuserprefmerge) - - **Allow Local Policy Merge** Baseline default: *True* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofileallowlocalpolicymerge) - - **Allow Local Ipsec Policy Merge** - Baseline default: *True* - [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofileallowlocalipsecpolicymerge) - - **Auth Apps Allow User Pref Merge** Baseline default: *True* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofileauthappsallowuserprefmerge) + - **Default Inbound Action for Public Profile** + Baseline default: *Block* + [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofiledefaultinboundaction) + - **Disable Unicast Responses To Multicast Broadcast** Baseline default: *False* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofiledisableunicastresponsestomulticastbroadcast) + - **Global Ports Allow User Pref Merge** + Baseline default: *True* + [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofileglobalportsallowuserprefmerge) + + - **Allow Local Ipsec Policy Merge** + Baseline default: *True* + [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofileallowlocalipsecpolicymerge) + - **Preshared Key Encoding** Baseline default: *UTF8* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoreglobalpresharedkeyencoding) diff --git a/memdocs/intune/protect/security-baseline-settings-mdm-all.md b/memdocs/intune/protect/security-baseline-settings-mdm-all.md index 21d98b083a9..6fb62ad192c 100644 --- a/memdocs/intune/protect/security-baseline-settings-mdm-all.md +++ b/memdocs/intune/protect/security-baseline-settings-mdm-all.md @@ -110,7 +110,7 @@ The settings in this baseline are taken from the **version 23H2** of the Group P Baseline default: *Enabled* [Learn more](/windows/client-management/mdm/policy-csp-msslegacy?WT.mc_id=Portal-fx#ipsourceroutingprotectionlevel) - **DisableIPSourceRouting (Device)** - Baseline default: *Enabled* *Highest protection, source routing is completely disabled* + Baseline default: *Highest protection, source routing is completely disabled* - **MSS: (EnableCMPRedirect) Allow ICMP redirects to override OSPF generated routes** Baseline default: *Disabled* diff --git a/memdocs/intune/protect/security-baseline-settings-windows-365.md b/memdocs/intune/protect/security-baseline-settings-windows-365.md index 790d37d095c..0d8ec0d26a6 100644 --- a/memdocs/intune/protect/security-baseline-settings-windows-365.md +++ b/memdocs/intune/protect/security-baseline-settings-windows-365.md @@ -7,7 +7,7 @@ description: View a list of the settings in the Microsoft Intune security baseli author: brenduns ms.author: brenduns manager: dougeby -ms.date: 07/19/2024 +ms.date: 09/10/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: protect @@ -174,10 +174,11 @@ The settings in this baseline apply to Windows devices managed through Intune. W - **Prevent installation of devices using drivers that match these device setup classes** Baseline default: *Enabled* [Learn more](/windows/client-management/mdm/policy-csp-deviceinstallation?WT.mc_id=Portal-fx#preventinstallationofmatchingdevicesetupclasses) + - **Prevented Classes** + Baseline default: *{d48179be-ec20-11d1-b6b8-00c04fa372a7}* + - **Also apply to matching devices that are already installed** Baseline default: *True* - - **Prevented Classes** - Baseline default: *{d48179be-ec20-11d1-b6b8-00c04fa372a7}* ### System > Early Launch Antimalware @@ -200,7 +201,7 @@ The settings in this baseline apply to Windows devices managed through Intune. W ### System > Internet Communication Management > Internet Communication settings -- **Turn off downloading of print drivers** +- **Turn off downloading of print drivers over HTTP** Baseline default: *Enabled* [Learn more](/windows/client-management/mdm/policy-csp-connectivity?WT.mc_id=Portal-fx#disabledownloadingofprintdriversoverhttp) @@ -208,24 +209,6 @@ The settings in this baseline apply to Windows devices managed through Intune. W Baseline default: *Enabled* [Learn more](/windows/client-management/mdm/policy-csp-connectivity?WT.mc_id=Portal-fx#disableinternetdownloadforwebpublishingandonlineorderingwizards) -### System > Power Management > Sleep Settings - -- **Allow standby states (S1-S3) when sleeping (on battery)** - Baseline default: *Disabled* - [Learn more](/windows/client-management/mdm/policy-csp-power?WT.mc_id=Portal-fx#allowstandbystateswhensleepingonbattery) - -- **Allow standby states (S1-S3) when sleeping (plugged in)** - Baseline default: *Disabled* - [Learn more](/windows/client-management/mdm/policy-csp-power?WT.mc_id=Portal-fx#allowstandbywhensleepingpluggedin) - -- **Require a password when a computer wakes (on battery)** - Baseline default: *Enabled* - [Learn more](/windows/client-management/mdm/policy-csp-power?WT.mc_id=Portal-fx#requirepasswordwhencomputerwakesonbattery) - -- **Require a password when a computer wakes (plugged in)** - Baseline default: *Enabled* - [Learn more](/windows/client-management/mdm/policy-csp-power?WT.mc_id=Portal-fx#requirepasswordwhencomputerwakespluggedin) - ### System > Remote Assistance - **Configure Solicited Remote Assistance** @@ -264,28 +247,6 @@ The settings in this baseline apply to Windows devices managed through Intune. W - **Turn off Autoplay on:** Baseline default: *All drives* -### Windows Components > BitLocker Drive Encryption > Fixed Data Drives - -> [!NOTE] -> -> The default configuration of the following setting will apply to all managed Windows 365 PCs as Windows 365 PC’s do no support use of BitLocker as an encryption option. For more information, see [Data encryption in Windows 365](/windows-365/enterprise/encryption) in the Windows Security documentation. - -- **Deny write access to fixed drives not protected by BitLocker** - Baseline default: *Disabled* - [Learn more](/windows/client-management/mdm/bitlocker-csp?WT.mc_id=Portal-fx#fixeddrivesrequireencryption) - -### Windows Components > BitLocker Drive Encryption > Removable Data Drives - -> [!NOTE] -> -> The default configuration of the following setting will apply to all managed Windows 365 PCs as Windows 365 PC’s do no support use of BitLocker as an encryption option. For more information, see [Data encryption in Windows 365](/windows-365/enterprise/encryption) in the Windows Security documentation. - -- **Deny write access to removable drives not protected by BitLocker** - Baseline default: *Enabled* - [Learn more](/windows/client-management/mdm/bitlocker-csp?WT.mc_id=Portal-fx#removabledrivesrequireencryption) - - **Do not allow write access to devices configured in another organization** - Baseline default: *False* - ### Windows Components > Credential User Interface - **Enumerate administrator accounts on elevation** @@ -1222,28 +1183,6 @@ The settings in this baseline apply to Windows devices managed through Intune. W Baseline default: *Success+ Failure* [Learn more](/windows/client-management/mdm/policy-csp-Audit?WT.mc_id=Portal-fx#system_auditsystemintegrity) -## Browser - -- **Allow Password Manager** - Baseline default: *Block* - [Learn more](/windows/client-management/mdm/policy-csp-Browser?WT.mc_id=Portal-fx#allowpasswordmanager) - -- **Allow Smart Screen** - Baseline default: *Allow* - [Learn more](/windows/client-management/mdm/policy-csp-Browser?WT.mc_id=Portal-fx#allowsmartscreen) - -- **Prevent Cert Error Overrides** - Baseline default: *Enabled* - [Learn more](/windows/client-management/mdm/policy-csp-Browser?WT.mc_id=Portal-fx#preventcerterroroverrides) - -- **Prevent Smart Screen Prompt Override** - Baseline default: *Enabled* - [Learn more](/windows/client-management/mdm/policy-csp-Browser?WT.mc_id=Portal-fx#preventsmartscreenpromptoverride) - -- **Prevent Smart Screen Prompt Override For Files** - Baseline default: *Enabled* - [Learn more](/windows/client-management/mdm/policy-csp-Browser?WT.mc_id=Portal-fx#preventsmartscreenpromptoverrideforfiles) - ## Data Protection - **Allow Direct Memory Access** @@ -1283,36 +1222,47 @@ The settings in this baseline apply to Windows devices managed through Intune. W - **Allow Script Scanning** Baseline default: *Allowed.* [Learn more](/windows/client-management/mdm/policy-csp-defender?WT.mc_id=Portal-fx#allowscriptscanning) + - **Block execution of potentially obfuscated scripts** Baseline default: *Block* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) + - **Block Win32 API calls from Office macros** Baseline default: *Block* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) + - **Block Office communication application from creating child processes** Baseline default: *Block* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) + - **Block all Office applications from creating child processes** Baseline default: *Block* - [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) - - **Block JavaScript or VBScript from launching downloaded executable content** + [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) + + - **Block Adobe Reader from creating child processes** Baseline default: *Block* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) - - **Block untrusted and unsigned processes that run from USB** + + - **Block credential stealing from the Windows local security authority subsystem** Baseline default: *Block* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) - - **Block Adobe Reader from creating child processes** + + - **Block JavaScript or VBScript from launching downloaded executable content** Baseline default: *Block* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) - - **Block credential stealing from the Windows local security authority subsystem** + + - **Block untrusted and unsigned processes that run from USB** Baseline default: *Block* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) + - **Block Office applications from creating executable content** Baseline default: *Block* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) + - **Block Office applications from injecting code into other processes** Baseline default: *Block* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) + - **Block executable content from email client and webmail** Baseline default: *Block* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) @@ -1377,10 +1327,12 @@ The settings in this baseline apply to Windows devices managed through Intune. W - **Device Password Enabled** Baseline default: *Enabled* [Learn more](/windows/client-management/mdm/policy-csp-devicelock?WT.mc_id=Portal-fx#devicepasswordenabled) + - **Device Password History** Baseline default: *Configured* Value: *24* [Learn more](/windows/client-management/mdm/policy-csp-devicelock?WT.mc_id=Portal-fx#devicepasswordhistory) + - **Min Device Password Length** Baseline default: *Configured* Value: *14* @@ -1397,9 +1349,11 @@ The settings in this baseline apply to Windows devices managed through Intune. W - **Allow Windows Spotlight (User)** Baseline default: *Allow* [Learn more](/windows/client-management/mdm/policy-csp-Experience?WT.mc_id=Portal-fx#allowwindowsspotlight) + - **Allow Windows Consumer Features** Baseline default: *Allow* [Learn more](/windows/client-management/mdm/policy-csp-experience?WT.mc_id=Portal-fx#allowwindowsconsumerfeatures) + - **Allow Third Party Suggestions In Windows Spotlight (User)** Baseline default: *Block* [Learn more](/windows/client-management/mdm/policy-csp-Experience?WT.mc_id=Portal-fx#allowthirdpartysuggestionsinwindowsspotlight) @@ -1409,74 +1363,94 @@ The settings in this baseline apply to Windows devices managed through Intune. W - **Enable Domain Network Firewall** Baseline default: *True* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoredomainprofileenablefirewall) - - **Enable Log Success Connections** - Baseline default: *Enable Logging Of Successful Connections* - [Learn more](/windows/client-management/mdm/Firewall-csp/?WT.mc_id=Portal-fx#mdmstoredomainprofileenablelogsuccessconnections) - - **Default Outbound Action** - Baseline default: *Allow* - [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoredomainprofiledefaultoutboundaction) + - **Enable Log Dropped Packets** Baseline default: *Enable Logging Of Dropped Packets* [Learn more](/windows/client-management/mdm/Firewall-csp/?WT.mc_id=Portal-fx#mdmstoredomainprofileenablelogdroppedpackets) + + - **Default Outbound Action** + Baseline default: *Allow* + [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoredomainprofiledefaultoutboundaction) + - **Disable Inbound Notifications** Baseline default: *True* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoredomainprofiledisableinboundnotifications) + - **Log Max File Size** Baseline default: *Configured* Value: *16384* [Learn more](/windows/client-management/mdm/Firewall-csp/?WT.mc_id=Portal-fx#mdmstoredomainprofilelogmaxfilesize) + - **Default Inbound Action for Domain Profile** Baseline default: *Block* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoredomainprofiledefaultinboundaction) + - **Enable Log Success Connections** + Baseline default: *Enable Logging Of Successful Connections* + [Learn more](/windows/client-management/mdm/Firewall-csp/?WT.mc_id=Portal-fx#mdmstoredomainprofileenablelogsuccessconnections) + - **Enable Private Network Firewall** Baseline default: *True* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoreprivateprofileenablefirewall) + - **Log Max File Size** Baseline default: *Configured* Value: *16384* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoreprivateprofilelogmaxfilesize) + - **Default Inbound Action for Private Profile** Baseline default: *Block* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoreprivateprofiledefaultinboundaction) + - **Enable Log Success Connections** Baseline default: *Enable Logging Of Successful Connections* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoreprivateprofileenablelogsuccessconnections) + - **Enable Log Dropped Packets** Baseline default: *Enable Logging Of Dropped Packets* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoreprivateprofileenablelogdroppedpackets) - - **Default Outbound Action** - Baseline default: *Allow* - [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoreprivateprofiledefaultoutboundaction) + - **Disable Inbound Notifications** Baseline default: *True* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoreprivateprofiledisableinboundnotifications) + - **Default Outbound Action** + Baseline default: *Allow* + [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoreprivateprofiledefaultoutboundaction) + - **Enable Public Network Firewall** Baseline default: *True* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofileenablefirewall) + - **Enable Log Dropped Packets** Baseline default: *Enable Logging Of Dropped Packets* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofileenablelogdroppedpackets) + - **Log Max File Size** Baseline default: *Configured* Value: *16384* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofilelogmaxfilesize) + - **Default Outbound Action** Baseline default: *Allow* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofiledefaultoutboundaction) + - **Disable Inbound Notifications** Baseline default: *True* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofiledisableinboundnotifications) - - **Default Inbound Action for Public Profile** - Baseline default: *Block* - [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofiledefaultinboundaction) + - **Allow Local Policy Merge** Baseline default: *False* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofileallowlocalpolicymerge) + + - **Default Inbound Action for Public Profile** + Baseline default: *Block* + [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofiledefaultinboundaction) + - **Enable Log Success Connections** Baseline default: *Enable Logging Of Successful Connections* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofileenablelogsuccessconnections) + - **Allow Local Ipsec Policy Merge** Baseline default: *False* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofileallowlocalipsecpolicymerge) @@ -1487,94 +1461,6 @@ The settings in this baseline apply to Windows devices managed through Intune. W Baseline default: *Disabled* [Learn more](/windows/client-management/mdm/policy-csp-LanmanWorkstation?WT.mc_id=Portal-fx#enableinsecureguestlogons) -## Local Policies Security Options - -- **Accounts Limit Local Account Use Of Blank Passwords To Console Logon Only** - Baseline default: *Enabled* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#accounts_limitlocalaccountuseofblankpasswordstoconsolelogononly) - -- **Interactive Logon Machine Inactivity Limit** - Baseline default: *Configured* - Value: *900* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#interactivelogon_machineinactivitylimit) - -- **Interactive Logon Smart Card Removal Behavior** - Baseline default: *Lock Workstation* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#interactivelogon_smartcardremovalbehavior) - -- **Microsoft Network Client Digitally Sign Communications Always** - Baseline default: *Enable* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#microsoftnetworkclient_digitallysigncommunicationsalways) - -- **Microsoft Network Client Send Unencrypted Password To Third Party SMB Servers** - Baseline default: *Disable* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#microsoftnetworkclient_sendunencryptedpasswordtothirdpartysmbservers) - -- **Microsoft Network Server Digitally Sign Communications Always** - Baseline default: *Enable* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#microsoftnetworkserver_digitallysigncommunicationsalways) - -- **Network Access Do Not Allow Anonymous Enumeration Of SAM Accounts** - Baseline default: *Enabled* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#networkaccess_donotallowanonymousenumerationofsamaccounts) - -- **Network Access Do Not Allow Anonymous Enumeration Of Sam Accounts And Shares** - Baseline default: *Enabled* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#networkaccess_donotallowanonymousenumerationofsamaccountsandshares) - -- **Network Access Restrict Anonymous Access To Named Pipes And Shares** - Baseline default *Enable* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#networkaccess-restrictanonymousaccesstonamedpipesandshares) - -- **Network Access Restrict Clients Allowed To Make Remote Calls To SAM** - Baseline default: *Configured* - Value: *O:BAG:BAD:(A;;RC;;;BA)* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#networkaccess_restrictclientsallowedtomakeremotecallstosam) - -- **Network Security Do Not Store LAN Manager Hash Value On Next Password Change** - Baseline default: *Enable* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#networksecurity_donotstorelanmanagerhashvalueonnextpasswordchange) - -- **Network Security LAN Manager Authentication Level** - Baseline default: *Send LM and NTLMv2 responses only. Refuse LM and NTLM* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#networksecurity_lanmanagerauthenticationlevel) - -- **Network Security Minimum Session Security For NTLMSSP Based Clients** - Baseline default: *Require NTLM and 128-bit encryption* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#networksecurity_minimumsessionsecurityforntlmsspbasedclients) - -- **Network Security Minimum Session Security For NTLMSSP Based Servers** - Baseline default: *Require NTLM and 128-bit encryption* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#networksecurity_minimumsessionsecurityforntlmsspbasedservers) - -- **User Account Control Behavior Of The Elevation Prompt For Administrators** - Baseline default: *Prompt for consent on the secure desktop* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#useraccountcontrol_behavioroftheelevationpromptforadministrators) - -- **User Account Control Behavior Of The Elevation Prompt For Standard Users** - Baseline default: *Automatically deny elevation requests* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#useraccountcontrol_behavioroftheelevationpromptforstandardusers) - -- **User Account Control Detect Application Installations And Prompt For Elevation** - Baseline default: *Enable* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#useraccountcontrol-detectapplicationinstallationsandpromptforelevation) - -- **User Account Control Only Elevate UI Access Applications That Are Installed In Secure Locations** - Baseline default: *Enabled: Application runs with UIAccess integrity only if it resides in secure location.* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#useraccountcontrol-onlyelevateuiaccessapplicationsthatareinstalledinsecurelocations) - -- **User Account Control Run All Administrators In Admin Approval Mode** - Baseline default: *Enabled* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#useraccountcontrol_runalladministratorsinadminapprovalmode) - -- **User Account Control Use Admin Approval Mode** - Baseline default: *Enable* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#useraccountcontrol_useadminapprovalmode) - -- **User Account Control Virtualize File And Registry Write Failures To Per User Locations** - Baseline default: *Enabled* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#useraccountcontrol_virtualizefileandregistrywritefailurestoperuserlocations) - ## Local Security Authority - **Configure Lsa Protected Process** @@ -1607,11 +1493,13 @@ The settings in this baseline apply to Windows devices managed through Intune. W - **Minimum TLS version enabled** Baseline default: *Enabled* + - **Minimum TLS version enabled (Device)** Baseline default: *TlS 1.2* - **Minimum TLS version enabled (User)** Baseline default: *Enabled* + - **Minimum TLS version enabled (User)** Baseline default: *TLS 1.2* @@ -1659,30 +1547,6 @@ The settings in this baseline apply to Windows devices managed through Intune. W - **Service Enabled** Baseline default: *Enabled* -## System Services - -- **Configure Xbox Accessory Management Service Startup Mode** - Baseline default: *Disabled* - [Learn more](/windows/client-management/mdm/policy-csp-SystemServices?WT.mc_id=Portal-fx#configurexboxaccessorymanagementservicestartupmode) - -- **Configure Xbox Live Auth Manager Service Startup Mode** - Baseline default: *Disabled* - [Learn more](/windows/client-management/mdm/policy-csp-SystemServices?WT.mc_id=Portal-fx#configurexboxliveauthmanagerservicestartupmode) - -- **Configure Xbox Live Game Save Service Startup Mode** - Baseline default: *Disabled* - [Learn more](/windows/client-management/mdm/policy-csp-SystemServices?WT.mc_id=Portal-fx#configurexboxlivegamesaveservicestartupmode) - -- **Configure Xbox Live Networking Service Startup Mode** - Baseline default: *Disabled* - [Learn more](/windows/client-management/mdm/policy-csp-SystemServices?WT.mc_id=Portal-fx#configurexboxlivenetworkingservicestartupmode) - -## Task Scheduler - -- **Enable Xbox Game Save Task** - Baseline default: *Disabled* - [Learn more](/windows/client-management/mdm/policy-csp-TaskScheduler?WT.mc_id=Portal-fx#enablexboxgamesavetask) - ## User Rights - **Access From Network** @@ -1801,22 +1665,99 @@ The settings in this baseline apply to Windows devices managed through Intune. W Baseline default: *(Enabled with UEFI lock) Turns on Hypervisor-Protected Code Integrity with UEFI lock.* [Learn more](/windows/client-management/mdm/policy-csp-VirtualizationBasedTechnology?WT.mc_id=Portal-fx#hypervisorenforcedcodeintegrity) -## Wi-Fi Settings - -- **Allow Auto Connect To Wi Fi Sense Hotspots** - Baseline default: *Block* - [Learn more](/windows/client-management/mdm/policy-csp-wifi?WT.mc_id=Portal-fx#allowautoconnecttowifisensehotspots) - -- **Allow Internet Sharing** - Baseline default: *Block* - [Learn more](/windows/client-management/mdm/policy-csp-wifi?WT.mc_id=Portal-fx#allowinternetsharing) - ## Windows Ink Workspace - **Allow Windows Ink Workspace** Baseline default: *Ink workspace is enabled (feature is turned on), but the user cannot access it above the lock screen.* [Learn more](/windows/client-management/mdm/policy-csp-WindowsInkWorkspace?WT.mc_id=Portal-fx#allowwindowsinkworkspace) +## Local Policies Security Options + +- **Accounts Limit Local Account Use Of Blank Passwords To Console Logon Only** + Baseline default: *Enabled* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#accounts_limitlocalaccountuseofblankpasswordstoconsolelogononly) + +- **Interactive Logon Machine Inactivity Limit** + Baseline default: *Configured* + Value: *900* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#interactivelogon_machineinactivitylimit) + +- **Interactive Logon Smart Card Removal Behavior** + Baseline default: *Lock Workstation* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#interactivelogon_smartcardremovalbehavior) + +- **Microsoft Network Client Digitally Sign Communications Always** + Baseline default: *Enable* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#microsoftnetworkclient_digitallysigncommunicationsalways) + +- **Microsoft Network Client Send Unencrypted Password To Third Party SMB Servers** + Baseline default: *Disable* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#microsoftnetworkclient_sendunencryptedpasswordtothirdpartysmbservers) + +- **Microsoft Network Server Digitally Sign Communications Always** + Baseline default: *Enable* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#microsoftnetworkserver_digitallysigncommunicationsalways) + +- **Network Access Do Not Allow Anonymous Enumeration Of SAM Accounts** + Baseline default: *Enabled* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#networkaccess_donotallowanonymousenumerationofsamaccounts) + +- **Network Access Do Not Allow Anonymous Enumeration Of Sam Accounts And Shares** + Baseline default: *Enabled* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#networkaccess_donotallowanonymousenumerationofsamaccountsandshares) + +- **Network Access Restrict Anonymous Access To Named Pipes And Shares** + Baseline default *Enable* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#networkaccess-restrictanonymousaccesstonamedpipesandshares) + +- **Network Access Restrict Clients Allowed To Make Remote Calls To SAM** + Baseline default: *Configured* + Value: *O:BAG:BAD:(A;;RC;;;BA)* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#networkaccess_restrictclientsallowedtomakeremotecallstosam) + +- **Network Security Do Not Store LAN Manager Hash Value On Next Password Change** + Baseline default: *Enable* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#networksecurity_donotstorelanmanagerhashvalueonnextpasswordchange) + +- **Network Security LAN Manager Authentication Level** + Baseline default: *Send LM and NTLMv2 responses only. Refuse LM and NTLM* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#networksecurity_lanmanagerauthenticationlevel) + +- **Network Security Minimum Session Security For NTLMSSP Based Clients** + Baseline default: *Require NTLM and 128-bit encryption* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#networksecurity_minimumsessionsecurityforntlmsspbasedclients) + +- **Network Security Minimum Session Security For NTLMSSP Based Servers** + Baseline default: *Require NTLM and 128-bit encryption* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#networksecurity_minimumsessionsecurityforntlmsspbasedservers) + +- **User Account Control Behavior Of The Elevation Prompt For Administrators** + Baseline default: *Prompt for consent on the secure desktop* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#useraccountcontrol_behavioroftheelevationpromptforadministrators) + +- **User Account Control Behavior Of The Elevation Prompt For Standard Users** + Baseline default: *Automatically deny elevation requests* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#useraccountcontrol_behavioroftheelevationpromptforstandardusers) + +- **User Account Control Detect Application Installations And Prompt For Elevation** + Baseline default: *Enable* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#useraccountcontrol-detectapplicationinstallationsandpromptforelevation) + +- **User Account Control Only Elevate UI Access Applications That Are Installed In Secure Locations** + Baseline default: *Enabled: Application runs with UIAccess integrity only if it resides in secure location.* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#useraccountcontrol-onlyelevateuiaccessapplicationsthatareinstalledinsecurelocations) + +- **User Account Control Run All Administrators In Admin Approval Mode** + Baseline default: *Enabled* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#useraccountcontrol_runalladministratorsinadminapprovalmode) + +- **User Account Control Use Admin Approval Mode** + Baseline default: *Enable* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#useraccountcontrol_useadminapprovalmode) + +- **User Account Control Virtualize File And Registry Write Failures To Per User Locations** + Baseline default: *Enabled* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#useraccountcontrol_virtualizefileandregistrywritefailurestoperuserlocations) ::: zone-end ::: zone pivot="win365-nov21" diff --git a/memdocs/intune/protect/security-baselines-configure.md b/memdocs/intune/protect/security-baselines-configure.md index 38b6690fae9..fe4712dd0c4 100644 --- a/memdocs/intune/protect/security-baselines-configure.md +++ b/memdocs/intune/protect/security-baselines-configure.md @@ -181,9 +181,9 @@ With the information from the export, you can rapidly reconfigure the new baseli :::image type="content" source="./media/security-baselines-configure/csv-export-of-baseline-configuration.png" alt-text="Screen shot that shows an export of the Microsoft Edge baseline profile as a .csv file." lightbox="./media/security-baselines-configure/csv-export-of-baseline-configuration.png"::: - In the preceding image, there are three columns of information. The information identifies the settings in the new profile, and the configuration for each of them that you had in the old profile. + In the preceding image, there are three columns of information. The information identifies the settings in the old profile, and the configuration for each of them that you had in the old profile. - - **DefinitionId** – This column displays the settings registry name. The information after the underscore ( _ ) identifies the settings name as it appears in the new baseline profile and format, but without spaces in the name. This value is also the name of the CSP setting that this baseline setting manages. + - **DefinitionId** – This column displays the settings registry name. The information after the underscore ( _ ) identifies the settings name as it appears in the old baseline profile and format, but without spaces in the name. This value is also the name of the CSP setting that this baseline setting manages. For example, our modified setting of *Enable site isolation for every site* appears in this export as *admx--microsoftedge_SitePerProcess*. The last portion, *SitePerProcess*, helps identify the setting. diff --git a/memdocs/intune/protect/security-baselines-monitor.md b/memdocs/intune/protect/security-baselines-monitor.md index 9358b2cdccc..9884caaf3bc 100644 --- a/memdocs/intune/protect/security-baselines-monitor.md +++ b/memdocs/intune/protect/security-baselines-monitor.md @@ -1,18 +1,18 @@ --- # required metadata -title: Check for the success or failure of security baselines in Microsoft Intune -description: Monitor the device and per-setting results of security baselines you deploy with Microsoft Intune, and identify when multiple baselines that apply to the same device result in conflicts. +title: Monitor security baselines deployed by Microsoft Intune +description: Monitor device and per-setting results of security baselines you deploy with Microsoft Intune, and identify conflicts for devices. keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 10/09/2023 +ms.date: 08/22/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect ms.localizationpriority: high -ms.assetid: +ms.assetid: # optional metadata @@ -55,7 +55,7 @@ For more information about the feature, see [Security baselines in Intune](secur > > The following information applies to profile versions released in May 2023 or later. To view information for profile versions released prior to May 2023, see [Monitor profiles for baseline versions released before May 2023](#monitor-profiles-for-baseline-versions-released-before-may-2023), later in this article. -When you select a security baseline profile that you’ve deployed, you can gain insights into the security state of devices that received that baseline. To view these insights, sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Endpoint security** > **Security baselines** and select a security baseline type like the *Microsoft 365 Apps for Enterprise Security Baseline*. Then, from the *Profiles* pane, select the profile instance for which you want to view details to open the profiles dashboard view. +When you select a security baseline profile that you've deployed, you can gain insights into the security state of devices that received that baseline. To view these insights, sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Endpoint security** > **Security baselines** and select a security baseline type like the *Microsoft 365 Apps for Enterprise Security Baseline*. Then, from the *Profiles* pane, select the profile instance for which you want to view details to open the profiles dashboard view. :::image type="content" source="./media/security-baselines-monitor/view-baseline-policy-details.png" alt-text="View the dashboard for a security baseline profile."::: @@ -84,7 +84,7 @@ You can filter this report view for specific *Assignment status* values, and the If you select the name of a device from the *Device name* column, Intune displays the *Profile Settings* view where you can view that devices status results for each setting in the security baseline. Next, from the Profile Settings page, you can select a setting to view more details, which is useful when a device reports a result for any setting other than *Succeeded*. -In the following image, we have drilled in on EAGLE003, the only device to show success for the baseline, and then selected the setting *Add-on Management*: +In the following image, we drill in on EAGLE003, the only device to show success for the baseline, and then selected the setting *Add-on Management*: :::image type="content" source="./media/security-baselines-monitor/drill-in-for-setting-details-pane.png" alt-text="View a devices' reported status for each setting in the baseline."::: @@ -92,7 +92,7 @@ On the settings Setting Details pane, we can see each profile that is assigned t For this device, there's only one source profile that manages the Add-on-management setting. If there were other profiles that configured this setting, those profiles would also be listed as a Source Profile. -Should this setting have been in conflict, this view can help you identify the other profiles so you can then reconcile a consistent configuration, or later baseline profile assignments to remove the conflict. +Should this setting be in conflict, this view can help you identify the other profiles so you can then reconcile a consistent configuration, or later baseline profile assignments to remove the conflict. ### Device assignment status report diff --git a/memdocs/intune/protect/skycure-mobile-threat-defense-connector.md b/memdocs/intune/protect/skycure-mobile-threat-defense-connector.md index 40f5c098709..c357fd72dd1 100644 --- a/memdocs/intune/protect/skycure-mobile-threat-defense-connector.md +++ b/memdocs/intune/protect/skycure-mobile-threat-defense-connector.md @@ -8,7 +8,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 11/17/2023 +ms.date: 08/27/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -46,6 +46,7 @@ You can control mobile device access to corporate resources using Conditional Ac You can enable SEP Mobile risk assessment through Intune device compliance policies, and then use Conditional Access policies to allow or block noncompliant device access to corporate resources based on detected threats. > [!NOTE] +> > This Mobile Threat Defense vendor is not supported for unenrolled devices. ## Supported platforms diff --git a/memdocs/intune/protect/skycure-mtd-connector-integration.md b/memdocs/intune/protect/skycure-mtd-connector-integration.md index 3bc2c38f744..f1a336fe5af 100644 --- a/memdocs/intune/protect/skycure-mtd-connector-integration.md +++ b/memdocs/intune/protect/skycure-mtd-connector-integration.md @@ -8,7 +8,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 11/17/2023 +ms.date: 08/27/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect diff --git a/memdocs/intune/protect/sophos-mtd-connector-integration.md b/memdocs/intune/protect/sophos-mtd-connector-integration.md index 28400cdfbb4..7e2e31e8fd7 100644 --- a/memdocs/intune/protect/sophos-mtd-connector-integration.md +++ b/memdocs/intune/protect/sophos-mtd-connector-integration.md @@ -8,7 +8,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 11/17/2023 +ms.date: 08/27/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect diff --git a/memdocs/intune/protect/sophos-mtd-connector.md b/memdocs/intune/protect/sophos-mtd-connector.md index adee8a1b205..f146c29cef6 100644 --- a/memdocs/intune/protect/sophos-mtd-connector.md +++ b/memdocs/intune/protect/sophos-mtd-connector.md @@ -8,7 +8,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 11/29/2023 +ms.date: 08/27/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect diff --git a/memdocs/intune/protect/trellix-mobile-threat-defense-connector.md b/memdocs/intune/protect/trellix-mobile-threat-defense-connector.md index 9f2f4284fbf..f4cf2248900 100644 --- a/memdocs/intune/protect/trellix-mobile-threat-defense-connector.md +++ b/memdocs/intune/protect/trellix-mobile-threat-defense-connector.md @@ -8,7 +8,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 10/18/2023 +ms.date: 08/23/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect diff --git a/memdocs/intune/protect/trellix-mtd-connector-integration.md b/memdocs/intune/protect/trellix-mtd-connector-integration.md index b1e33572b89..f30f57b5bfd 100644 --- a/memdocs/intune/protect/trellix-mtd-connector-integration.md +++ b/memdocs/intune/protect/trellix-mtd-connector-integration.md @@ -8,7 +8,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 10/18/2023 +ms.date: 08/23/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect diff --git a/memdocs/intune/protect/trend-micro-mobile-threat-defense-connector.md b/memdocs/intune/protect/trend-micro-mobile-threat-defense-connector.md index 9fb012e548a..d5f89cf7559 100644 --- a/memdocs/intune/protect/trend-micro-mobile-threat-defense-connector.md +++ b/memdocs/intune/protect/trend-micro-mobile-threat-defense-connector.md @@ -7,7 +7,7 @@ description: How to set up Trend Micro Mobile Threat Defense with with Microsoft author: brenduns ms.author: brenduns manager: dougeby -ms.date: 11/17/2023 +ms.date: 08/27/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -41,11 +41,10 @@ Control mobile device access to corporate resources using Conditional Access bas You can configure Conditional Access policies based on Trend Micro Mobile Security as a Service’s risk assessment, enabled through Intune device compliance policies for enrolled devices. You can set up your policies to allow or block noncompliant devices from accessing corporate resources based on detected threats. - +For more information about how to integrate Trend Micro with Microsoft Intune, see [Setting up Intune integration](https://docs.trendmicro.com/documentation/article/trend-vision-one-setting-up-intune-integration) in the Trend Micro Mobile Security documentation. > [!NOTE] +> > This Mobile Threat Defense vendor is not supported for unenrolled devices. ## Supported platforms diff --git a/memdocs/intune/protect/trend-micro-mtd-connector-integration.md b/memdocs/intune/protect/trend-micro-mtd-connector-integration.md index 756a0513de3..4da03b856db 100644 --- a/memdocs/intune/protect/trend-micro-mtd-connector-integration.md +++ b/memdocs/intune/protect/trend-micro-mtd-connector-integration.md @@ -8,7 +8,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 11/17/2023 +ms.date: 08/27/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -33,7 +33,7 @@ ms.collection: # Connect Trend Micro Mobile Security as a Service with Microsoft Intune -Connect Trend Micro Mobile Security as a Service to monitor and mitigate device risk levels on Intune-managed devices. Trend Micro Mobile Security as a Service works by reporting device risk levels to Microsoft Intune. Intune then uses that information to enforce the appropriate app configuration and risk assessment policies. For more information about Trend Micro Mobile Security as a Service, see [Getting Started with Mobile Security](https://docs.trendmicro.com/en-us/enterprise/trend-vision-one/mobile-security/getting-started-with_003.aspx) in the Trend Micro documentation. +Connect Trend Micro Mobile Security as a Service to monitor and mitigate device risk levels on Intune-managed devices. Trend Micro Mobile Security as a Service works by reporting device risk levels to Microsoft Intune. Intune then uses that information to enforce the appropriate app configuration and risk assessment policies. For more information about Trend Micro Mobile Security as a Service, see [Getting Started with Mobile Security](https://docs.trendmicro.com/documentation/article/trend-vision-one-getting-started-mobile-security) in the Trend Micro documentation. This article describes the requirements and steps to connect Trend Micro Mobile Security as a Service in your tenant. @@ -72,7 +72,7 @@ The configuration of Trend Micro Mobile Security as a Service and Intune integra 2. **Select groups to install Trend Micro Mobile Security as a Service mobile app.** - Trend Micro Mobile Security as a Service mobile app installs automatically on devices in the selected groups. -3. **(Optional) Create mobile policies.** - Optionally create customized mobile security policies provided by Trend Micro Mobile Security as a Service. For more information, see [Configuring Mobile Policies](https://docs.trendmicro.com/en-us/enterprise/trend-micro-xdr-help/configuringmobilepolicy). +3. **(Optional) Create mobile policies.** - Optionally create customized mobile security policies provided by Trend Micro Mobile Security as a Service. For more information, see [Configuring Mobile Policies](https://docs.trendmicro.com/enterprise/trend-micro-xdr-help/configuringmobilepolicy). 4. **Confirm mobile app status update.** @@ -90,5 +90,5 @@ The configuration of Trend Micro Mobile Security as a Service and Intune integra ## Next steps -- [Customize Mobile Policies in Trend Micro Mobile Security as a Service](https://docs.trendmicro.com/en-us/enterprise/trend-vision-one/mobile-security/integration-with-mdm/mobile-policy/configuring-mobile-p.aspx) +- [Customize Mobile Policies in Trend Micro Mobile Security as a Service](https://docs.trendmicro.com/documentation/article/trend-vision-one-configuring-mobile-policies) - [Create Mobile Threat Defense (MTD) device compliance policy with Intune](../protect/mtd-device-compliance-policy-create.md) diff --git a/memdocs/intune/protect/windows-10-feature-updates.md b/memdocs/intune/protect/windows-10-feature-updates.md index 3c27dbd421f..a2259010983 100644 --- a/memdocs/intune/protect/windows-10-feature-updates.md +++ b/memdocs/intune/protect/windows-10-feature-updates.md @@ -7,7 +7,7 @@ keywords: author: Smritib17 ms.author: smbhardwaj manager: dougeby -ms.date: 07/15/2024 +ms.date: 09/10/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -203,7 +203,6 @@ For more information about WPJ limitations for Intune Windows Update policies, s 5. Under **Review + create**, review the settings. When ready to save the Feature updates policy, select **Create**. - ## Upgrade devices to Windows 11 You can use policy for *Feature updates for Windows 10 and later* to upgrade devices that run Windows 10 to Windows 11. @@ -245,7 +244,7 @@ You cannot set the checkbox for an existing policy because changing the checkbox - Deploying an older Windows version to a device won't downgrade the device. Devices only install an update when it's newer than the devices current version. - Deploying a Windows 11 update to a Windows 10 device that supports Windows 11, [upgrades that device](#upgrade-devices-to-windows-11). -## Update behavior when multiple policies target a device: +## Update behavior when multiple policies target a device Consider the following points when feature update policies target a device with more than one update policy, or target a Windows 10 device with an update for Windows 11: @@ -257,6 +256,9 @@ Consider the following points when feature update policies target a device with - Using the checkbox **When a device isn't capable of running Windows 11, install the latest Windows 10 feature update** when using multiple policies avoids the problems mentioned in this section and configures the service to detect when the Windows 11 is not eligible for a device and instead offers the latest Windows 10 feature update. +> [!NOTE] +> If you create two policies with the same device/s, where one is set to **Required** and the other set to **Optional** and both policies target the same feature update version, then the update is offered as **Required**. + ## Manage Feature updates for Windows 10 and later policy In the admin center, go to **Devices** > **By platform** > **Windows** > **Manage updates** > **Windows 10 and later updates** > **Feature updates** tab to view your profiles. diff --git a/memdocs/intune/protect/windows-driver-updates-overview.md b/memdocs/intune/protect/windows-driver-updates-overview.md index 5153051df3d..523c4f1e63f 100644 --- a/memdocs/intune/protect/windows-driver-updates-overview.md +++ b/memdocs/intune/protect/windows-driver-updates-overview.md @@ -7,7 +7,7 @@ keywords: author: Smritib17 ms.author: smbhardwaj manager: dougeby -ms.date: 07/15/2024 +ms.date: 09/10/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -250,6 +250,7 @@ To help avoid issues that require rolling back a driver from large numbers of de ### Why do my devices have driver updates installed that didn't pass through an updates policy? - These are likely *extension* drivers, which are "sub drivers" that a main driver can reference to be installed when the main driver is installed or updated. Extension drivers show up in the installed drivers or update history on the device, but aren't directly manageable. Because extension drivers don't function without base drivers, it's safe to allow them to install. +- Plug and Play can also install drivers automatically. When Windows detects new hardware or software (such as a mouse, keyboard, or webcam) without an existing driver, it installs the latest driver to ensure the component functions immediately. After the initial installation, any future updates to these drivers will require approval. ### How quickly are paused updates actually paused? diff --git a/memdocs/intune/protect/zebra-lifeguard-ota-integration.md b/memdocs/intune/protect/zebra-lifeguard-ota-integration.md index 7316e350b02..6117dd445ec 100644 --- a/memdocs/intune/protect/zebra-lifeguard-ota-integration.md +++ b/memdocs/intune/protect/zebra-lifeguard-ota-integration.md @@ -111,6 +111,9 @@ In the Microsoft Intune admin center, you can link Intune and Zebra. 6. After the authorization process is complete, an enrollment token will auto-populate within the context panel. If the token doesn't appear, select **Refresh**. Copy the enrollment token to your clipboard, as you'll need the token later. + > [!NOTE] + > Before you select **Copy** from the context panel, make sure to select **Show Token**. Not doing this will send asterisks to your clipboard rather than the token value. + ## Step 2: Enroll Devices with Zebra LG OTA Service You must enroll devices separately with the Zebra LG OTA service before devices can be updated. We recommend that you identify which devices need to be updated and used with LG OTA. Then create a group containing only those devices, to make the enrollment process easier. @@ -304,4 +307,4 @@ By selecting the **More (…)** menu next to a deployment, or by selecting the d ## Disconnecting Zebra connector 1. Go to **Tenant admin** > **Connectors and tokens** > **Firmware over-the-air**. -2. Select **Disconnect** and confirm the disconnection. This disconnects your Intune tenant from Zebra and existing deployments will not be affected. \ No newline at end of file +2. Select **Disconnect** and confirm the disconnection. This disconnects your Intune tenant from Zebra and existing deployments will not be affected. diff --git a/memdocs/intune/protect/zimperium-mtd-connector-integration.md b/memdocs/intune/protect/zimperium-mtd-connector-integration.md index 2a6c404210b..9e53282062b 100644 --- a/memdocs/intune/protect/zimperium-mtd-connector-integration.md +++ b/memdocs/intune/protect/zimperium-mtd-connector-integration.md @@ -8,7 +8,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 11/17/2023 +ms.date: 08/27/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect diff --git a/memdocs/intune/remote-actions/collect-diagnostics.md b/memdocs/intune/remote-actions/collect-diagnostics.md index 6135ce25eb5..532461f8e3e 100644 --- a/memdocs/intune/remote-actions/collect-diagnostics.md +++ b/memdocs/intune/remote-actions/collect-diagnostics.md @@ -93,12 +93,12 @@ The *Collect diagnostics* remote action is supported for: - Devices that are online and able to communicate with the service during diagnostics > [!NOTE] -> For diagnostics to be able to upload successfully from the client, make sure that the following URLs are not blocked on the network: -> `lgmsapeweu.blob.core.windows.net` -> `lgmsapewus2.blob.core.windows.net` -> `lgmsapesea.blob.core.windows.net` -> `lgmsapeaus.blob.core.windows.net` -> `lgmsapeind.blob.core.windows.net` +> For diagnostics to be able to upload successfully from the client, make sure that the URL for your region is not blocked on the network: +> - `Europe - lgmsapeweu.blob.core.windows.net` +> - `Americas - lgmsapewus2.blob.core.windows.net` +> - `East Asia - lgmsapesea.blob.core.windows.net` +> - `Australia - lgmsapeaus.blob.core.windows.net` +> - `India - lgmsapeind.blob.core.windows.net` ### Collect diagnostics diff --git a/memdocs/intune/remote-actions/devices-wipe.md b/memdocs/intune/remote-actions/devices-wipe.md index 96a3d2c617e..1abf5f91df7 100644 --- a/memdocs/intune/remote-actions/devices-wipe.md +++ b/memdocs/intune/remote-actions/devices-wipe.md @@ -7,7 +7,7 @@ keywords: author: Smritib17 ms.author: smbhardwaj manager: dougeby -ms.date: 06/27/2024 +ms.date: 08/15/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: remote-actions @@ -35,9 +35,9 @@ By using the **Retire** or **Wipe** actions, you can remove devices from Intune ## Wipe -The **Wipe** device action restores a device to its factory default settings. The user data is kept if you choose the **Retain enrollment state and user account** checkbox. Otherwise, all data, apps, and settings are removed. +The **Wipe** device action restores a device to its factory default settings. The user data is kept if you choose the **Wipe device, but keep enrollment state and associated user account** checkbox. Otherwise, all data, apps, and settings are removed. -|Wipe action|**Retain enrollment state and user account**|Removed from Intune management|Description| +|Wipe action|**Wipe device, but keep enrollment state and associated user account**|Removed from Intune management|Description| |:-------------:|:------------:|:------------:|------------| |**Wipe**| Not checked | Yes | Wipes all user accounts, data, MDM policies, and settings. Resets the operating system to its default state and settings.| |**Wipe**| Checked | No | Wipes all MDM Policies. Keeps user accounts and data. Resets user settings back to default. Resets the operating system to its default state and settings.| @@ -208,7 +208,7 @@ If you want to remove devices from the Intune admin center, you can delete them | OS | Enrollment Type | Action triggered | |---------|--------------------------------------------|--------------------------------------------------------------------------------------------| | Android | Device administrator | RETIRE - All Profiles are deleted, Company Portal (CP) app is signed out. | -| Android | Personally-owned devices with work profile | RETIRE - All Profiles are deleted, CP app is deleted. | +| Android | Personally owned devices with work profile | RETIRE - All Profiles are deleted, CP app is deleted. | | Android | Corporate-owned devices with work profile | WIPE | | Android | Dedicated devices | WIPE | | Android | Dedicated w/ Entra ID Shared Mode | WIPE | diff --git a/memdocs/intune/remote-actions/organizational-messages-cancel.md b/memdocs/intune/remote-actions/organizational-messages-cancel.md deleted file mode 100644 index 15e5aa44440..00000000000 --- a/memdocs/intune/remote-actions/organizational-messages-cancel.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -# required metadata -title: Cancel or delete organizational message | Microsoft Intune -description: Cancel or delete an organizational message in the Microsoft Intune admin center. -keywords: -author: Lenewsad -ms.author: lanewsad -manager: dougeby -ms.date: 04/02/2024 -ms.topic: how-to -ms.service: microsoft-intune -ms.subservice: fundamentals -ms.localizationpriority: medium -ms.assetid: -# optional metadata - -#ROBOTS: -#audience: - -ms.suite: ems -search.appverid: MET150 -#ms.tgt_pltfrm: -ms.custom: intune-azure -ms.collection: -- tier2 -- M365-identity-device-management ---- - -# Cancel or delete organizational messages - -*Applies to Windows 11* - -Cancel or delete an organizational message that you no longer need in Microsoft Intune. - -## Cancel message -Cancel an active or scheduled organizational message. Cancelling stops active messages from being sent to additional surfaces and devices. It stops scheduled messages from being sent at all. - -1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). -2. Go to **Tenant administration** > **Organizational messages**. -2. Select the **Message** tab. -3. Find your message in the table and scroll to the end of the row. -3. Select the (**...**) context menu > **Cancel**. - -## Delete message -Delete an organizational message from Microsoft Intune. Deleted messages are removed from your inventory and are no longer visible in the admin center. You can delete a message anytime, regardless of its status. This action is permanent and can't be undone. - -Intune automatically cancels active messages after you delete them, and stops the delivery of future messages. Messages that were delivered and cached prior to deletion could still appear to device users. - -1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). -2. Go to **Tenant administration** > **Organizational messages**. -2. Select the **Message** tab. -3. Find your message in the table and scroll to the end of the row. -3. Select the (**...**) context menu > **Delete**. - -This action requires the *Organizational Messages/Delete* permission. Be sure to assign the permission to the custom admin roles in your tenant that need it. For more information about adding permissions to custom roles, see [Custom role permissions](../fundamentals/create-custom-role.md#custom-role-permissions). - -## Learn more about organizational messages - -For frequently asked questions, known issues, and limitations, see [Overview of organizational messages](organizational-messages-overview.md). \ No newline at end of file diff --git a/memdocs/intune/remote-actions/organizational-messages-create.md b/memdocs/intune/remote-actions/organizational-messages-create.md deleted file mode 100644 index b703cac8d1d..00000000000 --- a/memdocs/intune/remote-actions/organizational-messages-create.md +++ /dev/null @@ -1,187 +0,0 @@ ---- -# required metadata -title: Create organizational messages | Microsoft Intune -description: Create and manage organizational messages in the Microsoft Intune admin center. -keywords: -author: Lenewsad -ms.author: lanewsad -manager: dougeby -ms.date: 04/02/2024 -ms.topic: how-to -ms.service: microsoft-intune -ms.subservice: fundamentals -ms.localizationpriority: medium -ms.assetid: -# optional metadata - -#ROBOTS: -#audience: - -ms.suite: ems -search.appverid: MET150 -#ms.tgt_pltfrm: -ms.custom: intune-azure -ms.collection: -- tier2 -- M365-identity-device-management ---- - -# Create organizational messages - -*Applies to Windows 11* - -Create, edit, and monitor [organizational messages](organizational-messages-overview.md) in the Microsoft Intune admin center. You can send important messages and call-to-actions to employees on Windows 11 devices managed by Microsoft Intune. - -This article describes how to create the following types of organizational messages: - - * Taskbar messages - * Notification area messages - * Get Started app messages - -## Before you begin -Complete these steps before creating a message. - -### Review overview and prerequisites -Make sure your tenant is set up to support organizational messages. -1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). -2. Go to **Tenant administration** > **Organizational messages**. -3. Spend some time in the **Overview** tab to learn about messaging options and prerequisites. - -### Confirm license requirements -Confirm that your tenant has the license required to support organizational messages. This step only has to be done once. You must be assigned the [Organization/Update permission](../fundamentals/create-custom-role.md#custom-role-permissions) or be a Microsoft Entra Global Administrator to complete this step. -1. Go to the **Message** tab. -2. Review and verify that your tenant meets all licensing requirements. Select **I confirm that my organization owns the appropriate license and I understand the Windows device requirements.** -3. Select **Confirm**. - -## Step 1: Create a message - -# [Taskbar](#tab/taskbar) -Create and configure a message for the taskbar area. -1. Go to the **Message** tab and select **Create**. -2. For **Message type**, select **Taskbar**. -3. For **Message theme**, select the type of message you want to create. Your options: - - * **Mandatory update**: Prompt employees to install a mandatory update. - * **Security update**: Prompt employees to review information about an important security update. - * **Important action**: Prompt employees to review an important action they need to take. - * **Important information**: Prompt employees to review important information from your organization. - * **Key meeting**: Prompt employees to review highlights from a recent meeting. - * **Latest video**: Prompt employees to review important video updates. - * **Leadership updates**: Prompt employees to review important updates from leadership. - * **Team updates**: Prompt employees to review important updates from their team. - * **Planned outage**: Prompt employees to review information about an upcoming outage. - -4. Select **OK**. -5. On the **Message** page, select **Add a logo**, and then choose an image file. For requirements, see [Logo requirements](organizational-messages-prerequisites.md#logo-requirements). -6. **Provide a link for the message**: To include a URL link in your message: - 1. Enter your custom URL. Example: `www.contoso.com/SoftwareUpdate` - 2. Select the full generated link to make sure it works. -7. **Choose language to preview**: Select a language to preview the localized version of your message. The message is shown to employees in the [display language](https://support.microsoft.com/windows/manage-the-input-and-display-language-settings-in-windows-12a10cb4-8626-9b77-0ccb-5013e0c7c7a2) they've selected on their device. Organizational messages are supported in 15 languages. If the employee's preferred language isn't supported, the message will appear in their preferred fallback language. -8. **Preview the message in dark theme**: Turn on the toggle to view how your message appears in dark theme. Check to make sure your logo shows up correctly in both light and dark theme. -9. Select **Next: Schedule** to continue to scheduling options. - -# [Notification area](#tab/notification) -Create and configure a message for the notification area. -1. Go to the **Message** tab and select **Create**. -2. For **Message type**, select **Notification area**. -3. For **Message theme**, select the type of message you want to create. Your options: - - * **Organizational HR training**: Prompt users to complete HR training. - * **Organizational skills training**: Prompt users to complete skill-specific training. - * **Organizational training**: Prompt users to complete training provided by your organization. - * **Organizational update**: Prompt users to install an update from your organization. - * **Update browser**: Prompt users to update their browser. - * **Update device**: Prompt users to update their device. - -3. Select **OK**. -4. On the **Message** page, select **Add a logo**, and then choose an image file. For requirements, see [Logo requirements](organizational-messages-prerequisites.md#logo-requirements). -5. **Provide a link for the message**: To include a URL link in your message: - 1. Enter your custom URL. Example: `www.contoso.com/SoftwareUpdate` - 2. Select the full generated link to make sure it works. -6. **Choose language to preview**: Select a language to preview the localized version of your message. The message is shown to employees in the [display language](https://support.microsoft.com/windows/manage-the-input-and-display-language-settings-in-windows-12a10cb4-8626-9b77-0ccb-5013e0c7c7a2) they've selected on their device. Organizational messages are supported in 15 languages. If the employee's preferred language isn't supported, the message will appear in their preferred fallback language. -7. **Preview the message in dark theme**: Turn on the toggle to view how your message appears in dark theme. Check to make sure your logo shows up correctly in both light and dark theme. -8. Select **Next: Schedule** to continue to scheduling options. - -# [Get Started app](#tab/get-started) -Create and configure a message for the Get Started app. -1. Go to the **Message** tab and select **Create**. -2. For **Message type**, select **Get Started app**. -3. Select **OK**. -4. On the **Message** page, select **Add a logo**, and then choose an image file. For requirements, see [Logo requirements](organizational-messages-prerequisites.md#logo-requirements). -5. Choose **Select messages**. You must select two messages to show to users. - 1. Select **Add your first message**. - 2. Choose a theme for your message. Options include: - * **Review benefits** - * **Review organization** - * **Get started with device** - 3. **Provide a link for the message**: To include a URL link in your message: - 1. Enter your custom URL. Example: `www.contoso.com/SoftwareUpdate` - 2. Select the full generated link to make sure it works. - 4. Select **OK**. - 5. Select **Add your second message**. Options include: - * **Organizational training** - * **Organization policies** - * **Help resources** - * **Update VPN** - 6. Provide a link for the message like you did for the first one. Select the generated link to make sure it works. - 7. Select **OK**. -6. **Choose language to preview**: Select a language to preview the localized version of your message. The message is shown to employees in the [display language](https://support.microsoft.com/windows/manage-the-input-and-display-language-settings-in-windows-12a10cb4-8626-9b77-0ccb-5013e0c7c7a2) they've selected on their device. Organizational messages are supported in 15 languages. If the employee's preferred language isn't supported, the message will be shown to them in their preferred fallback language. -7. **Preview the message in dark theme**: Turn on the toggle to view how your message appears in dark theme. Check to make sure your logo shows up correctly in both light and dark theme. -8. Select **Next: Schedule** to continue to scheduling options. ---- -## Step 2: Schedule a message - -# [Taskbar / Notification area](#tab/taskbar+notification) -On the **Schedule** page, schedule the delivery of your message. -1. Configure the delivery time window. Your options: - - * **First day to show message**: Select when to first show the message. To ensure that delivery begins when you want it to, configure this setting 24 hours before you want the message to appear. - * **Last day to show message**: Select the last day to show the message. This date must be at least 7 days after the start date. -2. Select **Next: Assignments** to continue to assignment options. - -# [Get Started app](#tab/get-started) -On the **Schedule** page, schedule the delivery of your message. - -1. Configure the **Message repeat frequency**. Select how often you want the message to reappear after employees dismiss it. The message will initially go away when the employee dismisses it or completes the call-to-action, but will reappear at the frequency you select here. Your options: - * **Once a week** - * **Once every two weeks** - * **Once a month** -2. Turn on the **Always on** toggle to make messages visible in the Get Started app. -3. Select **Next: Assignments** to continue to assignment options. ---- - -## Step 3: Add scope tags -Optionally, add scope tags to control which administrators can see, edit, cancel, or delete messages in Intune. Choose **Select scope tags** to add scope tags to the message. Select **Remove** to delete scope tags from the message. - -For more information about scope tags, see [Use role-based access control (RBAC) and scope tags for distributed IT in Intune](../fundamentals/scope-tags.md). - ->[!NOTE] -> Intune only enforces scope tags and scope groups for messages created in Intune, and for admins with Intune roles. - -## Step 4: Assign message -Assign the message to Microsoft Entra registered users in your organization. You can assign the message to Microsoft Entra user groups, not Microsoft Entra device groups. If a group includes both users and devices, Intune will only send the message to the users. - -1. To include groups in the assignment, you have two options: - * **Add groups**: Select this option to individually choose from a list of Microsoft Entra groups. - * **Include all users**: Select the option to assign the message to all Microsoft Entra registered users. -2. If needed, exclude Microsoft Entra groups from the assignment. Under **Exclude**, select **Add groups** and choose the Microsoft Entra groups to leave out. -3. Select **Next: Review + Create** to review and finalize your message. - -## Step 5: Review and create message -Review your message, scheduling details, and assignments before creating your message. When you're ready to send the message, select **Create**. - -Return to **Organizational messages** and select the **Message** tab to view or edit your new message. - -## Edit scheduled message -You can edit the properties of a message that's in a scheduled state. - -1. Go to **Organizational messages** > **Messages**. -2. Select the name of the message you want to edit. -2. A summary of the message opens, and shows the message properties. Next to **Summary**, select **Edit**. -3. Make changes to the properties. -4. Select **Save**. - -## Next steps -* Monitor and track the status and user engagement details for scheduled organizational messages. For more information, see [View reporting details for organizational messages](organizational-messages-reporting.md). -* [Cancel or delete an organizational message](organizational-messages-cancel.md) that's no longer needed. -* For frequently asked questions, known issues, and limitations, see [Overview of organizational messages](organizational-messages-overview.md). diff --git a/memdocs/intune/remote-actions/organizational-messages-overview.md b/memdocs/intune/remote-actions/organizational-messages-overview.md deleted file mode 100644 index 598c1693172..00000000000 --- a/memdocs/intune/remote-actions/organizational-messages-overview.md +++ /dev/null @@ -1,93 +0,0 @@ ---- -# required metadata -title: Overview of organizational messages in Microsoft Intune | Microsoft Docs -description: Learn more about the features and capabilities of organizational messages. -keywords: -author: Lenewsad -ms.author: lanewsad -manager: dougeby -ms.date: 04/02/2024 -ms.topic: conceptual -ms.service: microsoft-intune -ms.subservice: fundamentals -ms.localizationpriority: medium -ms.assetid: -# optional metadata - -#ROBOTS: -#audience: - -ms.suite: ems -search.appverid: MET150 -#ms.tgt_pltfrm: -ms.custom: intune-azure -ms.collection: -- tier2 -- M365-identity-device-management ---- - -# Organizational messages in Microsoft Intune - -*Applies to Windows 11* - -Use organizational messages to send important messages to employees on Intune-managed Windows 11 devices. Organizational messages can be used to communicate in remote and hybrid work scenarios and is intended to help employees: - -* Acclimate to new roles. -* Learn more about their workplace. -* Stay informed of new and required updates and trainings. - -Organizational messages appear in highly visible places in Windows 11, including the Get Started app, notification area, and just above the taskbar. This article provides an overview of organizational messages, with known issues, limitations, and FAQs. - -## How it works - -Microsoft Intune provides you with pre-written messages in templates designed for the taskbar area, notification area, and Get Started app. You can add a custom destination URL in the message to link employees to additional resources or the next step in their onboarding process. You must include a logo so that employees recognize and know the message is from you. - -Messages are assigned to Microsoft Entra users and scheduled in the admin center. After you create a message, you can track the delivery status and user engagement data for it, and cancel the message if it's no longer needed. - -## Message types -You can create the following types of messages: - -* Taskbar messages: These messages appear just above the desktop taskbar. Taskbar messages are disruptive and good to use when you need to deliver an important notification, like a critical software update. A device user can dismiss the message, but it reappears at the frequency you configure in Intune until they go to the included URL. - -* Notification area messages: These messages appear in the Notification Center. They typically pop up and then disappear, and are good for linking employees to informational resources, such as new and available trainings or optional updates. The message reappears at the frequency you configure in Intune until the user goes to the included URL. The device user's Windows 11 Focus Assist settings may disrupt the visibility of notification area messages. - -* Get Started app messages: These messages appear in the Get Started app. The device user sees this message after they enroll their device, and then open the Get Started app. Use this type of message to welcome new employees and link them to resources like benefits information, essential employee trainings, device tips, policies, and support information. The message keeps showing up at the frequency you configure in Intune until the user goes to the included URL. - -## Prerequisites -For all tenant, role, and policy requirements for organizational messages see [Prerequisites](organizational-messages-prerequisites.md). - -## Known issues and limitations - -Organizational messages have the following known issues and limitations: - -* Assigning messages to devices and mixed groups isn't supported. If an assigned group includes both users and devices, Intune will only send the message to the users. -* If you recently onboarded your tenant to Microsoft Entra ID, it can take 36 to 64 hours before you're able to use the organizational messages feature. -* When you create an organizational message for the Get Started app, Microsoft Intune automatically sets the delivery end date to 12/31/2035, which is shown in the profile summary. The message will be delivered to targeted groups until that date or until you cancel the message. -* Message priority isn't supported. If you schedule multiple messages of the same type for the same time window, targeted employees will receive the messages in a random order. - -## Frequently asked questions -This section answers frequently asked questions (FAQ) for organizational messages. - -### Can I customize message text? -No, we'll generate the message based on the theme you select. You can add a custom URL to the message to link people to more detailed information. - -### What do I need to do if I don't have the correct permissions? -Contact someone in your organization who is a Microsoft Entra Global Administrator, Intune Administrator, or Intune Role Administrator and ask them to assign one of the following roles: - * Microsoft Entra Global Administrator - * Intune Administrator - * Organizational messages manager (Microsoft Intune role) - * Organizational messages writer (Microsoft Entra role) - -### Why do I need to update other policies before I create a message? -The required policies described in [Prerequisites](organizational-messages-prerequisites.md) control access to the taskbar, notification area, and Get Started app. If the settings are blocked or not configured as described, employees will not receive the messages. - -### Can I control the order in which messages are delivered? -You can schedule messages to arrive at different times on a device by selecting a unique delivery window for each message. If you schedule the same time for multiple messages, the messages will arrive in random order. - -### Where can I share an idea for organizational messages or suggest an improvement? -In the Microsoft Intune admin center, select the **Feedback** icon that's next to your account name at the top of the page. Rate your experience and then describe your experience or idea. If you're okay with getting a response from Microsoft, select **Microsoft can email you about your feedback.** - -For other support options, see [How to get support in Microsoft Intune admin center](../../get-support.md). - -## Next steps -Complete the [prerequisites for organizational messages](organizational-messages-prerequisites.md) to enable the feature in your tenant. diff --git a/memdocs/intune/remote-actions/organizational-messages-prerequisites.md b/memdocs/intune/remote-actions/organizational-messages-prerequisites.md deleted file mode 100644 index d086719c441..00000000000 --- a/memdocs/intune/remote-actions/organizational-messages-prerequisites.md +++ /dev/null @@ -1,132 +0,0 @@ ---- -# required metadata -title: Prerequisites for organizational messages | Microsoft Intune -description: Find out what's required to use organizational messages in Microsoft Intune. -keywords: -author: Lenewsad -ms.author: lanewsad -manager: dougeby -ms.date: 04/02/2024 -ms.topic: how-to -ms.service: microsoft-intune -ms.subservice: fundamentals -ms.localizationpriority: medium -ms.assetid: -# optional metadata - -#ROBOTS: -#audience: - -ms.suite: ems -search.appverid: MET150 -#ms.tgt_pltfrm: -ms.custom: intune-azure -ms.collection: -- tier2 -- M365-identity-device-management ---- - -# Organizational messages prerequisites - -*Applies to Windows 11* - -This article describes the tenant, message, and configuration requirements for organizational messages. Employees will not receive messages until you complete all prerequisites. -## Version requirements -Organizational messages are supported on devices running [Windows 11, version 22H2 or later](https://blogs.windows.com/windowsexperience/2022/09/20/how-to-get-the-windows-11-2022-update/). - -## Licensing requirements -The organizational message feature is included with the following licenses: - -* Microsoft 365 E3 -* Microsoft 365 E5 -* Windows 10/11 Enterprise E3 with Microsoft Intune Plan 1 -* Windows 10/11 Enterprise E5 with Microsoft Intune Plan 1 - -For more information about license options, see [Microsoft Intune licensing](../fundamentals/licenses.md). - -## Role-based access control requirements -To create organizational messages in Microsoft Intune, you must be assigned one of these roles: - -* Organizational Messages Manager, a Microsoft Intune built-in role -* Organizational Messages Writer, a Microsoft Entra built-in role -* Intune Administrator, a Microsoft Entra built-in role - -You can also create a custom role for people managing organization messages by using role-based access control (RBAC). For more information about how to use built-in roles and custom roles, see [RBAC with Microsoft Intune](../fundamentals/role-based-access-control.md). - -## Logo requirements -Logos must meet these requirements: - -* PNG file -* Transparent background -* Size requirements: - * Taskbar messages: 64 x 64 pixels - * Notification area messages: 48 x 48 pixels - * Get Started app messages: 50 pixels long x 50 - 100 pixels wide - -## Policy requirements -There are certain experience and Windows Spotlight policies in Microsoft Intune that block the delivery of organizational messages. This section describes how to adjust all settings so that delivery is always allowed and works as intended. - -### Organizational messages delivery policy -> [!IMPORTANT] -> This policy is required for devices running [Windows 11, version 22H2, build 10.0.22621.900](https://support.microsoft.com/help/5020044) and later. If you don't enable this policy, these devices can't receive organizational messages. The policy isn't required on devices running earlier builds. - -Enable the delivery of organizational messages in all new and existing policies that are targeted at users and devices receiving organizational messages. - - 1. Go to **Settings catalog** > **Experience** > **Enable delivery of organizational messages (User)**. - 2. For **Enable delivery of organizational messages**, switch the toggle to **Enabled**. - -### Windows Spotlight policy - Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and configure the Windows Spotlight policies using a Microsoft Intune [device restrictions profile template](../configuration/device-restrictions-configure.md) or the [settings catalog](../configuration/settings-catalog.md). Make sure to adjust these policies in all new and existing policies that are targeted at users and devices receiving organizational messages. - -> [!NOTE] -> If you use the Windows 10/11 MDM security baseline, you will need to change the **Windows Spotlight** policy to **Not configured**. The Windows Spotlight policy controls organizational messages and messages coming from Microsoft. To continue blocking messages from Microsoft as defined in the Windows 10/11 MDM security baseline, [configure the Microsoft messaging policy](organizational-messages-prerequisites.md#microsoft-messaging-policy). - -#### Template profiles -Go to **Devices** > **By platform** > **Windows** > **Manage devices** > **Configuration**, and in a new or existing template profile, select **Device restrictions** > **Windows Spotlight**. - -* To allow taskbar messages: - * **Windows Spotlight**: Select **Not configured**. - * **Windows Tips**: Select **Not configured**. -* To allow notification area messages: - * **Windows Spotlight**: Select **Not configured**. - * **Windows Spotlight in action center**: Select **Not configured**. -* To allow Get Started app messages: - * **Windows Spotlight**: Select **Not configured**. - -#### Settings catalog profiles -In a new or existing Windows configuration profile, select **Settings catalog** > **Add settings**. Use the **Settings picker** to add the settings to your profile. Then adjust the setting toggles as needed under **Configuration settings**. - -All of these settings are in the settings catalog, in the **Experience** category. - -* To allow taskbar messages: - * Add **Allow Windows Spotlight (User)**: Switch the toggle to **Allow**. - * Add **Allow Windows Tips**: Switch the toggle to **Allow**. -* To allow notification area messages: - * Add **Allow Windows Spotlight (User)**: Switch the toggle to **Allow**. - * Add **Allow Windows Spotlight on Action Center (User)**: Switch the toggle to **Allow**. -* To allow Get Started app messages: - * Add **Allow Windows Spotlight (User)**: Switch the toggle to **Allow**. - * Add **Disable Cloud Optimized Content**: Switch the toggle to **Disabled**. - -#### Policy CSP -The configuration service provider (CSP) policies available for Windows 11 include: -* [Experience/AllowWindowsSpotlight](/windows/client-management/mdm/policy-csp-experience#experience-allowwindowsspotlight) -* [Experience/AllowWindowsTips](/windows/client-management/mdm/policy-csp-experience#experience-allowwindowstips) -* [Experience/AllowWindowsSpotlightOnActionCenter](/windows/client-management/mdm/policy-csp-experience#experience-allowwindowsspotlightonactioncenter) -* [Experience/DisableCloudOptimizedContent](/windows/client-management/mdm/policy-csp-experience#experience-disablecloudoptimizedcontent) - -### Microsoft messaging policy -If you currently block messages that come from Microsoft, you can continue to do so while also allowing organizational messages to come through. - -1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). -2. Go to **Tenant administration** > **Organizational messages**. -2. In the **Overview** tab, go to step 2 under **Before you create a message**. -3. **Decide whether to block messages directly from Microsoft, while allowing admin messages to display**: Switch the toggle to **Allow** to allow both Microsoft messages and organizational messages. Switch the toggle to **Block** to block Microsoft messages and allow organizational messages. - - - -## Attention: New Microsoft Entra tenants -If you recently created your Microsoft Entra tenant, the organizational messages feature won't be available to use right away. It will become available 36 to 64 hours after you create the tenant. - -## Next steps -Now that prerequisites are complete, you can [create organizational messages](organizational-messages-create.md) in Microsoft Intune. diff --git a/memdocs/intune/remote-actions/organizational-messages-reporting.md b/memdocs/intune/remote-actions/organizational-messages-reporting.md deleted file mode 100644 index 8c20ed0c947..00000000000 --- a/memdocs/intune/remote-actions/organizational-messages-reporting.md +++ /dev/null @@ -1,75 +0,0 @@ ---- -# required metadata -title: View reporting details for organizational messages | Microsoft Intune -description: View the reporting details for existing organizational messages in the Microsoft Intune admin center. -keywords: -author: Lenewsad -ms.author: lanewsad -manager: dougeby -ms.date: 04/02/2024 -ms.topic: how-to -ms.service: microsoft-intune -ms.subservice: fundamentals -ms.localizationpriority: medium -ms.assetid: -# optional metadata - -#ROBOTS: -#audience: - -ms.suite: ems -search.appverid: MET150 -#ms.tgt_pltfrm: -ms.custom: intune-azure -ms.collection: -- tier2 -- M365-identity-device-management ---- - -# View reporting details for organizational messages - -*Applies to Windows 11* -View the details of your organizational messages in the Microsoft Intune admin center. - -## Access message details - -1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). -2. Go to **Tenant administration** > **Organizational messages**. -3. Select the **Message** tab to see a list of all existing messages and message details. - -### Available details - -Message details include: - - * **Message type**: Shows whether the message is for the taskbar, notification area, or Get Started app. Select the hyperlink to see your message, schedule, and assignment settings. - * **Message theme**: Shows the theme you chose for the message. - * **Date created**: Shows the date and time you created the message. - * **Status** Shows the status of the message, which includes: - * **Active**: The message is currently being shown to users according to your schedule. - * **Pending**: The message hasn't been scheduled yet and is currently in progress. - * **Scheduled**: The message isn't currently being shown to users but has been scheduled. - * **Canceled**: The message was canceled and is no longer scheduled to go out to users. - * **Completed**: The message was sent out during the scheduled time and is done being shown. - * **Failed**: The message failed to schedule due to a service error. - * **Start date**: Shows the start date for the message. - * **End date** Shows the end date for the message. - * **Times shown**: Shows an estimate of the total number of times the message has been shown to users in the past 180 days. - * **Times clicked**: Shows an estimate of the total number of times users clicked the message in the past 180 days. - * **Click-through rate**: Shows how often, in percentage, that users clicked the message when shown. This data is determined by dividing times clicked by times shown. - - ## Access audit logs - Use audit logs to track and monitor organizational message events in Microsoft Intune. Audit logs contain a record of activities that generate a change in Microsoft Intune. The following organizational message actions create audit events: - - * Assign - * Create - * Delete - * Update (edit) - - To access audit logs, go to **Tenant administration** > **Audit logs**. Available logs are shown in the table. Select **Filter** to filter logs by category. The category for organizational messages is **OrganizationalMessage**. - - For more information about audit logs, see [Use audit logs to track and monitor events in Microsoft Intune](../fundamentals/monitor-audit-logs.md). - -## Learn more about organizational messages -For frequently asked questions, known issues, and limitations, see [Overview of organizational messages](organizational-messages-overview.md). - - diff --git a/memdocs/intune/toc.yml b/memdocs/intune/toc.yml index d0447afa92f..22f9d085fff 100644 --- a/memdocs/intune/toc.yml +++ b/memdocs/intune/toc.yml @@ -390,8 +390,6 @@ items: href: ./apps/store-apps-microsoft.md - name: Microsoft store apps (legacy) href: ./apps/store-apps-windows.md - - name: Microsoft Store for Business apps - href: ./apps/windows-store-for-business.md - name: Managed Google Play apps href: ./apps/apps-add-android-for-work.md - name: Microsoft 365 Suite @@ -669,8 +667,6 @@ items: href: ./protect/mde-security-integration.md - name: Manage endpoint security policies in Microsoft Defender href: /defender-endpoint/manage-security-policies?toc=/mem/intune/toc.json&bc=/mem/breadcrumb/toc.json - - name: Firewall rule migration - href: ./protect/endpoint-security-firewall-rule-tool.md - name: Tenant attach href: ./protect/tenant-attach-intune.md - name: Encrypt disks @@ -1173,7 +1169,7 @@ items: - name: Domain Join on Windows href: ./configuration/domain-join-configure.md displayName: enrollment, active directory, azure ad joined, join domain - - name: Update Windows + - name: Delivery Optimization href: ./configuration/delivery-optimization-windows.md displayName: delivery optimization, windows updates - name: Upgrade Windows and S mode @@ -1733,18 +1729,6 @@ items: href: ./remote-actions/remove-apps-config.md - name: Pause config refresh href: ./remote-actions/pause-config-refresh.md - - name: Send organizational messages - items: - - name: Overview - href: ./remote-actions/organizational-messages-overview.md - - name: Prerequisites for organizational messages - href: ./remote-actions/organizational-messages-prerequisites.md - - name: Create organizational messages - href: ./remote-actions/organizational-messages-create.md - - name: Cancel or delete organizational message - href: ./remote-actions/organizational-messages-cancel.md - - name: Monitor organizational messages - href: ./remote-actions/organizational-messages-reporting.md - name: Bulk device actions href: ./remote-actions/bulk-device-actions.md - name: Troubleshooting diff --git a/memdocs/intune/user-help/TOC.yml b/memdocs/intune/user-help/TOC.yml index 5da28582683..ec32fef54f1 100644 --- a/memdocs/intune/user-help/TOC.yml +++ b/memdocs/intune/user-help/TOC.yml @@ -200,6 +200,8 @@ items: href: enroll-windows-10-device.md - name: Unenroll device href: unenroll-your-device-from-intune-windows.md + - name: Enrollment dialog FAQs + href: sso-dialog-faqs.yml - name: Company Portal app for Windows items: diff --git a/memdocs/intune/user-help/docfx.json b/memdocs/intune/user-help/docfx.json index ebf9b4ea583..8f4ec07c61b 100644 --- a/memdocs/intune/user-help/docfx.json +++ b/memdocs/intune/user-help/docfx.json @@ -48,7 +48,9 @@ "jborsecnik", "garycentric", "dstrome", - "American-Dipper" + "American-Dipper", + "padmagit77", + "aditisrivastava07" ], "searchScope": [ "Intune" diff --git a/memdocs/intune/user-help/media/1804_remote_lock_Windows_CPapp_05.png b/memdocs/intune/user-help/media/1804_remote_lock_Windows_CPapp_05.png deleted file mode 100644 index aad3b152f31..00000000000 Binary files a/memdocs/intune/user-help/media/1804_remote_lock_Windows_CPapp_05.png and /dev/null differ diff --git a/memdocs/intune/user-help/media/1809_CheckAccess_Checking_Status.png b/memdocs/intune/user-help/media/1809_CheckAccess_Checking_Status.png deleted file mode 100644 index 8903554edd3..00000000000 Binary files a/memdocs/intune/user-help/media/1809_CheckAccess_Checking_Status.png and /dev/null differ diff --git a/memdocs/intune/user-help/media/1809_CheckAccess_Context_Menu_Alert2.png b/memdocs/intune/user-help/media/1809_CheckAccess_Context_Menu_Alert2.png deleted file mode 100644 index 71545ea6876..00000000000 Binary files a/memdocs/intune/user-help/media/1809_CheckAccess_Context_Menu_Alert2.png and /dev/null differ diff --git a/memdocs/intune/user-help/media/1809_CheckAccess_Context_Select_Device.png b/memdocs/intune/user-help/media/1809_CheckAccess_Context_Select_Device.png deleted file mode 100644 index ea3e6426651..00000000000 Binary files a/memdocs/intune/user-help/media/1809_CheckAccess_Context_Select_Device.png and /dev/null differ diff --git a/memdocs/intune/user-help/media/1809_CheckAccess_Device_details_alert1.png b/memdocs/intune/user-help/media/1809_CheckAccess_Device_details_alert1.png deleted file mode 100644 index f5e813a854d..00000000000 Binary files a/memdocs/intune/user-help/media/1809_CheckAccess_Device_details_alert1.png and /dev/null differ diff --git a/memdocs/intune/user-help/media/1809_CheckAccess_Device_details_button.png b/memdocs/intune/user-help/media/1809_CheckAccess_Device_details_button.png deleted file mode 100644 index 854dab51a8d..00000000000 Binary files a/memdocs/intune/user-help/media/1809_CheckAccess_Device_details_button.png and /dev/null differ diff --git a/memdocs/intune/user-help/media/1809_CheckAccess_Device_details_status1.png b/memdocs/intune/user-help/media/1809_CheckAccess_Device_details_status1.png deleted file mode 100644 index 24c0aed0367..00000000000 Binary files a/memdocs/intune/user-help/media/1809_CheckAccess_Device_details_status1.png and /dev/null differ diff --git a/memdocs/intune/user-help/media/1809_DeviceContextMenu_Windows_CP.png b/memdocs/intune/user-help/media/1809_DeviceContextMenu_Windows_CP.png deleted file mode 100644 index d0224eebaa9..00000000000 Binary files a/memdocs/intune/user-help/media/1809_DeviceContextMenu_Windows_CP.png and /dev/null differ diff --git a/memdocs/intune/user-help/media/1812_UCP_Help_Support_sections.png b/memdocs/intune/user-help/media/1812_UCP_Help_Support_sections.png deleted file mode 100644 index b3ccf018ac8..00000000000 Binary files a/memdocs/intune/user-help/media/1812_UCP_Help_Support_sections.png and /dev/null differ diff --git a/memdocs/intune/user-help/media/RS1_HoloLens_SettingsRS1_Accounts_06.png b/memdocs/intune/user-help/media/RS1_HoloLens_SettingsRS1_Accounts_06.png deleted file mode 100644 index f59c2aced16..00000000000 Binary files a/memdocs/intune/user-help/media/RS1_HoloLens_SettingsRS1_Accounts_06.png and /dev/null differ diff --git a/memdocs/intune/user-help/media/RS1_HoloLens_SyncRS1_Sync_08.png b/memdocs/intune/user-help/media/RS1_HoloLens_SyncRS1_Sync_08.png deleted file mode 100644 index e4f02b2fd79..00000000000 Binary files a/memdocs/intune/user-help/media/RS1_HoloLens_SyncRS1_Sync_08.png and /dev/null differ diff --git a/memdocs/intune/user-help/media/W81-1-workplacejoin.png b/memdocs/intune/user-help/media/W81-1-workplacejoin.png deleted file mode 100644 index 91951d886d5..00000000000 Binary files a/memdocs/intune/user-help/media/W81-1-workplacejoin.png and /dev/null differ diff --git a/memdocs/intune/user-help/media/W81-2-workplacesettings_signin.png b/memdocs/intune/user-help/media/W81-2-workplacesettings_signin.png deleted file mode 100644 index 321f01d346d..00000000000 Binary files a/memdocs/intune/user-help/media/W81-2-workplacesettings_signin.png and /dev/null differ diff --git a/memdocs/intune/user-help/media/W81-3-dev-mgt-turn-on.png b/memdocs/intune/user-help/media/W81-3-dev-mgt-turn-on.png deleted file mode 100644 index 47eb68d75fe..00000000000 Binary files a/memdocs/intune/user-help/media/W81-3-dev-mgt-turn-on.png and /dev/null differ diff --git a/memdocs/intune/user-help/media/W81-4-agree-allow-apps-services.png b/memdocs/intune/user-help/media/W81-4-agree-allow-apps-services.png deleted file mode 100644 index 2f06d2ea01e..00000000000 Binary files a/memdocs/intune/user-help/media/W81-4-agree-allow-apps-services.png and /dev/null differ diff --git a/memdocs/intune/user-help/media/W81-5-enrolled-done.png b/memdocs/intune/user-help/media/W81-5-enrolled-done.png deleted file mode 100644 index dd5605b4759..00000000000 Binary files a/memdocs/intune/user-help/media/W81-5-enrolled-done.png and /dev/null differ diff --git a/memdocs/intune/user-help/media/and-enroll-12-tem-datalert-setup.png b/memdocs/intune/user-help/media/and-enroll-12-tem-datalert-setup.png deleted file mode 100644 index a9bc0a37319..00000000000 Binary files a/memdocs/intune/user-help/media/and-enroll-12-tem-datalert-setup.png and /dev/null differ diff --git a/memdocs/intune/user-help/media/and-enroll-12a-tem-datalert-enroll-msft-account.png b/memdocs/intune/user-help/media/and-enroll-12a-tem-datalert-enroll-msft-account.png deleted file mode 100644 index 1d285d6cc1b..00000000000 Binary files a/memdocs/intune/user-help/media/and-enroll-12a-tem-datalert-enroll-msft-account.png and /dev/null differ diff --git a/memdocs/intune/user-help/media/and-enroll-12b-tem-datalert-enroll-select-msft-account.png b/memdocs/intune/user-help/media/and-enroll-12b-tem-datalert-enroll-select-msft-account.png deleted file mode 100644 index 6cc683c7d68..00000000000 Binary files a/memdocs/intune/user-help/media/and-enroll-12b-tem-datalert-enroll-select-msft-account.png and /dev/null differ diff --git a/memdocs/intune/user-help/media/and-enroll-13-tem-datalert-phone-number.png b/memdocs/intune/user-help/media/and-enroll-13-tem-datalert-phone-number.png deleted file mode 100644 index 4214845fa24..00000000000 Binary files a/memdocs/intune/user-help/media/and-enroll-13-tem-datalert-phone-number.png and /dev/null differ diff --git a/memdocs/intune/user-help/media/and-enroll-14-tem-datalert-sms.png b/memdocs/intune/user-help/media/and-enroll-14-tem-datalert-sms.png deleted file mode 100644 index 687f2561855..00000000000 Binary files a/memdocs/intune/user-help/media/and-enroll-14-tem-datalert-sms.png and /dev/null differ diff --git a/memdocs/intune/user-help/media/and-enroll-15-tem-datalert-monitoring-active.png b/memdocs/intune/user-help/media/and-enroll-15-tem-datalert-monitoring-active.png deleted file mode 100644 index 3d038fea822..00000000000 Binary files a/memdocs/intune/user-help/media/and-enroll-15-tem-datalert-monitoring-active.png and /dev/null differ diff --git a/memdocs/intune/user-help/media/andr-cert_install-1-cert_missing.png b/memdocs/intune/user-help/media/andr-cert_install-1-cert_missing.png deleted file mode 100644 index a034902d371..00000000000 Binary files a/memdocs/intune/user-help/media/andr-cert_install-1-cert_missing.png and /dev/null differ diff --git a/memdocs/intune/user-help/media/android-wp-05-1908.png b/memdocs/intune/user-help/media/android-wp-05-1908.png deleted file mode 100644 index f64bc591d50..00000000000 Binary files a/memdocs/intune/user-help/media/android-wp-05-1908.png and /dev/null differ diff --git a/memdocs/intune/user-help/media/android-wp-05a-1908.png b/memdocs/intune/user-help/media/android-wp-05a-1908.png deleted file mode 100644 index 1789c1b8187..00000000000 Binary files a/memdocs/intune/user-help/media/android-wp-05a-1908.png and /dev/null differ diff --git a/memdocs/intune/user-help/media/ios-enroll-11b-tem-datalert-open-authenticator.png b/memdocs/intune/user-help/media/ios-enroll-11b-tem-datalert-open-authenticator.png deleted file mode 100644 index 03109cb6c71..00000000000 Binary files a/memdocs/intune/user-help/media/ios-enroll-11b-tem-datalert-open-authenticator.png and /dev/null differ diff --git a/memdocs/intune/user-help/media/management-profile-approve-macos-2006.png b/memdocs/intune/user-help/media/management-profile-approve-macos-2006.png deleted file mode 100644 index b8dd2d366ac..00000000000 Binary files a/memdocs/intune/user-help/media/management-profile-approve-macos-2006.png and /dev/null differ diff --git a/memdocs/intune/user-help/media/rename-reset-device-step2-1808.png b/memdocs/intune/user-help/media/rename-reset-device-step2-1808.png deleted file mode 100644 index 20f17000efc..00000000000 Binary files a/memdocs/intune/user-help/media/rename-reset-device-step2-1808.png and /dev/null differ diff --git a/memdocs/intune/user-help/media/rename-reset-device-step3-more-1808.png b/memdocs/intune/user-help/media/rename-reset-device-step3-more-1808.png deleted file mode 100644 index 1ce72f29373..00000000000 Binary files a/memdocs/intune/user-help/media/rename-reset-device-step3-more-1808.png and /dev/null differ diff --git a/memdocs/intune/user-help/media/skycure-list-of-potential-issues-android.png b/memdocs/intune/user-help/media/skycure-list-of-potential-issues-android.png deleted file mode 100644 index 5cd48723f2c..00000000000 Binary files a/memdocs/intune/user-help/media/skycure-list-of-potential-issues-android.png and /dev/null differ diff --git a/memdocs/intune/user-help/media/sso-dialog-faqs/sso-consent-screen-mdm.png b/memdocs/intune/user-help/media/sso-dialog-faqs/sso-consent-screen-mdm.png new file mode 100644 index 00000000000..eccdedefcb3 Binary files /dev/null and b/memdocs/intune/user-help/media/sso-dialog-faqs/sso-consent-screen-mdm.png differ diff --git a/memdocs/intune/user-help/media/sso-dialog-faqs/sso-consent-screen-no-mdm.png b/memdocs/intune/user-help/media/sso-dialog-faqs/sso-consent-screen-no-mdm.png new file mode 100644 index 00000000000..33dc5dbb392 Binary files /dev/null and b/memdocs/intune/user-help/media/sso-dialog-faqs/sso-consent-screen-no-mdm.png differ diff --git a/memdocs/intune/user-help/media/win10pc-sync-2-settings-accounts.png b/memdocs/intune/user-help/media/win10pc-sync-2-settings-accounts.png deleted file mode 100644 index 032e3d316a0..00000000000 Binary files a/memdocs/intune/user-help/media/win10pc-sync-2-settings-accounts.png and /dev/null differ diff --git a/memdocs/intune/user-help/media/win10pc-sync-5-tap-sync.png b/memdocs/intune/user-help/media/win10pc-sync-5-tap-sync.png deleted file mode 100644 index 7e3f6d9ad98..00000000000 Binary files a/memdocs/intune/user-help/media/win10pc-sync-5-tap-sync.png and /dev/null differ diff --git a/memdocs/intune/user-help/microsoft-intune-app-linux.md b/memdocs/intune/user-help/microsoft-intune-app-linux.md index a9aa71f5b84..7ab06b3410e 100644 --- a/memdocs/intune/user-help/microsoft-intune-app-linux.md +++ b/memdocs/intune/user-help/microsoft-intune-app-linux.md @@ -7,7 +7,7 @@ keywords: author: lenewsad ms.author: lanewsad manager: dougeby -ms.date: 05/15/2024 +ms.date: 08/27/2024 ms.topic: end-user-help ms.service: microsoft-intune ms.subservice: end-user @@ -41,10 +41,10 @@ The Microsoft Intune app is supported with the following operating systems: - RedHat Enterprise Linux 8 - RedHat Enterprise Linux 9 -## Install Intune app -Run the following commands in a command line to manually install the Intune app and its dependencies on your device. +## Install Microsoft Intune app for Ubuntu Desktop +Run the following commands in a command line to manually install the Microsoft Intune app and its dependencies on your device. -1. Install Curl: +1. Install Curl. ```bash sudo apt install curl gpg @@ -52,7 +52,7 @@ Run the following commands in a command line to manually install the Intune app 2. Install the Microsoft package signing key. - For Ubuntu 20.04: + For Ubuntu 20.04: ```bash curl https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor > microsoft.gpg @@ -61,7 +61,7 @@ Run the following commands in a command line to manually install the Intune app sudo rm microsoft.gpg ``` - For Ubuntu 22.04: + For Ubuntu 22.04: ```bash curl https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor > microsoft.gpg @@ -70,42 +70,90 @@ Run the following commands in a command line to manually install the Intune app sudo rm microsoft.gpg ``` -3. Install the Microsoft Intune app: +3. Install the Intune app. ```bash sudo apt update sudo apt install intune-portal - ``` + ``` -4. Reboot your device. +4. Reboot your device. -## Update Intune app -The Microsoft Intune app automatically updates when updates become available in Software Updater. +### Update app for Ubuntu Desktop +The Microsoft Intune app automatically updates when updates become available in Software Updater. Run the following commands to update the app manually. -Run these commands to update the Microsoft Intune app manually: -1. Update the package repo and metadata, which includes intune-portal, msft-broker, and msft edge: +1. Update the package repo and metadata, which includes `intune-portal`, `msft-broker`, and `msft edge`. ```bash sudo apt update ``` -2. Upgrade the packages and clean up dependencies: +2. Upgrade the packages and clean up dependencies. ```bash sudo apt-get dist-upgrade ``` -## Uninstall Intune app +### Uninstall app for Ubuntu Desktop +Run the following commands to uninstall the Microsoft Intune app and remove local registration data from devices running Ubuntu Desktop. -1. Remove the Intune app from your system: +1. Remove the Intune app from your system. ```bash sudo apt remove intune-portal ``` -2. Remove the local registration data. This command removes the local configuration data that contains your device registration: +2. Remove the local registration data. This command removes the local configuration data that contains your device registration. ```bash sudo apt purge intune-portal - ``` + ``` +## Install Microsoft Intune app for RedHat Enterprise Linux + +1. Add the Microsoft repository. + + ```bash + sudo rpm --import https://packages.microsoft.com/keys/microsoft.asc + sudo dnf config-manager --add-repo https://packages.microsoft.com/yumrepos/microsoft-rhel9.0-prod + ``` + +2. Install the Microsoft Intune app. + + ```bash + sudo dnf install intune-portal + ``` + +3. Reboot your device. + +### Update app for RedHat Enterprise Linux +Run one of the following commands to update the Microsoft Intune app. + +**Option 1**: + + ```bash + sudo dnf update + ``` + +**Option 2**: + ```bash + sudo dnf update intune-portal + ``` + +### Uninstall app for RedHat Enterprise Linux + +Run the following commands to uninstall the Microsoft Intune app and remove local registration data on devices running RedHat Enterprise Linux. + +1. Remove the Intune portal package. + + ```bash + sudo dnf remove intune-portal + ``` + +2. Remove local registration data. + + ```bash + sudo rm -rf /var/opt/microsoft/mdatp + sudo rm -rf /etc/opt/microsoft/mdatp + sudo rm -rf /opt/microsoft/mdatp + ``` diff --git a/memdocs/intune/user-help/sso-dialog-faqs.yml b/memdocs/intune/user-help/sso-dialog-faqs.yml new file mode 100644 index 00000000000..831a1678807 --- /dev/null +++ b/memdocs/intune/user-help/sso-dialog-faqs.yml @@ -0,0 +1,126 @@ +### YamlMime:FAQ +metadata: + title: FAQ - Adding your Microsoft Entra account to a device + description: Frequently asked questions about adding your Microsoft Entra account to a device and their answers. + author: DidunAyodeji + ms.author: dayodeji + ms.service: entra-id + ms.topic: faq + ms.date: 09/10/2024 + ms.reviewer: joflore + #customer intent: As an Entra account holder, I want to add my account to the device so that I am compliant with my organization's security requirements. +title: Adding your Microsoft Entra account to a device +summary: | + **The changes to the single sign-on enrollment page mentioned in this article are scheduled for October of 2024.** + + This article provides answers to some frequently asked questions (FAQ) about adding your Microsoft Entra account to a device. + +sections: + - name: Overview + questions: + - question: | + What is the single sign-on enrollment dialog page? + answer: | + The single sign-on (SSO) enrollment page is shown when you're trying to access protected resources through an app. The page is where you decide if you want to add your account to the device. When an app like Outlook tries to access a protected resource, you see the SSO enrollment page requesting you to add your account to the device. This functionality enables your administrator to make sure your device is compliant with your organization's security requirements. Adding your account to the device gives you the ability to seamlessly sign in to all your desktop apps. It also provides you with more security features. This dialog only appears when using your Microsoft Entra accounts. + + :::image type="content" source="media/sso-dialog-faqs/sso-consent-screen-no-mdm.png" alt-text="Screenshot of the SSO dialog enrollment page." lightbox="media/sso-dialog-faqs/sso-consent-screen-no-mdm.png"::: + + - question: | + What does selecting "Yes, all apps" do? + answer: | + You're automatically signed in to desktop apps that use your work or school account. You don't have to enter your credentials when you open these apps. + + - question: | + How do I sign out? + answer: | + On a Windows device, navigate to the **Settings** app > **Accounts** > **Access work or school** > Select your account > **Disconnect**. If you don't have access to the device you signed in to, go to [https://account.microsoft.com/devices](https://account.microsoft.com/devices) to manage your account and sign out. + + > [!NOTE] + > Signing out of any individual app doesn't remove your account from your device. Signing out of a desktop app doesn't remove your account from the device. You must sign out of all apps via settings or [https://account.microsoft.com/devices](https://account.microsoft.com/devices) to remove your account from the device. + + - question: | + What does selecting "No, this app only" do? + answer: | + You're signed in to the individual app that you're currently trying to sign in to. Your account isn't added to the device and it isn't shown in the Windows Settings app under Accounts. You aren't signed in to other apps. + + - name: Mobile device management + questions: + - question: | + What is mobile device management? + answer: | + [Mobile device management (MDM)](/windows/client-management/mdm-overview) lets your administrator manage security and applications on your personal or corporate device without compromising your privacy. It's how organizations make sure only devices that are up to date and configured with required security policies are able to access apps and resources. If your company enables mobile device management, you see the following version of the dialog and you can enroll by checking the **Allow my organization to manage this device** checkbox. + + :::image type="content" source="media/sso-dialog-faqs/sso-consent-screen-mdm.png" alt-text="Screenshot of the SSO dialog enrollment page with MDM enrollment." lightbox="media/sso-dialog-faqs/sso-consent-screen-mdm.png"::: + + - question: | + What can an administrator see if I enroll in MDM? + answer: | + [Things your administrator can always see.](/mem/intune/user-help/what-info-can-your-company-see-when-you-enroll-your-device-in-intune#things-your-organization-can-always-see) + + - question: | + What can an administrator never see even if I enroll in MDM? + answer: | + [Things your administrator can never see.](/mem/intune/user-help/what-info-can-your-company-see-when-you-enroll-your-device-in-intune#things-your-organization-can-never-see) + + - question: | + What happens if I check the device management checkbox but don't sign in to all apps, I sign in to this app only? + answer: | + [Mobile device management](/windows/client-management/mdm-overview) isn't activated. If you select "No, this app only," mobile device management isn't activated even if the checkbox is checked. Mobile device management can only be turned on if you select "Yes, all apps." + + - question: | + What happens if I uncheck the device management checkbox but sign in to all apps? + answer: | + You're signed in to all native and desktop apps on your device, but your device isn't enrolled in [mobile device management](/windows/client-management/mdm-overview). Your organization might require MDM to access some applications or resources, without it you might not have access. + + - question: | + What can my administrator do if I enroll in mobile device management? + answer: | + They're able to: + - Install applications on devices + - Restrict access to specific operating systems + - Deploy and update software + - Configure device settings + - Enforce security policies + - Block personal devices + - Remove data from lost or stolen devices + - Secure and protect data on devices + + - name: General + questions: + - question: | + Can I change my selections later? + answer: | + The SSO enrollment dialog page appears only once per account so to change your choices, sign out of the account then sign back in. When you sign back in, you see the SSO enrollment dialog page again. You can then make different selections. + + - question: | + Why am I seeing the SSO enrollment dialog page? + answer: | + All Microsoft Entra users are prompted to add their account to the device when signing in to an app because it can provide you with more security. This page is where you decide if you want to add your account to the device or not. If your administrator requires mobile device management, you get to decide if you want to enroll in mobile device management on this page as well. + + - question: | + What are the benefits of signing in to all apps on my device? + answer: | + In addition to being compliant with your organization's policies, you get more security features. You're also automatically signed in to all your desktop apps. + + - question: | + Do my choices here apply to other devices I'm signed in to? + answer: | + No, your choices on the SSO enrollment page apply to this device only. + + - question: | + What is the difference between a service and an app? + answer: | + A desktop app is a software program that you access directly on the computer and it runs locally on the computer. A web app is a combination of pages that you access via a browser and it runs in the cloud. A web app has links to help you navigate through multiple pages. + + A service enables communication between different apps that work with the internet. Web services work by exposing APIs (Application Programming Interfaces) and allow for the exchange of information between different apps across different platforms (mobile, Windows, Microsoft Edge). + + - question: | + For administrator reference + answer: | + [Conditional Access](/entra/identity/conditional-access/overview) policies are used by administrators to protect resources. + + Applications configured to work with Windows [Web Account Manager](/entra/identity-platform/scenario-desktop-acquire-token-wam) authentication broker provide you with SSO and other [security features](/entra/identity/conditional-access/concept-token-protection). + + All Microsoft Entra customers are prompted to sign in using Web Account Manager if the app and operating system support it. + + [Learn more about mobile device management](/mem/intune/fundamentals/what-is-device-management). diff --git a/memdocs/media/00009-icon-service-Log-Analytics-Workspaces.svg b/memdocs/media/00009-icon-service-Log-Analytics-Workspaces.svg deleted file mode 100644 index ec1c0ce91c4..00000000000 --- a/memdocs/media/00009-icon-service-Log-Analytics-Workspaces.svg +++ /dev/null @@ -1 +0,0 @@ -Icon-manage-307 \ No newline at end of file diff --git a/memdocs/media/10332-icon-service-Devices.svg b/memdocs/media/10332-icon-service-Devices.svg deleted file mode 100644 index 35561135f4c..00000000000 --- a/memdocs/media/10332-icon-service-Devices.svg +++ /dev/null @@ -1 +0,0 @@ -Icon-intune-332 \ No newline at end of file diff --git a/memdocs/media/active-directory.svg b/memdocs/media/active-directory.svg deleted file mode 100644 index 4a4d020cc2f..00000000000 --- a/memdocs/media/active-directory.svg +++ /dev/null @@ -1,56 +0,0 @@ - - - - - - - - - - Page-1 - - - Sheet.53 - - - - - - diff --git a/memdocs/media/analytics.svg b/memdocs/media/analytics.svg deleted file mode 100644 index 5d294245acd..00000000000 --- a/memdocs/media/analytics.svg +++ /dev/null @@ -1,61 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - Page-1 - - - Icon-manage-307 - - Sheet.44 - - - - Sheet.45 - - - - Sheet.46 - - - - Sheet.47 - - - - Sheet.48 - - - - - diff --git a/memdocs/media/autopatch.png b/memdocs/media/autopatch.png deleted file mode 100644 index 5dfff52e866..00000000000 Binary files a/memdocs/media/autopatch.png and /dev/null differ diff --git a/memdocs/media/autopatch.svg b/memdocs/media/autopatch.svg deleted file mode 100644 index f781d11c928..00000000000 --- a/memdocs/media/autopatch.svg +++ /dev/null @@ -1,65 +0,0 @@ - - - - - - - - - - Page-1 - - - Sheet.56 - - - - - - - - - - - - - - - - - - - - - - diff --git a/memdocs/media/autopilot.svg b/memdocs/media/autopilot.svg deleted file mode 100644 index 38c827eacf9..00000000000 --- a/memdocs/media/autopilot.svg +++ /dev/null @@ -1,44 +0,0 @@ - - - - - - - - - - Page-1 - - - Sheet.51 - - - - - - diff --git a/memdocs/media/configmgr.png b/memdocs/media/configmgr.png deleted file mode 100644 index 9cad2464f8d..00000000000 Binary files a/memdocs/media/configmgr.png and /dev/null differ diff --git a/memdocs/media/configmgr.svg b/memdocs/media/configmgr.svg deleted file mode 100644 index 10af691f68f..00000000000 --- a/memdocs/media/configmgr.svg +++ /dev/null @@ -1,54 +0,0 @@ - - - - - - - - - - Page-1 - - - Sheet.17 - - Completed_Icons - - Sheet.19 - - - - Sheet.20 - - Sheet.21 - - - - Sheet.22 - - - - Sheet.23 - - - - - - - diff --git a/memdocs/media/devices.svg b/memdocs/media/devices.svg deleted file mode 100644 index a2827694b9f..00000000000 --- a/memdocs/media/devices.svg +++ /dev/null @@ -1,83 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - Page-1 - - - Icon-intune-332 - - Sheet.10 - - - - Sheet.11 - - - - Sheet.12 - - - - Sheet.13 - - - - Sheet.14 - - - - Sheet.15 - - - - Sheet.16 - - - - - diff --git a/memdocs/media/endpoint-analytics.svg b/memdocs/media/endpoint-analytics.svg deleted file mode 100644 index 9d4f9149695..00000000000 --- a/memdocs/media/endpoint-analytics.svg +++ /dev/null @@ -1,41 +0,0 @@ - - - - - - - - - - Page-1 - - - Sheet.49 - - - - - - diff --git a/memdocs/media/get-support/service-requests-pane.png b/memdocs/media/get-support/service-requests-pane.png deleted file mode 100644 index 3ad72566d37..00000000000 Binary files a/memdocs/media/get-support/service-requests-pane.png and /dev/null differ diff --git a/memdocs/media/i_identity-protection.svg b/memdocs/media/i_identity-protection.svg deleted file mode 100644 index 619df2fa055..00000000000 --- a/memdocs/media/i_identity-protection.svg +++ /dev/null @@ -1 +0,0 @@ - \ No newline at end of file diff --git a/memdocs/media/i_security-management.svg b/memdocs/media/i_security-management.svg deleted file mode 100644 index 39c7704c0ed..00000000000 --- a/memdocs/media/i_security-management.svg +++ /dev/null @@ -1 +0,0 @@ - \ No newline at end of file diff --git a/memdocs/media/index/app-manage.svg b/memdocs/media/index/app-manage.svg deleted file mode 100644 index 42cde5f94d7..00000000000 --- a/memdocs/media/index/app-manage.svg +++ /dev/null @@ -1,69 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - Page-1 - - - Icon-intune-331.40 - - Sheet.41 - - - - - Sheet.78 - - Sheet.76 - - - - Sheet.75 - - - - - diff --git a/memdocs/media/index/app-protection.svg b/memdocs/media/index/app-protection.svg deleted file mode 100644 index b5a5f2e68a7..00000000000 --- a/memdocs/media/index/app-protection.svg +++ /dev/null @@ -1,74 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - Page-1 - - - Icon-intune-331 - - Sheet.2 - - - - - Sheet.20 - - Sheet.10 - - Sheet.4 - - - - - Sheet.9 - - Sheet.5 - - - - - - diff --git a/memdocs/media/index/cloud-native.svg b/memdocs/media/index/cloud-native.svg deleted file mode 100644 index 182ca6ea55f..00000000000 --- a/memdocs/media/index/cloud-native.svg +++ /dev/null @@ -1,13 +0,0 @@ - - - - - - - - - - - Icon-Cloud-other-357 - - \ No newline at end of file diff --git a/memdocs/media/index/device-secure.svg b/memdocs/media/index/device-secure.svg deleted file mode 100644 index 1bcbdafffaa..00000000000 --- a/memdocs/media/index/device-secure.svg +++ /dev/null @@ -1,112 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - Page-1 - - - Sheet.170 - - Sheet.139 - - - - Sheet.140 - - - - Sheet.141 - - - - Sheet.142 - - - - Sheet.143 - - - - Sheet.144 - - - - Sheet.145 - - - - Sheet.151 - - Sheet.152 - - Sheet.153 - - - - - Sheet.154 - - Sheet.155 - - - - - - - diff --git a/memdocs/media/index/get-started_gray.svg b/memdocs/media/index/get-started_gray.svg deleted file mode 100644 index 07acd8a06e3..00000000000 --- a/memdocs/media/index/get-started_gray.svg +++ /dev/null @@ -1,22 +0,0 @@ - - - - -get_started - - - - - - - - - diff --git a/memdocs/media/index/multifactor-authentication.svg b/memdocs/media/index/multifactor-authentication.svg deleted file mode 100644 index 386c57574b4..00000000000 --- a/memdocs/media/index/multifactor-authentication.svg +++ /dev/null @@ -1 +0,0 @@ - \ No newline at end of file diff --git a/memdocs/media/index/plan_gray.svg b/memdocs/media/index/plan_gray.svg deleted file mode 100644 index c029ee3afdc..00000000000 --- a/memdocs/media/index/plan_gray.svg +++ /dev/null @@ -1,22 +0,0 @@ - - - - -task_checklist_planning - - - - - - - - - - - - - diff --git a/memdocs/media/learn.svg b/memdocs/media/learn.svg deleted file mode 100644 index 3ca62cc0a85..00000000000 --- a/memdocs/media/learn.svg +++ /dev/null @@ -1,144 +0,0 @@ - - - - - - - - - - Page-1 - - - Sheet.55 - - - - - - diff --git a/memdocs/media/microsoft-intune.png b/memdocs/media/microsoft-intune.png deleted file mode 100644 index 8f4f4eff31e..00000000000 Binary files a/memdocs/media/microsoft-intune.png and /dev/null differ diff --git a/memdocs/media/microsoft-intune.svg b/memdocs/media/microsoft-intune.svg deleted file mode 100644 index 133ab4fa08b..00000000000 --- a/memdocs/media/microsoft-intune.svg +++ /dev/null @@ -1,81 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - Page-1 - - - Icon-intune-329 - - Sheet.2 - - - - Sheet.3 - - - - Sheet.4 - - - - Sheet.5 - - - - Sheet.6 - - - - Sheet.7 - - - - Sheet.8 - - - - - diff --git a/memdocs/media/privilege.svg b/memdocs/media/privilege.svg deleted file mode 100644 index b10857e8f89..00000000000 --- a/memdocs/media/privilege.svg +++ /dev/null @@ -1,64 +0,0 @@ - - - - - - - - - - Page-1 - - - Sheet.52 - - - - - - diff --git a/memdocs/solutions/frontline-worker/frontline-worker-overview-windows.md b/memdocs/solutions/frontline-worker/frontline-worker-overview-windows.md index 1de17a41b4a..0d117288d09 100644 --- a/memdocs/solutions/frontline-worker/frontline-worker-overview-windows.md +++ b/memdocs/solutions/frontline-worker/frontline-worker-overview-windows.md @@ -4,7 +4,7 @@ description: Learn how to manage frontline worker devices using Windows devices ms.author: mandia author: MandiOhlinger manager: dougeby -ms.date: 10/25/2023 +ms.date: 08/19/2024 audience: ITPro ms.topic: how-to ms.service: microsoft-intune @@ -55,28 +55,30 @@ Use this article to get started with Windows FLW devices in Intune. Specifically These devices enroll in Intune, and are managed like any other device, including apps, configuration settings, and updates. -For more information on Windows 365 Cloud PCs, and to learn more, go to: +For information on Windows 365 Cloud PCs, and to learn more, go to: - [Windows 365 Cloud PCs overview - Enterprise](/windows-365/enterprise/overview) - [Windows 365 Cloud PCs overview - Small & medium business](/windows-365/business/get-started-windows-365-business) ## Step 1 - Select your enrollment option -The first step is to determine the enrollment platform that's best for your organization. +✅ **Determine the enrollment option** that's best for your organization. -For FLW devices using the Windows platform, you can use **Windows Autopilot** enrollment or use a **provisioning package**. This section focuses on these enrollment options. +Determining the enrollment option is the first step. Enrollment determines how the devices are added to Intune for you to manage. The option you choose depends on your business needs and the devices you have. + +For FLW devices using Windows, you can use **Windows Autopilot** enrollment or use a **provisioning package**. This section focuses on these enrollment options. # [Windows Autopilot](#tab/autopilot) **Windows Autopilot** is the recommended option for FLW devices. You can ship the devices directly to the location without ever touching the devices. With self-deploying mode, users turn on the device, and the enrollment automatically starts. -✅ If you have Microsoft Entra Premium and you're getting new devices from an OEM, then use Windows Autopilot. You can use the Windows OEM version preinstalled on the devices to automatically enroll the devices. Other than turning on the device, no other end user interaction is required. +✅ If you have Microsoft Entra Premium and you're getting new devices from an OEM, then use Windows Autopilot. You can use the Windows OEM version preinstalled on the devices to automatically enroll the devices. End users only need to turn on the device; no other end user interaction is required. You can use Windows Autopilot on existing devices. When the existing devices are reset, the Windows Autopilot enrollment can automatically start. ❌ Windows Autopilot requires Microsoft Entra Premium. If you don't have Entra Premium, then use a provisioning package. There are other Windows enrollment options available, but they're not commonly used for FLW devices. -For more information on Windows Autopilot, go to [Windows Autopilot overview](/autopilot/overview) and [Windows Autopilot self-deploying mode](/autopilot/self-deploying). +For information on Windows Autopilot, go to [Windows Autopilot overview](/autopilot/overview) and [Windows Autopilot self-deploying mode](/autopilot/self-deploying). # [Provisioning package](#tab/provpackage) @@ -86,39 +88,45 @@ This option uses the Windows Configuration Designer (WCD) app to create a provis ❌ If you have Microsoft Entra Premium, then use Windows Autopilot. Windows Autopilot requires Entra Premium. -For more information on using a provisioning package with Intune, go to [Bulk enrollment for Windows devices](../../intune/enrollment/windows-bulk-enroll.md). +For information on using a provisioning package with Intune, go to [Bulk enrollment for Windows devices](../../intune/enrollment/windows-bulk-enroll.md). --- > [!NOTE] -> There are other Windows enrollment options available. This article focuses on the enrollment options commonly used for FLW devices. For more information on all the Windows enrollment options, go to [Enrollment guide: Enroll Windows client devices in Microsoft Intune](../../intune/fundamentals/deployment-guide-enrollment-windows.md). +> There are other Windows enrollment options available. This article focuses on the enrollment options commonly used for FLW devices. For information on all the Windows enrollment options, go to [Enrollment guide: Enroll Windows client devices in Microsoft Intune](../../intune/fundamentals/deployment-guide-enrollment-windows.md). ## Step 2 - Shared device or user associated device -The next decision is to determine if the devices are shared with many users or assigned to a single user. This decision depends on your business needs and the end user requirements. It also impacts how these devices are managed with Intune. +✅ Determine if the devices are **shared with many users** or **assigned to a single user**. + +In this step, this decision depends on your business needs and the end user requirements. It also impacts how these devices are managed with Intune. These features are configured using Intune device configuration profiles. When the profile has the settings you want, you assign the profile to the devices. The profile can be deployed during Intune enrollment. -- **Shared device** +# [Shared device](#tab/shared) - **Shared PC** is a feature in Intune, and allows devices to be shared with many users, one user at a time. A user gets the device, completes their tasks, and gives the device to another user. End users sign in to these shared devices with their **Microsoft Entra organization account** or a **guest account**. With this feature, you can delete account information and allow (or prevent) users from saving & viewing files locally. +**Shared PC** is a feature in Intune, and allows devices to be shared with many users, one user at a time. A user gets the device, completes their tasks, and gives the device to another user. End users sign in to these shared devices with their **Microsoft Entra organization account** or a **guest account**. With this feature, you can delete account information and allow (or prevent) users from saving & viewing files locally. - For example, shared Windows devices can be public computers in libraries, computer labs in schools & universities, shared workstations in offices, shared laptops in classrooms, and more. +For example, shared Windows devices can be public computers in libraries, computer labs in schools & universities, shared workstations in offices, and shared laptops in classrooms. - For more information on this feature, and to get started, go to: +For information on this feature, and to get started, go to: - - [Shared PC or multi-user Windows devices in Intune](../../intune/configuration/shared-user-device-settings-windows.md) - - [Shared PC or multi-user Windows devices in Intune - Settings list](../../intune/configuration/shared-user-device-settings.md) +- [Shared PC or multi-user Windows devices in Intune](../../intune/configuration/shared-user-device-settings-windows.md) +- [Shared PC or multi-user Windows devices in Intune - Settings list](../../intune/configuration/shared-user-device-settings.md) -- **User associated device** +# [User associated device](#tab/single) - These devices have one user. This user associates the device with themselves, which happens when the user signs in during the Intune enrollment. The device is associated with the user's identity in Microsoft Entra. +These devices have one user. This user associates the device with themselves, which happens when the user signs in during the Intune enrollment. The device is associated with the user's identity in Microsoft Entra. - These devices are used in FLW scenarios where the device is only used by that user. Some examples include personal computers for support staff, design computers for architects & graphic artists, and work-from-home setups. +These devices are used in FLW scenarios where the device is only used by that user. Some examples include personal computers for support staff, design computers for architects & graphic artists, and work-from-home setups. + +--- ## Step 3 - Device experience and kiosk -This step is optional and depends on your business scenario. If these devices are shared by many users, then it's recommended to use the device experience features described in this section. +✅ **Configure the device experience**. + +This step is optional and depends on your business scenario. If many users share these devices, then we recommended you configure the device experience using the features described in this section. On Windows devices, you can configure the home screen and device experience. In this step, consider what frontline workers are doing on the devices and the device experience they need for their jobs. This decision impacts how you configure the device. @@ -126,48 +134,48 @@ Some examples of kiosks include self-service terminals in airports, retail store These features are configured using device configuration profiles. When the profile has the settings you want, you assign the profile to the devices. The profile can be deployed during Intune enrollment. -The following scenarios are common: +The following scenarios are common. -- **Scenario 1: Kiosk with one app or many apps** +### Scenario 1 - Kiosk with one app or many apps - For this scenario, you configure the device as a kiosk, which allows you to customize the device experience. +For this scenario, you configure the device as a kiosk, which allows you to customize the device experience. - For example, you can use the device in a lobby so customers can see your product catalog. Or, use the device to show visual content as a digital sign. For more information, go to [Configure kiosks and digital signs on Windows desktop editions](/windows/configuration/kiosk-methods) (opens another Microsoft web site). +For example, you can use the device in a lobby so customers can see your product catalog. Or, use the device to show visual content as a digital sign. For information, go to [Configure kiosks and digital signs on Windows desktop editions](/windows/configuration/kiosk-methods) (opens another Microsoft web site). - You can pin one app or many apps, select a wallpaper, set icon positions, and more. This scenario is often used for dedicated devices, such as shared devices. You can create a Shared PC profile and configure it be a kiosk using the kiosk settings in Intune. +You can pin one app or many apps, select a wallpaper, set icon positions, and more. This scenario is often used for dedicated devices, such as shared devices. You can create a Shared PC profile and configure it be a kiosk using the kiosk settings in Intune. - **What you need to know**: +**What you need to know**: - - Only features added to the kiosk are available to end users. So, you can restrict end users from accessing settings and other device features. - - When you pin one app or pin many apps to the kiosk, only those apps open. They're the only apps users can access. Users are locked to those apps, can't close the apps, or do anything else on the devices. This scenario is used on devices dedicated to a specific use, like airport terminals. +- Only features added to the kiosk are available to end users. So, you can restrict end users from accessing settings and other device features. +- When you pin one app or pin many apps to the kiosk, only those apps open. They're the only apps users can access. Users are locked to those apps, can't close the apps, or do anything else on the devices. This scenario is used on devices dedicated to a specific use, like airport terminals. - To get started, use the following links: +To get started, use the following links: - 1. [Add apps to Microsoft Intune](../../intune/apps/apps-add.md). When the apps are added, you create app policies that deploy the apps to the devices. - 2. Create a device configuration [kiosk profile](../../intune/configuration/kiosk-settings.md) and configure the [Windows kiosk profile - settings list](../../intune/configuration/kiosk-settings.md). +1. [Add apps to Microsoft Intune](../../intune/apps/apps-add.md). When the apps are added, you create app policies that deploy the apps to the devices. +2. Create a device configuration [kiosk profile](../../intune/configuration/kiosk-settings.md) and configure the [Windows kiosk profile - settings list](../../intune/configuration/kiosk-settings.md). - The following example shows the kiosk profile settings for a single app. Make sure you add the app to Intune before you configure the kiosk profile. + The following example shows the kiosk profile settings for a single app. Make sure you add the app to Intune before you configure the kiosk profile. - :::image type="content" source="./media/windows-kiosk-single-app.png" alt-text="The kiosk device configuration profile settings for a single app on Windows devices in Microsoft Intune." lightbox="./media/windows-kiosk-single-app.png"::: + :::image type="content" source="./media/windows-kiosk-single-app.png" alt-text="The kiosk device configuration profile settings for a single app on Windows devices in Microsoft Intune." lightbox="./media/windows-kiosk-single-app.png"::: - The following example shows the kiosk profile settings for multiple apps. Make sure you add the apps to Intune before you configure the kiosk profile. + The following example shows the kiosk profile settings for multiple apps. Make sure you add the apps to Intune before you configure the kiosk profile. - :::image type="content" source="./media/windows-kiosk-multi-app.png" alt-text="The kiosk device configuration profile settings for multiple apps on Windows devices in Microsoft Intune." lightbox="./media/windows-kiosk-multi-app.png"::: + :::image type="content" source="./media/windows-kiosk-multi-app.png" alt-text="The kiosk device configuration profile settings for multiple apps on Windows devices in Microsoft Intune." lightbox="./media/windows-kiosk-multi-app.png"::: -- **Scenario 2: Device wide access with multiple apps** +### Scenario 2 - Device wide access with many apps - This scenario is a good scenario for Windows 365 Cloud PCs. Users have access to the apps and settings on the device. You can restrict users from different features, such as simple passwords, features in the Settings app, and more. +This scenario is a good scenario for Windows 365 Cloud PCs. Users have access to the apps and settings on the device. You can restrict users from different features, such as simple passwords, features in the Settings app, and more. - This scenario also applies to physical devices. It expands the boundary of traditional frontline worker scenarios by also including knowledge workers. +This scenario also applies to physical devices. It expands the boundary of traditional frontline worker scenarios by also including knowledge workers. - To configure devices for this scenario, you deploy the apps to the devices. Then, use device configuration policies to allow or block device features. +To configure devices for this scenario, you deploy the apps to the devices. Then, use device configuration policies to allow or block device features. - To get started, use the following links: +To get started, use the following links: - 1. [Add apps to Microsoft Intune](../../intune/apps/apps-add.md). When the apps are added, you create app policies that deploy the apps to the devices. - 2. Create a device configuration restrictions profile that [allows or restricts features using Intune](../../intune/configuration/device-restrictions-windows-10.md). There are hundreds of settings available for you to configure, including more in the [Settings Catalog](../../intune/configuration/settings-catalog.md). +1. [Add apps to Microsoft Intune](../../intune/apps/apps-add.md). When the apps are added, you create app policies that deploy the apps to the devices. +2. Create a device configuration restrictions profile that [allows or restricts features using Intune](../../intune/configuration/device-restrictions-windows-10.md). There are hundreds of settings available for you to configure, including more in the [Settings Catalog](../../intune/configuration/settings-catalog.md). - :::image type="content" source="./media/windows-device-restrictions.png" alt-text="All the device restrictions settings for Windows devices in Microsoft Intune."::: + :::image type="content" source="./media/windows-device-restrictions.png" alt-text="All the device restrictions settings for Windows devices in Microsoft Intune."::: ## Related articles diff --git a/memdocs/solutions/frontline-worker/frontline-worker-overview.md b/memdocs/solutions/frontline-worker/frontline-worker-overview.md index b4c641d7376..c2f8d88d87d 100644 --- a/memdocs/solutions/frontline-worker/frontline-worker-overview.md +++ b/memdocs/solutions/frontline-worker/frontline-worker-overview.md @@ -1,10 +1,10 @@ --- title: Get started with frontline worker (FLW) device management -description: Learn how to manage frontline worker devices using Android, iOS/iPadOS, and Windows devices in Microsoft Intune. Get guidance on how the devices are used and Intune features built for FLW, like Remote Help. Also, learn about Microsoft Entra shared device mode (SDM) for FLW. +description: Learn how to manage frontline worker devices using Android, iOS/iPadOS, and Windows devices in Microsoft Intune. Get guidance on device use and Intune features built for FLW, like Remote Help. Also, learn about Microsoft Entra shared device mode (SDM) for FLW. ms.author: mandia author: MandiOhlinger manager: dougeby -ms.date: 10/25/2023 +ms.date: 08/19/2024 audience: ITPro ms.topic: how-to ms.service: microsoft-intune @@ -25,7 +25,7 @@ ms.collection: # Frontline worker device management overview in Microsoft Intune -A frontline worker (FLW) is a person that works in an essential or critical role to your business. They're typically in direct contact with the public and customers. During a crisis or emergency, such as a pandemic or natural disaster, frontline workers are often at the forefront of the response effort, providing critical services and support. +A frontline worker (FLW) is a person that works in an essential or critical role to your business. They're typically in direct contact with the public and customers. During a crisis or emergency, like a pandemic or natural disaster, frontline workers are often at the forefront of the response effort, providing critical services and support. Some popular examples of frontline workers include healthcare, emergency responders, law enforcement, retail & food service, and transportation. @@ -38,7 +38,7 @@ The articles in this section apply to: > [!NOTE] > FLW devices are typically owned by the organization. End user personal devices can be used as FLW devices, but personal devices aren't covered in these articles. This set of articles focus on corporate-owned devices. -Frontline workers also rely on devices to enable their productivity, such as devices used to scan barcodes or devices utilized for field operations. If these devices fail, worker productivity and business operation can stop. Often, these types of devices can be categorized as mission critical. +Frontline workers rely on devices to enable their productivity, like devices used to scan barcodes or devices utilized for field operations. If these devices fail, worker productivity and business operation can stop. Often, these types of devices can be categorized as mission critical. The articles in this section provide guidance on managing and configuring frontline worker (FLW) devices using Intune. These devices play a key role in running business operations. And, they're an extension of the operator who uses and relies on the device to be productive for day-to-day business operations. @@ -48,7 +48,7 @@ When you're planning for FLW devices (including rugged devices) and how you mana - Determine how the **devices will be used**. - For example, you can provide a device wide experience where frontline workers access all the apps and settings on the device. Or, provide a locked screen experience where frontline workers only access specific apps. You can configure the device for a single purpose, such as scanning inventory, or for multiple purposes, such as using an app to check in customers and using another app to check email. + For example, you can provide a device wide experience where frontline workers access all the apps and settings on the device. Or, provide a locked screen experience where frontline workers only access specific apps. You can configure the device for a single purpose, like scanning inventory. Or, configure the device for multiple purposes, like using an app to check in customers and using another app to check email. Intune has built-in kiosk features that can run one app or run many apps for Android, iPadOS, and Windows. This article provides more details about these device management scenarios. @@ -58,9 +58,9 @@ When you're planning for FLW devices (including rugged devices) and how you mana Intune has built-in features that offer shared device management for Android, iPadOS, and Windows devices. This article provides more details about shared devices, and the decisions you need to make. -- Determine the **sign-in/sign-out experience** and how user switching will happen, including device hand-off. For example, before cradling the device for charging, you might want users to sign out of apps. +- Determine the **sign-in/sign-out experience** and how user switching happens, including device hand-off. For example, before cradling the device for charging, you might want users to sign out of apps. - Intune has built-in features that allow users to sign in as a guest, sign in with their Entra organization credentials, or only sign into apps. There are also features that use single sign-on and single sign out for your apps. This article provides more details about these features. + Intune has built-in features that allow users to sign in as a guest, sign in with their Microsoft Entra organization credentials, or only sign into apps. There are also features that use single sign-on and single sign-out for your apps. This article provides more details about these features. - Determine the **starting app experience**. For example, users can sign in to the device and then launch an app, or users can get the device and have an app automatically start. @@ -95,19 +95,19 @@ Intune has built-in features that can be used for frontline worker devices, incl These devices include augmented reality (AR) & virtual reality (VR) headsets, large smart-screen devices, and some conference room meeting devices, like Microsoft Teams Rooms devices. They can be managed using Intune policies. > [!NOTE] -> Some features may require additional licenses. For more information, go to [ntune Suite add-on capabilities](../../intune/fundamentals/intune-add-ons.md) or [Microsoft Intune licensing](../../intune/fundamentals/licenses.md). +> Some features may require additional licenses. For more information, go to [Intune Suite add-on capabilities](../../intune/fundamentals/intune-add-ons.md) or [Microsoft Intune licensing](../../intune/fundamentals/licenses.md). ## Microsoft Entra shared device mode for FLW -Microsoft Entra shared device mode (SDM) is designed for frontline workers (FLW). It's an Entra feature that focuses on building apps so the apps can be used by many users on the same device. Users sign in/sign out of apps, have all their data removed, and have the device ready for the next user. +Microsoft Entra shared device mode (SDM) is designed for frontline workers (FLW). It's an Entra feature that focuses on building apps so many users can use the apps on the same device. Users sign in/sign out of apps, have all their data removed, and have the device ready for the next user. Some of the benefits of Entra SDM include: - Entra SDM supports multiple users on devices designed for one user. Some mobile devices running Android and iOS are designed for single users. Most apps optimize their experience for a single user. Apps built with Entra SDM support multiple users on one device. -- Entra SDM does automatic single sign in and single sign out. Employees can sign in once and get single sign-on (SSO) to all apps that support Entra SDM, giving them faster access to information. +- Entra SDM does automatic single sign-in and single sign-out. Employees can sign in once and get single sign-on (SSO) to all apps that support Entra SDM, giving them faster access to information. - This feature is good for organizations that use a set of apps in a device pool that's shared by employees. Devices can be immediately ready for use by the next employee with no access to the previous user's data. + This feature is good for organizations with a set of apps in a device pool that employees share. Devices can be immediately ready for use by the next employee with no access to the previous user's data. - Apps built for Entra SDM use the Microsoft Authentication Library (MSAL) and the Microsoft Authenticator app. When a device is in shared device mode, and with (MSAL) and the Microsoft Authenticator app, Microsoft provides information to your app. This information allows the app to modify its behavior based on the state of the user on the device, which helps protect user data. @@ -120,19 +120,19 @@ For more information on Entra SDM, go to [Overview of shared device mode](/azure ## More Microsoft services for FLW -**Microsoft 365 for frontline workers** is a licensing option that's designed for frontline worker scenarios. It's ideal for a mobile workforce that primarily interacts with customers and needs to stay connected to the rest of the organization. It interacts with other apps and services, including Microsoft Teams, Outlook, SharePoint, and more. +**Microsoft 365 for frontline workers** is a licensing option designed for frontline worker scenarios. It's ideal for a mobile workforce that primarily interacts with customers and needs to stay connected to the rest of the organization. It interacts with other apps and services, including Microsoft Teams, Outlook, SharePoint, and more. For more information and to get started, go to: - [Get started with Microsoft 365 for frontline workers](/microsoft-365/frontline/flw-overview) - [Choose your scenarios for Microsoft 365 for frontline workers](/microsoft-365/frontline/flw-choose-scenarios) -**Windows 365 Frontline** is a version of Windows 365 that provides a single license to provision some Cloud PC virtual machines. It can help organizations save costs. It's ideal for workers who share computing resources and don't require 24/7 devices, including users who are: +**Windows 365 Frontline** is a version of Windows 365 that provides a single license to provision some Cloud PC virtual machines. It can help organizations save costs. It's ideal for workers who share computing resources and don't require 24/7 devices, including users who: -- On a rotation schedule -- Working across time zones and regions -- Part-time workers -- Contingent staff +- Are on a rotation schedule +- Work across time zones and regions +- Are part-time workers +- Are contingent staff For more information and to get started, go to: diff --git a/memdocs/solutions/frontline-worker/media/android-fully-managed-kiosk.png b/memdocs/solutions/frontline-worker/media/android-fully-managed-kiosk.png deleted file mode 100644 index 92da632e508..00000000000 Binary files a/memdocs/solutions/frontline-worker/media/android-fully-managed-kiosk.png and /dev/null differ diff --git a/memdocs/solutions/media/cloud-native-windows-endpoints/cloud-native-endpoint-graphic.png b/memdocs/solutions/media/cloud-native-windows-endpoints/cloud-native-endpoint-graphic.png deleted file mode 100644 index 4a1f3dddef6..00000000000 Binary files a/memdocs/solutions/media/cloud-native-windows-endpoints/cloud-native-endpoint-graphic.png and /dev/null differ diff --git a/windows-365/business-continuity-disaster-recovery.md b/windows-365/business-continuity-disaster-recovery.md index d990136ade8..0dea3973f92 100644 --- a/windows-365/business-continuity-disaster-recovery.md +++ b/windows-365/business-continuity-disaster-recovery.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 05/09/2023 +ms.date: 08/28/2024 ms.topic: overview ms.service: windows-365 ms.subservice: diff --git a/windows-365/business-enterprise-comparison.md b/windows-365/business-enterprise-comparison.md index 32986634565..55cd2966b8c 100644 --- a/windows-365/business-enterprise-comparison.md +++ b/windows-365/business-enterprise-comparison.md @@ -7,10 +7,10 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 05/14/2023 +ms.date: 08/28/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/business/add-user-assign-licenses.md b/windows-365/business/add-user-assign-licenses.md index 8074ae97295..4cb6db510cc 100644 --- a/windows-365/business/add-user-assign-licenses.md +++ b/windows-365/business/add-user-assign-licenses.md @@ -19,7 +19,7 @@ ms.assetid: #ROBOTS: #audience: -ms.reviewer: +ms.reviewer: nandis ms.suite: ems search.appverid: MET150 #ms.tgt_pltfrm: diff --git a/windows-365/business/cloud-pc-location.md b/windows-365/business/cloud-pc-location.md index 8b77f78bfab..ba5273854b5 100644 --- a/windows-365/business/cloud-pc-location.md +++ b/windows-365/business/cloud-pc-location.md @@ -6,7 +6,7 @@ f1.keywords: ms.author: erikje author: ErikjeMS manager: dougeby -ms.date: 05/09/2023 +ms.date: 08/28/2024 audience: Admin ms.topic: article ms.service: windows-365 diff --git a/windows-365/business/device-management.md b/windows-365/business/device-management.md index 3a3f1cb6f07..9f1403438fb 100644 --- a/windows-365/business/device-management.md +++ b/windows-365/business/device-management.md @@ -6,7 +6,7 @@ f1.keywords: ms.author: erikje author: ErikjeMS manager: dougeby -ms.date: 06/15/2023 +ms.date: 08/28/2024 audience: Admin ms.topic: how-to ms.service: windows-365 diff --git a/windows-365/business/known-issues.md b/windows-365/business/known-issues.md index 47e4a9bc045..38acf8bc5a8 100644 --- a/windows-365/business/known-issues.md +++ b/windows-365/business/known-issues.md @@ -6,7 +6,7 @@ f1.keywords: ms.author: erikje author: ErikjeMS manager: dougeby -ms.date: 06/15/2023 +ms.date: 08/28/2024 audience: Admin ms.topic: troubleshooting ms.service: windows-365 diff --git a/windows-365/business/media/add-user-assign-licenses/licenses.png b/windows-365/business/media/add-user-assign-licenses/licenses.png deleted file mode 100644 index 815294b67e3..00000000000 Binary files a/windows-365/business/media/add-user-assign-licenses/licenses.png and /dev/null differ diff --git a/windows-365/business/media/add-user-assign-licenses/select-products.png b/windows-365/business/media/add-user-assign-licenses/select-products.png deleted file mode 100644 index 30c201df25c..00000000000 Binary files a/windows-365/business/media/add-user-assign-licenses/select-products.png and /dev/null differ diff --git a/windows-365/business/media/change-organization-default-settings/change-organization-default-settings.png b/windows-365/business/media/change-organization-default-settings/change-organization-default-settings.png deleted file mode 100644 index 90e0e142de1..00000000000 Binary files a/windows-365/business/media/change-organization-default-settings/change-organization-default-settings.png and /dev/null differ diff --git a/windows-365/business/media/get-started-windows-365-business/remote-desktop-apps.png b/windows-365/business/media/get-started-windows-365-business/remote-desktop-apps.png deleted file mode 100644 index 7ed1a267d7b..00000000000 Binary files a/windows-365/business/media/get-started-windows-365-business/remote-desktop-apps.png and /dev/null differ diff --git a/windows-365/business/reset-user-password.md b/windows-365/business/reset-user-password.md index a1a2d4f3943..bcfe4009b50 100644 --- a/windows-365/business/reset-user-password.md +++ b/windows-365/business/reset-user-password.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 06/16/2023 +ms.date: 08/28/2024 ms.topic: how-to ms.service: windows-365 ms.subservice: diff --git a/windows-365/business/restore-overview.md b/windows-365/business/restore-overview.md index b85a8333a64..125f0571d85 100644 --- a/windows-365/business/restore-overview.md +++ b/windows-365/business/restore-overview.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 09/13/2023 +ms.date: 08/28/2024 ms.topic: conceptual ms.service: windows-365 ms.subservice: diff --git a/windows-365/business/windows-365-business-sizing.md b/windows-365/business/windows-365-business-sizing.md index 6f97a5a719e..ce0b7d1fbe7 100644 --- a/windows-365/business/windows-365-business-sizing.md +++ b/windows-365/business/windows-365-business-sizing.md @@ -6,7 +6,7 @@ f1.keywords: ms.author: erikje author: ErikjeMS manager: dougeby -ms.date: 10/20/2023 +ms.date: 08/28/2024 audience: Admin ms.topic: article ms.service: windows-365 @@ -35,8 +35,8 @@ Windows 365 Business offers fixed-price licensing (through Microsoft 365) for This table shows examples of the different sizes available for a Cloud PC. -> [!NOTE] -> If Microsoft 365 Apps and Microsoft Teams are included in the **Supported apps** column, they are pre-installed for those Cloud PC options. +> [!NOTE] +> If Microsoft 365 Apps and Microsoft Teams are included in the **Supported apps** column, they are pre-installed for those Cloud PC options. Additional licensing is required for these apps. |CPUs, RAM, and storage|Example scenarios|Supported apps| |:-------------------------------------------------------------------------------|:----------------------------------|:----------------------------------| diff --git a/windows-365/docfx.json b/windows-365/docfx.json index dd38e5854e3..9c1ce909027 100644 --- a/windows-365/docfx.json +++ b/windows-365/docfx.json @@ -83,7 +83,9 @@ "claydetels19", "beccarobins", "Stacyrch140", - "American-Dipper" + "American-Dipper", + "padmagit77", + "aditisrivastava07" ] }, "fileMetadata": { diff --git a/windows-365/enterprise/add-device-images.md b/windows-365/enterprise/add-device-images.md index 4bf3460bfb8..78e75254b45 100644 --- a/windows-365/enterprise/add-device-images.md +++ b/windows-365/enterprise/add-device-images.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 05/07/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/alerts.md b/windows-365/enterprise/alerts.md index b935b5b40e6..05a6ebe2e55 100644 --- a/windows-365/enterprise/alerts.md +++ b/windows-365/enterprise/alerts.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 02/14/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/app-assure.md b/windows-365/enterprise/app-assure.md index e3b8fafcf67..1457b96a09f 100644 --- a/windows-365/enterprise/app-assure.md +++ b/windows-365/enterprise/app-assure.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 07/24/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/app-overview.md b/windows-365/enterprise/app-overview.md index a4df186af3f..d73ac5fa35c 100644 --- a/windows-365/enterprise/app-overview.md +++ b/windows-365/enterprise/app-overview.md @@ -7,10 +7,10 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 06/15/2023 +ms.date: 08/28/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/architecture.md b/windows-365/enterprise/architecture.md index 4c518ce0c45..03d9b335a38 100644 --- a/windows-365/enterprise/architecture.md +++ b/windows-365/enterprise/architecture.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 07/09/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/assign-apps.md b/windows-365/enterprise/assign-apps.md index 4d0677b631b..1e08f39fee3 100644 --- a/windows-365/enterprise/assign-apps.md +++ b/windows-365/enterprise/assign-apps.md @@ -7,10 +7,10 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 09/13/2023 +ms.date: 08/28/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/assign-licenses.md b/windows-365/enterprise/assign-licenses.md index ff6c5ca692e..9140b46e0a9 100644 --- a/windows-365/enterprise/assign-licenses.md +++ b/windows-365/enterprise/assign-licenses.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 07/24/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/assign-users-as-local-admin.md b/windows-365/enterprise/assign-users-as-local-admin.md index f30fb4d90bf..4ff38b43105 100644 --- a/windows-365/enterprise/assign-users-as-local-admin.md +++ b/windows-365/enterprise/assign-users-as-local-admin.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 07/26/2023 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/automated-provisioning-steps.md b/windows-365/enterprise/automated-provisioning-steps.md index f80e191eb62..d3e22d2494d 100644 --- a/windows-365/enterprise/automated-provisioning-steps.md +++ b/windows-365/enterprise/automated-provisioning-steps.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 07/31/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/azure-firewall-windows-365.md b/windows-365/enterprise/azure-firewall-windows-365.md index 1e8470c2841..7ae90760a09 100644 --- a/windows-365/enterprise/azure-firewall-windows-365.md +++ b/windows-365/enterprise/azure-firewall-windows-365.md @@ -7,10 +7,10 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 04/22/2024 +ms.date: 08/28/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/azure-network-connection-domain-credential.md b/windows-365/enterprise/azure-network-connection-domain-credential.md index ba6e48e6004..474fb4b27ba 100644 --- a/windows-365/enterprise/azure-network-connection-domain-credential.md +++ b/windows-365/enterprise/azure-network-connection-domain-credential.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 04/29/2023 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/azure-network-connections.md b/windows-365/enterprise/azure-network-connections.md index 6d05f21a8e5..29ded36f1fa 100644 --- a/windows-365/enterprise/azure-network-connections.md +++ b/windows-365/enterprise/azure-network-connections.md @@ -7,10 +7,10 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 09/26/2023 +ms.date: 08/28/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/chroma-value-change-default.md b/windows-365/enterprise/chroma-value-change-default.md index 189a6e73133..83254d78e4a 100644 --- a/windows-365/enterprise/chroma-value-change-default.md +++ b/windows-365/enterprise/chroma-value-change-default.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 07/10/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/cisco-webex-support.md b/windows-365/enterprise/cisco-webex-support.md index f2d69244ad5..072eddc5876 100644 --- a/windows-365/enterprise/cisco-webex-support.md +++ b/windows-365/enterprise/cisco-webex-support.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 09/13/2023 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/cloud-pc-maintenance-windows.md b/windows-365/enterprise/cloud-pc-maintenance-windows.md index 784299b5601..f9058ada7ec 100644 --- a/windows-365/enterprise/cloud-pc-maintenance-windows.md +++ b/windows-365/enterprise/cloud-pc-maintenance-windows.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 03/27/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/cloud-pc-size-recommendations.md b/windows-365/enterprise/cloud-pc-size-recommendations.md index 67adc1896b9..f3c80104d90 100644 --- a/windows-365/enterprise/cloud-pc-size-recommendations.md +++ b/windows-365/enterprise/cloud-pc-size-recommendations.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 07/25/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/configure-single-sign-on.md b/windows-365/enterprise/configure-single-sign-on.md index 9b4b790488a..404f0980f71 100644 --- a/windows-365/enterprise/configure-single-sign-on.md +++ b/windows-365/enterprise/configure-single-sign-on.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 11/16/2023 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/connection-errors.md b/windows-365/enterprise/connection-errors.md index c9cd26353b7..b4e43cf1156 100644 --- a/windows-365/enterprise/connection-errors.md +++ b/windows-365/enterprise/connection-errors.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 05/09/2023 ms.topic: conceptual ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/create-azure-network-connection.md b/windows-365/enterprise/create-azure-network-connection.md index 505e2036487..b58773d20a4 100644 --- a/windows-365/enterprise/create-azure-network-connection.md +++ b/windows-365/enterprise/create-azure-network-connection.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 04/01/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/create-custom-image-languages.md b/windows-365/enterprise/create-custom-image-languages.md index 8db1d47c7c3..33a3cd4285c 100644 --- a/windows-365/enterprise/create-custom-image-languages.md +++ b/windows-365/enterprise/create-custom-image-languages.md @@ -7,10 +7,10 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 06/16/2023 +ms.date: 08/28/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/create-custom-image-support-teams.md b/windows-365/enterprise/create-custom-image-support-teams.md index 649916e9fb8..fe900569374 100644 --- a/windows-365/enterprise/create-custom-image-support-teams.md +++ b/windows-365/enterprise/create-custom-image-support-teams.md @@ -7,10 +7,10 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 06/16/2023 +ms.date: 08/28/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/create-device-configuration-profile.md b/windows-365/enterprise/create-device-configuration-profile.md index e31f6222c1a..1ee2ca593a8 100644 --- a/windows-365/enterprise/create-device-configuration-profile.md +++ b/windows-365/enterprise/create-device-configuration-profile.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 07/25/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/create-dynamic-device-group-all-cloudpcs.md b/windows-365/enterprise/create-dynamic-device-group-all-cloudpcs.md index 85d382d6ad4..7db2440cdd1 100644 --- a/windows-365/enterprise/create-dynamic-device-group-all-cloudpcs.md +++ b/windows-365/enterprise/create-dynamic-device-group-all-cloudpcs.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 07/16/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/create-dynamic-device-group-for-specific-configuration.md b/windows-365/enterprise/create-dynamic-device-group-for-specific-configuration.md index e43f1763b9b..26808328167 100644 --- a/windows-365/enterprise/create-dynamic-device-group-for-specific-configuration.md +++ b/windows-365/enterprise/create-dynamic-device-group-for-specific-configuration.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 06/16/2023 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/create-dynamic-device-group-from-specific-policy.md b/windows-365/enterprise/create-dynamic-device-group-from-specific-policy.md index 8b6e0731f7c..94c7d632282 100644 --- a/windows-365/enterprise/create-dynamic-device-group-from-specific-policy.md +++ b/windows-365/enterprise/create-dynamic-device-group-from-specific-policy.md @@ -7,10 +7,10 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 06/16/2023 +ms.date: 08/28/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/create-filter.md b/windows-365/enterprise/create-filter.md index 6b34c142fcf..f5711e28855 100644 --- a/windows-365/enterprise/create-filter.md +++ b/windows-365/enterprise/create-filter.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 07/25/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/create-manual-restore-point.md b/windows-365/enterprise/create-manual-restore-point.md index 2ee23df1d8f..a2340a8a136 100644 --- a/windows-365/enterprise/create-manual-restore-point.md +++ b/windows-365/enterprise/create-manual-restore-point.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 06/24/2024 ms.topic: conceptual ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/create-provisioning-policy.md b/windows-365/enterprise/create-provisioning-policy.md index 6696a99a04f..e85990edfd2 100644 --- a/windows-365/enterprise/create-provisioning-policy.md +++ b/windows-365/enterprise/create-provisioning-policy.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 10/17/2023 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: @@ -51,7 +51,7 @@ A few things to keep in mind: ## Create a provisioning policy -1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Devices** > **Windows 365** (under **Provisioning**) > **Provisioning policies** > **Create policy**. +1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Devices** > **Windows 365** (under **Device onboarding**) > **Provisioning policies** > **Create policy**. ![Screenshot of create policy.](./media/create-provisioning-policy/create-policy.png) 2. On the **General** page, enter a **Name** and **Description** (optional) for the new policy. diff --git a/windows-365/enterprise/cross-region-disaster-recovery-activate.md b/windows-365/enterprise/cross-region-disaster-recovery-activate.md index 049457314a7..c95f23ec8ba 100644 --- a/windows-365/enterprise/cross-region-disaster-recovery-activate.md +++ b/windows-365/enterprise/cross-region-disaster-recovery-activate.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 07/01/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/cross-region-disaster-recovery-report.md b/windows-365/enterprise/cross-region-disaster-recovery-report.md index 761e1747c1d..ef79c392a89 100644 --- a/windows-365/enterprise/cross-region-disaster-recovery-report.md +++ b/windows-365/enterprise/cross-region-disaster-recovery-report.md @@ -7,10 +7,10 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 07/01/2023 +ms.date: 08/28/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: @@ -34,7 +34,7 @@ The **Cloud PCs cross region disaster recovery status** report shows you pertine ## Use the Cloud PCs cross region disaster recovery status report -To get to the **Cloud PCs cross region disaster recovery status report**, sign in to [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Reports** > **Cloud PC overview** > **Cross region disaster recovery status”. +To get to the **Cloud PCs cross region disaster recovery status report**, sign in to [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Reports** > **Cloud PC overview** > **Cross region disaster recovery status**. The device list shows the individual Cloud PCs with the following columns: @@ -47,7 +47,7 @@ The device list shows the individual Cloud PCs with the following columns: - **No** - **Current restore point** - **Device name** -- **Disaster recovery status** +- **Disaster recover status** - **Active outage** - **Activation expiring** - **Not active** @@ -64,7 +64,7 @@ You can use the **Columns** and **Add filter** options to customize the report. - **Activation expiration** - **Configuration alert** - **Cross region enabled** -- **Disaster recovery status** +- **Disaster recover status** - **License type** diff --git a/windows-365/enterprise/cross-region-disaster-recovery-set-up.md b/windows-365/enterprise/cross-region-disaster-recovery-set-up.md index 2f2dc735a10..6fb6d480972 100644 --- a/windows-365/enterprise/cross-region-disaster-recovery-set-up.md +++ b/windows-365/enterprise/cross-region-disaster-recovery-set-up.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 07/01/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/cross-region-disaster-recovery.md b/windows-365/enterprise/cross-region-disaster-recovery.md index 01d54e5e3bc..47ac5f4dcc6 100644 --- a/windows-365/enterprise/cross-region-disaster-recovery.md +++ b/windows-365/enterprise/cross-region-disaster-recovery.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 07/01/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/customer-permissions.md b/windows-365/enterprise/customer-permissions.md index 1d18c741f2c..8ad8f45ea21 100644 --- a/windows-365/enterprise/customer-permissions.md +++ b/windows-365/enterprise/customer-permissions.md @@ -7,10 +7,10 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 06/15/2023 +ms.date: 08/28/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: @@ -19,7 +19,7 @@ ms.assetid: #ROBOTS: #audience: -ms.reviewer: elaineyou +ms.reviewer: ericor ms.suite: ems search.appverid: MET150 #ms.tgt_pltfrm: diff --git a/windows-365/enterprise/delete-azure-network-connection.md b/windows-365/enterprise/delete-azure-network-connection.md index 959c343bdb2..c0c171bbbd8 100644 --- a/windows-365/enterprise/delete-azure-network-connection.md +++ b/windows-365/enterprise/delete-azure-network-connection.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 07/25/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/delete-provisioning-policy.md b/windows-365/enterprise/delete-provisioning-policy.md index 679a48e47e8..653aeb8a7e9 100644 --- a/windows-365/enterprise/delete-provisioning-policy.md +++ b/windows-365/enterprise/delete-provisioning-policy.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 07/25/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/deploy-security-baselines.md b/windows-365/enterprise/deploy-security-baselines.md index 28880793799..73594dd74db 100644 --- a/windows-365/enterprise/deploy-security-baselines.md +++ b/windows-365/enterprise/deploy-security-baselines.md @@ -7,10 +7,10 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 06/24/2024 +ms.date: 08/09/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: @@ -31,27 +31,21 @@ ms.collection: # Deploy security baselines -Windows 365 Security Baselines are a set of policy templates built on security best practices and experience from real world implementations. You can use security baselines to get security recommendations that can help lower risks. The Windows 365 baselines enable security configurations for Windows 10, Microsoft Edge, and Microsoft Defender for Endpoint. They include versioning features and help customers choose when to update user policies to the latest release. +Windows 365 Security Baselines version 24H1 are a set of policy templates built on security best practices and experience from real world implementations. You can use security baselines to get security recommendations that can help lower risks. The Windows 365 baselines enable security configurations for Windows 11, Windows 10, Microsoft Edge, and Microsoft Defender for Endpoint. They include versioning features and help customers choose when to update user policies to the latest release. -Windows 365-branded security baselines are a group of tested and validated recommended settings available in Microsoft Intune that apply to the following areas: - -- Windows 10 settings: 1809 -- MDATP settings: version 4 -- Microsoft Edge settings: April 2020 (Microsoft Edge version 80 and later) - -You can optionally apply Windows 365 security baselines to the Microsoft Entra groups containing Cloud PC devices in your tenant. +The settings in the Windows 365 Cloud PC security baseline version 24H1 apply to Windows devices managed through Intune. When available, the setting name links to the source Configuration Service Provider (CSP), and then displays that settings default configuration in the baseline. > [!TIP] > Like any configuration change, it is always a good idea to test the security baseline on a pilot group of Cloud PCs. For information on how to build a rollout plan in Microsoft Intune, see the [Microsoft Intune planning guide](/mem/intune/fundamentals/intune-planning-guide#task-5-create-a-rollout-plan). For information on Microsoft Defender for Endpoint features can be tested, see [Test how Microsoft Defender for Endpoint features work in audit mode](/microsoft-365/security/defender-endpoint/audit-windows-defender). 1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) select **Endpoint Security** > **Security Baselines**. ![Screenshot of view security baselines](./media/deploy-security-baselines/view-security-baselines.png) -2. Select **Windows 365 Security Baseline**. -3. On the **Create a profile** pane, select **Create**. +2. Select **Windows 365 Security Baseline Version 24H1**. +3. On the **Create a profile** pane, select **Create profile** > **Create**. 4. On the **Basics** page, provide a **Name** > **Next**. 5. On the **Configuration settings** tab, view the groups of settings that are available in the baseline you selected. You can expand a group to view the settings in that group, and the default values for those settings in the baseline. To find specific settings: - Select a group to expand and review the available settings. - - Use the Search bar and specify keywords that filter the view to display only those groups that contain your search criteria. + - To display only those groups that contain your search criteria, use the Search bar and specify keywords that filter the view. Each setting in a baseline has a default configuration for that baseline version. Reconfigure the default settings to meet your business needs. Different baselines might contain the same setting, and use different default values for the setting, depending on the intent of the baseline. 5. Select **Next**. @@ -59,11 +53,13 @@ You can optionally apply Windows 365 security baselines to the Microsoft Entra g 7. On the **Assignments** tab, select a device group with the Cloud PCs to include and then assign the baseline to one or more groups with your Cloud PCs. Use **Add groups** under **Excluded groups** to fine-tune the assignment. Select **Next**. 8. When you're ready to deploy the baseline, advance to the **Review + create** tab and review the details for the baseline. Select **Create** to save and deploy the profile. -As soon as you create the profile, it's pushed to the assigned group and will apply immediately. - -For more information, see [Use security baselines to configure Windows devices in Intune](/mem/intune/protect/security-baselines). +As soon as you create the profile, it's pushed to the assigned group and is applied immediately. ## Next steps -[Set conditional access policies](set-conditional-access-policies.md) +For more information, see [Use security baselines to configure Windows devices in Intune](/mem/intune/protect/security-baselines). + +For a detailed list of the 24H1 settings, see [Settings list for the Windows 365 Cloud PC security baseline in Intune](/mem/intune/protect/security-baseline-settings-windows-365?pivots=win365-24h1). + +[Set conditional access policies](set-conditional-access-policies.md). diff --git a/windows-365/enterprise/deployment-options.md b/windows-365/enterprise/deployment-options.md index f25ac3b6927..73064f8bb24 100644 --- a/windows-365/enterprise/deployment-options.md +++ b/windows-365/enterprise/deployment-options.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 12/08/2023 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/deployment-overview.md b/windows-365/enterprise/deployment-overview.md index d29528a3f8f..5cc18da924e 100644 --- a/windows-365/enterprise/deployment-overview.md +++ b/windows-365/enterprise/deployment-overview.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 07/16/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/device-configuration.md b/windows-365/enterprise/device-configuration.md index 5c58decc687..69d619c0a86 100644 --- a/windows-365/enterprise/device-configuration.md +++ b/windows-365/enterprise/device-configuration.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 07/24/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/device-images-convert-generation-2.md b/windows-365/enterprise/device-images-convert-generation-2.md index fb456d3ad85..7411b8cf102 100644 --- a/windows-365/enterprise/device-images-convert-generation-2.md +++ b/windows-365/enterprise/device-images-convert-generation-2.md @@ -7,10 +7,10 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 06/15/2023 +ms.date: 08/26/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: @@ -19,7 +19,7 @@ ms.assetid: #ROBOTS: #audience: -ms.reviewer: chbrinkh +ms.reviewer: evas ms.suite: ems search.appverid: MET150 #ms.tgt_pltfrm: @@ -44,7 +44,7 @@ There are four main steps to this process: ## Create a new virtual machine -1. Make sure that Hyper-V is installed on your management PC. For information on how to install Hyper-V, see [Install Hyper-V on Windows 10](/virtualization/hyper-v-on-windows/quick-start/enable-hyper-v). +1. Make sure that Hyper-V is installed on your management PC. For information on how to install Hyper-V, see [Install Hyper-V on Windows](/virtualization/hyper-v-on-windows/quick-start/enable-hyper-v). 2. Download your existing custom image virtual hard drive (VHD) file from the Azure storage blob URL to your PC where you have Hyper-V available. The VHD file is the exact size of the OS disk, which can be a large file size. Make sure to use a fast, stable internet connection to download the VHD file, and prepare for long download times. For information on how to download a managed disk, see [Download a VHD from Azure](/azure/virtual-machines/windows/download-vhd#generate-download-url). diff --git a/windows-365/enterprise/device-images.md b/windows-365/enterprise/device-images.md index 763b9b9143a..5c8d8fcc90f 100644 --- a/windows-365/enterprise/device-images.md +++ b/windows-365/enterprise/device-images.md @@ -7,10 +7,10 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 06/21/2024 +ms.date: 09/09/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: @@ -41,7 +41,7 @@ Both marketplace and custom images must meet the following requirements: - Generation 2 images. > [!Note] > We recently made the change to **generation 2** (Gen2) virtual machine images. Newly created custom images must be Gen2. Existing custom images uploaded based on generation 1 will remain active. -- The image must never have been Active Directory, Microsoft Entra ID joined, Intune-enrolled, or enrolled for co-management. For more information, see [Sysprep will not run correctly on a device that has been MDM enrolled](/troubleshoot/mem/intune/device-enrollment/troubleshoot-sysprep-windows-10-device-enrolled-mdm). +- The image must never have been Active Directory, Microsoft Entra ID joined, Intune-enrolled, or enrolled for co-management. For more information, see [Sysprep won't run correctly on a device that has been MDM enrolled](/troubleshoot/mem/intune/device-enrollment/troubleshoot-sysprep-windows-10-device-enrolled-mdm). - Generalized VM image. - Single Session VM images (multi-session isn’t supported). - No recovery partition. For information about how to remove a recovery partition, see the [Windows Server command: delete partition](/windows-server/administration/windows-commands/delete-partition). @@ -56,7 +56,7 @@ Storing a managed image on Azure incurs storage costs. However, customers can de ## Gallery images -Windows 365 provides a built-in gallery of Windows Enterprise images accessible through the [provisioning policy creation flow](create-provisioning-policy.md). Each image helps admins with pre-set audit policies already enabled, like account policies, logon/logoff, object access, and policy change. +Windows 365 provides a built-in gallery of Windows Enterprise images accessible through the [provisioning policy creation flow](create-provisioning-policy.md). Each image helps admins with preset audit policies already enabled, like account policies, logon/logoff, object access, and policy change. They're replicated to all Azure regions to give you a quick provisioning experience. These images are updated monthly with: @@ -65,7 +65,7 @@ They're replicated to all Azure regions to give you a quick provisioning experie There are two sets of images available to choose from across the different versions of Windows Enterprise: -- **Images with pre-installed Microsoft 365 Apps**: Microsoft 365 Apps and Teams optimizations are already installed. The following settings are pre-applied: +- **Images with pre-installed Microsoft 365 Apps**: Microsoft 365 Apps and Teams optimizations are already installed. The following settings are preapplied: - IsWVDEnvironment reg key (Teams). - C++ Runtime (Teams). - WebRTC Redirector (Teams). @@ -78,12 +78,13 @@ Both types of images are harmonized in GPOs. Any differences are due to preinsta ### Gallery image update cycle -All supported Windows 365 gallery images are updated monthly after the security patch release schedule of Windows Servicing & Delivery. This update happens around the middle of each month. +All supported Windows 365 gallery images are updated monthly after the security patch release schedule of Windows Servicing & Delivery. This update happens around the middle of each month. Updated Windows 365 images are made available in Intune for provisioning around the end of the third week of the month. Each updated image includes: - [Windows 10/11 monthly image updates](https://support.microsoft.com/topic/windows-10-release-on-azure-marketplace-update-history-da826e21-45ae-f6b9-de71-5f0ee2ec1563) - [Microsoft 365 Apps security updates](/officeupdates/microsoft365-apps-security-updates) and [feature updates](/officeupdates/monthly-enterprise-channel) + - Windows 365 gallery images include the latest Monthly Enterprise Channel release with the latest security updates. - [Microsoft Teams updates](https://support.microsoft.com/office/what-s-new-in-microsoft-teams-d7092a6d-c896-424c-b362-a472d5f105de) - [WebRTC redirector service updates](/azure/virtual-desktop/teams-on-avd#install-the-teams-websocket-service) @@ -117,3 +118,5 @@ When you upload a custom device image, Windows 365: [Learn about device configuration](device-configuration.md). [Learn about using apps, like Microsoft Teams, with your Cloud PCs](app-overview.md). + +[Learn about restoring a Cloud PC to a previous state](restore-overview.md) diff --git a/windows-365/enterprise/device-management-overview.md b/windows-365/enterprise/device-management-overview.md index 2450940c88b..b8c28e4b386 100644 --- a/windows-365/enterprise/device-management-overview.md +++ b/windows-365/enterprise/device-management-overview.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 07/25/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/digital-forensics.md b/windows-365/enterprise/digital-forensics.md index cd3d57d4348..7184276f6ad 100644 --- a/windows-365/enterprise/digital-forensics.md +++ b/windows-365/enterprise/digital-forensics.md @@ -7,10 +7,10 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 09/13/2023 +ms.date: 08/28/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/edit-azure-network-connection.md b/windows-365/enterprise/edit-azure-network-connection.md index facd1e92aae..6d82413976b 100644 --- a/windows-365/enterprise/edit-azure-network-connection.md +++ b/windows-365/enterprise/edit-azure-network-connection.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 07/25/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/edit-provisioning-policy.md b/windows-365/enterprise/edit-provisioning-policy.md index 624db7c42a8..ea2415e3b30 100644 --- a/windows-365/enterprise/edit-provisioning-policy.md +++ b/windows-365/enterprise/edit-provisioning-policy.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 06/27/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/encryption.md b/windows-365/enterprise/encryption.md index 35c4a1b3916..30f53cdc2e4 100644 --- a/windows-365/enterprise/encryption.md +++ b/windows-365/enterprise/encryption.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 12/05/2023 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/end-grace-period.md b/windows-365/enterprise/end-grace-period.md index a9d4198155c..2e61d442007 100644 --- a/windows-365/enterprise/end-grace-period.md +++ b/windows-365/enterprise/end-grace-period.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 06/24/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/end-of-support.md b/windows-365/enterprise/end-of-support.md index 7b0dc170dee..f98c9578e09 100644 --- a/windows-365/enterprise/end-of-support.md +++ b/windows-365/enterprise/end-of-support.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 07/25/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: @@ -19,7 +19,7 @@ ms.assetid: #ROBOTS: #audience: -ms.reviewer: naramkri +ms.reviewer: evas ms.suite: ems search.appverid: MET150 #ms.tgt_pltfrm: diff --git a/windows-365/enterprise/enrollment-status-page.md b/windows-365/enterprise/enrollment-status-page.md index e1974c49980..f0f8855ec99 100644 --- a/windows-365/enterprise/enrollment-status-page.md +++ b/windows-365/enterprise/enrollment-status-page.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 07/16/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/forensic-evidence-set-up.md b/windows-365/enterprise/forensic-evidence-set-up.md index 43c0c6efb7e..43f1eb75b55 100644 --- a/windows-365/enterprise/forensic-evidence-set-up.md +++ b/windows-365/enterprise/forensic-evidence-set-up.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 05/31/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: @@ -53,6 +53,7 @@ To set up Microsoft Purview forensic evidence, your environment must meet the fo - Windows 11 Enterprise + Microsoft 365 Apps 23H2 or later - Licensing options - Microsoft 365 E5 + - Microsoft 365 E5 (no Teams) - Microsoft 365 E5 Compliance - Microsoft 365 E5 Insider Risk Management - Join type and network diff --git a/windows-365/enterprise/frontline-cloud-pc-session-time-limits.md b/windows-365/enterprise/frontline-cloud-pc-session-time-limits.md index 7647d385a3a..44864728c26 100644 --- a/windows-365/enterprise/frontline-cloud-pc-session-time-limits.md +++ b/windows-365/enterprise/frontline-cloud-pc-session-time-limits.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 07/25/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/get-cloud-pc-audit-logs-using-powershell.md b/windows-365/enterprise/get-cloud-pc-audit-logs-using-powershell.md index 8eaa3d4bcff..ef29e204285 100644 --- a/windows-365/enterprise/get-cloud-pc-audit-logs-using-powershell.md +++ b/windows-365/enterprise/get-cloud-pc-audit-logs-using-powershell.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 10/20/2023 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/gpu-cloud-pc-performance.md b/windows-365/enterprise/gpu-cloud-pc-performance.md index 8d5273d54c4..8637c6523be 100644 --- a/windows-365/enterprise/gpu-cloud-pc-performance.md +++ b/windows-365/enterprise/gpu-cloud-pc-performance.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 07/31/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/gpu-cloud-pc.md b/windows-365/enterprise/gpu-cloud-pc.md index edc103a7965..ea56bb9f8fc 100644 --- a/windows-365/enterprise/gpu-cloud-pc.md +++ b/windows-365/enterprise/gpu-cloud-pc.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 07/31/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/health-checks-connectivity.md b/windows-365/enterprise/health-checks-connectivity.md index c3a590ededd..20ec868edb7 100644 --- a/windows-365/enterprise/health-checks-connectivity.md +++ b/windows-365/enterprise/health-checks-connectivity.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 01/31/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/health-checks.md b/windows-365/enterprise/health-checks.md index 357e593d47a..2f762ce4be8 100644 --- a/windows-365/enterprise/health-checks.md +++ b/windows-365/enterprise/health-checks.md @@ -7,10 +7,10 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 09/27/2023 +ms.date: 08/28/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/high-level-architecture.md b/windows-365/enterprise/high-level-architecture.md index f1f9c0cca02..7f327d66685 100644 --- a/windows-365/enterprise/high-level-architecture.md +++ b/windows-365/enterprise/high-level-architecture.md @@ -7,10 +7,10 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 06/15/2023 +ms.date: 08/28/2024 ms.topic: conceptual ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/hp-anyware-requirements.md b/windows-365/enterprise/hp-anyware-requirements.md index 32e4f647d74..26d50eba610 100644 --- a/windows-365/enterprise/hp-anyware-requirements.md +++ b/windows-365/enterprise/hp-anyware-requirements.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 04/10/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/hp-anyware-set-up.md b/windows-365/enterprise/hp-anyware-set-up.md index 865070d9d15..5f41918fc64 100644 --- a/windows-365/enterprise/hp-anyware-set-up.md +++ b/windows-365/enterprise/hp-anyware-set-up.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 04/10/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/identity-authentication.md b/windows-365/enterprise/identity-authentication.md index 7f0fc7fc868..e3b0756907f 100644 --- a/windows-365/enterprise/identity-authentication.md +++ b/windows-365/enterprise/identity-authentication.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 07/16/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/in-development.md b/windows-365/enterprise/in-development.md index 7ff3d65fcd2..add57516b75 100644 --- a/windows-365/enterprise/in-development.md +++ b/windows-365/enterprise/in-development.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 06/28/2024 +ms.date: 09/12/2024 ms.topic: conceptual ms.service: windows-365 @@ -23,6 +23,7 @@ ms.custom: references_regions ms.collection: - M365-identity-device-management - tier2 +ms.subservice: windows-365-enterprise --- # In development for Windows 365 Enterprise @@ -71,6 +72,24 @@ In a future update, Windows 365 Cloud PC gallery images with Microsoft 365 appli - Windows 10 Enterprise + Microsoft 365 Apps 22H2 - Windows 10 Enterprise + Microsoft 365 Apps 21H2 +### Windows 365 support for HEVC video coding + +Windows 365 will support Hardware High Efficiency Video Coding (HEVC) h.265 4:2:0 on compatible GPU-enabled Cloud PCs. + +### Azure network connections inactive state + +In a future update, Azure network connections that meet either of the following conditions for more than four weeks will be marked as inactive: + +- ANCs that aren't associated with provisioning policies. +- ANCs with provisioning policies that have no Cloud PCs associate with them. + +Inactive ANCs: + +- Can't be assigned to provisioning policies. +- Are skipped during health checks. + +You'll be able to reactive such ANCs. + ## Device security diff --git a/windows-365/enterprise/index.yml b/windows-365/enterprise/index.yml index 1a8bfea5527..2b7edbbb6f8 100644 --- a/windows-365/enterprise/index.yml +++ b/windows-365/enterprise/index.yml @@ -10,6 +10,7 @@ metadata: ms.author: erikje manager: dougeby ms.date: 05/14/2024 + ms.subservice: windows-365-enterprise highlightedContent: items: diff --git a/windows-365/enterprise/install-windows-365-app-intune.md b/windows-365/enterprise/install-windows-365-app-intune.md index 3798b755ddb..2ecf7e6f0ff 100644 --- a/windows-365/enterprise/install-windows-365-app-intune.md +++ b/windows-365/enterprise/install-windows-365-app-intune.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 06/24/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/introduction-windows-365-frontline.md b/windows-365/enterprise/introduction-windows-365-frontline.md index eda5571207e..07f000728f3 100644 --- a/windows-365/enterprise/introduction-windows-365-frontline.md +++ b/windows-365/enterprise/introduction-windows-365-frontline.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 07/31/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/introduction-windows-365-government.md b/windows-365/enterprise/introduction-windows-365-government.md index addf6af3bfd..11dca78acaa 100644 --- a/windows-365/enterprise/introduction-windows-365-government.md +++ b/windows-365/enterprise/introduction-windows-365-government.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 07/31/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: @@ -67,8 +67,8 @@ The following features aren't yet supported for Windows 365 GCC or GCC High. - Windows 365 Frontline (available for GCC, not available for GCC High) - Cloud PC connection quality report - Cross region disaster recovery -- [Microsoft Purview Customer Key](purview-customer-key.md) - [Support for Omnissa Horizon clients and the Blast protocol](set-up-omnissa-horizon.md) +- [Microsoft Purview Customer Key](purview-customer-key.md) ## Next steps diff --git a/windows-365/enterprise/known-issues-enterprise.md b/windows-365/enterprise/known-issues-enterprise.md index 01ca44329ab..1df8bdba788 100644 --- a/windows-365/enterprise/known-issues-enterprise.md +++ b/windows-365/enterprise/known-issues-enterprise.md @@ -9,7 +9,7 @@ ms.date: 7/09/2024 audience: Admin ms.topic: troubleshooting ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/lifecycle.md b/windows-365/enterprise/lifecycle.md index 312cba37585..369cb4a9123 100644 --- a/windows-365/enterprise/lifecycle.md +++ b/windows-365/enterprise/lifecycle.md @@ -7,10 +7,10 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 05/09/2023 +ms.date: 08/28/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/manage-cloud-pcs-using-configuration-manager.md b/windows-365/enterprise/manage-cloud-pcs-using-configuration-manager.md index dbd95708f1a..4789b3e6f94 100644 --- a/windows-365/enterprise/manage-cloud-pcs-using-configuration-manager.md +++ b/windows-365/enterprise/manage-cloud-pcs-using-configuration-manager.md @@ -7,10 +7,10 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 05/09/2023 +ms.date: 08/28/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/manage-rdp-device-redirections.md b/windows-365/enterprise/manage-rdp-device-redirections.md index 1892d73d34b..343e244157c 100644 --- a/windows-365/enterprise/manage-rdp-device-redirections.md +++ b/windows-365/enterprise/manage-rdp-device-redirections.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 08/02/2024 ms.topic: conceptual ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/media/create-provisioning-policy/select-cloud-pc-size.png b/windows-365/enterprise/media/create-provisioning-policy/select-cloud-pc-size.png deleted file mode 100644 index 8ad25c33870..00000000000 Binary files a/windows-365/enterprise/media/create-provisioning-policy/select-cloud-pc-size.png and /dev/null differ diff --git a/windows-365/enterprise/media/deploy-security-baselines/view-security-baselines.png b/windows-365/enterprise/media/deploy-security-baselines/view-security-baselines.png index 39efb92bfb8..0501f42928a 100644 Binary files a/windows-365/enterprise/media/deploy-security-baselines/view-security-baselines.png and b/windows-365/enterprise/media/deploy-security-baselines/view-security-baselines.png differ diff --git a/windows-365/enterprise/media/manage-rdp-device-restrictions/checkmark.png b/windows-365/enterprise/media/manage-rdp-device-restrictions/checkmark.png deleted file mode 100644 index a0a6c080c7e..00000000000 Binary files a/windows-365/enterprise/media/manage-rdp-device-restrictions/checkmark.png and /dev/null differ diff --git a/windows-365/enterprise/media/manage-rdp-device-restrictions/xmark.png b/windows-365/enterprise/media/manage-rdp-device-restrictions/xmark.png deleted file mode 100644 index e6b79adca49..00000000000 Binary files a/windows-365/enterprise/media/manage-rdp-device-restrictions/xmark.png and /dev/null differ diff --git a/windows-365/enterprise/media/report-cloud-pc-connection-quality/report-connection-quality.png b/windows-365/enterprise/media/report-cloud-pc-connection-quality/report-connection-quality.png deleted file mode 100644 index baa399b6d65..00000000000 Binary files a/windows-365/enterprise/media/report-cloud-pc-connection-quality/report-connection-quality.png and /dev/null differ diff --git a/windows-365/enterprise/media/set-up-citrix/turn-on-connector.png b/windows-365/enterprise/media/set-up-citrix/turn-on-connector.png deleted file mode 100644 index b72317f0d36..00000000000 Binary files a/windows-365/enterprise/media/set-up-citrix/turn-on-connector.png and /dev/null differ diff --git a/windows-365/enterprise/move-cloud-pc.md b/windows-365/enterprise/move-cloud-pc.md index 289d8e150db..174dcfd3348 100644 --- a/windows-365/enterprise/move-cloud-pc.md +++ b/windows-365/enterprise/move-cloud-pc.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 07/25/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/nested-virtualization.md b/windows-365/enterprise/nested-virtualization.md index 14ba5d78a32..9d0c4a69e47 100644 --- a/windows-365/enterprise/nested-virtualization.md +++ b/windows-365/enterprise/nested-virtualization.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 05/06/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/overview.md b/windows-365/enterprise/overview.md index 4c37c324748..a54f4e74e98 100644 --- a/windows-365/enterprise/overview.md +++ b/windows-365/enterprise/overview.md @@ -7,10 +7,10 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 05/09/2023 +ms.date: 08/28/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: @@ -48,7 +48,7 @@ With the Windows 365 service, you can: - Automatically provision on-demand Windows Enterprise Cloud PCs for your users. [Provisioning](provisioning.md) is the automatic creation of Cloud PCs for your end users. After you set up Cloud PC support in Microsoft Intune, a Cloud PC is automatically provisioned whenever you assign a user with a Cloud PC license to an appropriate Microsoft Entra user group. To set up Cloud PC support, you’ll: - [Optional] Create [Azure network connections](azure-network-connections.md), which are links between the Cloud PCs and your on-premises resources. - Choose a built-in, optimized Windows [image](device-images.md) (or create your own) to use as the basis for each Cloud PC. -- Manage your Cloud PCs like your organization’s other devices in [Microsoft Intune](/intune/). Based on your configuration, Cloud PCs are either: +- Manage your Cloud PCs like your organization’s other devices in [Microsoft Intune](https://go.microsoft.com/fwlink/?linkid=2109431). Based on your configuration, Cloud PCs are either: - Joined to your enterprise Active Directory domain and synced to Microsoft Entra ID. - Directly joined to Microsoft Entra ID. diff --git a/windows-365/enterprise/permission-scopes.md b/windows-365/enterprise/permission-scopes.md index b1f9dcf2535..23c0446ecb6 100644 --- a/windows-365/enterprise/permission-scopes.md +++ b/windows-365/enterprise/permission-scopes.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 03/27/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/place-cloud-pc-under-review.md b/windows-365/enterprise/place-cloud-pc-under-review.md index c6a75a9131c..31dfdf9e828 100644 --- a/windows-365/enterprise/place-cloud-pc-under-review.md +++ b/windows-365/enterprise/place-cloud-pc-under-review.md @@ -7,10 +7,10 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 10/30/2023 +ms.date: 08/28/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: @@ -92,6 +92,10 @@ Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/? You can also use Intune’s bulk device actions to place multiple Cloud PCs under review at the same time. For more information, see [Use bulk device actions]( /mem/intune/remote-actions/bulk-device-actions). + +> [!NOTE] +> Up to 10 Cloud PCs can be placed under review simultaneously. When more than 10 are placed under review at once, requests are queued and timeouts may increase if the request remains in the queue for too long. If you experience timeouts, it is recommended you stagger the requests to allow sufficient time for previous requests to complete first. Completion times will depend on the size of the Cloud PC disk as well as the location and type of your Azure Storage account. + ## Management with API You can use the Graph API to place or remove a Cloud PC from review. For more information, see [managedDevice: setCloudPcReviewStatus](/graph/api/manageddevice-setcloudpcreviewstatus?view=graph-rest-beta&tabs=http). diff --git a/windows-365/enterprise/planning-guide.md b/windows-365/enterprise/planning-guide.md index 9771b6edc44..2a99ce89d7f 100644 --- a/windows-365/enterprise/planning-guide.md +++ b/windows-365/enterprise/planning-guide.md @@ -7,10 +7,10 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 05/09/2023 +ms.date: 08/28/2024 ms.topic: conceptual ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/privacy-personal-data.md b/windows-365/enterprise/privacy-personal-data.md index 73153447416..081c7926334 100644 --- a/windows-365/enterprise/privacy-personal-data.md +++ b/windows-365/enterprise/privacy-personal-data.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 09/13/2023 ms.topic: conceptual ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/provide-localized-windows-experience.md b/windows-365/enterprise/provide-localized-windows-experience.md index d0fde09c621..ab0f1020e3d 100644 --- a/windows-365/enterprise/provide-localized-windows-experience.md +++ b/windows-365/enterprise/provide-localized-windows-experience.md @@ -7,10 +7,10 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 07/17/2023 +ms.date: 08/28/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: @@ -19,7 +19,7 @@ ms.assetid: #ROBOTS: #audience: -ms.reviewer: chrimo +ms.reviewer: satulim ms.suite: ems search.appverid: MET150 #ms.tgt_pltfrm: diff --git a/windows-365/enterprise/provisioning-errors.md b/windows-365/enterprise/provisioning-errors.md index 79ce26c63e8..5a94a5b80e8 100644 --- a/windows-365/enterprise/provisioning-errors.md +++ b/windows-365/enterprise/provisioning-errors.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 07/16/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/provisioning.md b/windows-365/enterprise/provisioning.md index 2f99220b03d..3bdc5df0960 100644 --- a/windows-365/enterprise/provisioning.md +++ b/windows-365/enterprise/provisioning.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 01/19/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/purview-customer-key.md b/windows-365/enterprise/purview-customer-key.md index 0b63773e1b7..95bebf406f1 100644 --- a/windows-365/enterprise/purview-customer-key.md +++ b/windows-365/enterprise/purview-customer-key.md @@ -7,10 +7,10 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 03/11/2024 +ms.date: 08/29/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: @@ -32,11 +32,11 @@ ms.collection: # Microsoft Purview Customer Key for Windows 365 Cloud PCs -[Microsoft Purview Customer Key](/purview/customer-key-overview) is a security feature that lets you add an extra layer of encryption to your data within Microsoft 365 services. +[Microsoft Purview Customer Key](/purview/customer-key-overview) is a security feature that lets you add an extra layer of compliance to your data within Microsoft 365 services. When you use Customer Key with Windows 365 Cloud PCs: -- Your Cloud PC disks, snapshots, and images are encrypted at rest with customer-managed keys. +- Your Cloud PC disks, snapshots, and images are encrypted at rest with customer-managed keys instead of Microsoft-managed keys. - These keys are supplied by you and managed using Azure Key Vault. - Microsoft manages all other keys, supporting a secure and controlled environment. diff --git a/windows-365/enterprise/rdp-shortpath-private-networks.md b/windows-365/enterprise/rdp-shortpath-private-networks.md index a37c097ce72..bdfc70049ce 100644 --- a/windows-365/enterprise/rdp-shortpath-private-networks.md +++ b/windows-365/enterprise/rdp-shortpath-private-networks.md @@ -7,10 +7,10 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 06/16/2023 +ms.date: 08/28/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/rdp-shortpath-public-networks.md b/windows-365/enterprise/rdp-shortpath-public-networks.md index 710b92cc135..bc08574d1d3 100644 --- a/windows-365/enterprise/rdp-shortpath-public-networks.md +++ b/windows-365/enterprise/rdp-shortpath-public-networks.md @@ -7,10 +7,10 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 06/27/2023 +ms.date: 08/28/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/remotely-manage-cloud-pc.md b/windows-365/enterprise/remotely-manage-cloud-pc.md index cd80aa2bdd1..e660aff646e 100644 --- a/windows-365/enterprise/remotely-manage-cloud-pc.md +++ b/windows-365/enterprise/remotely-manage-cloud-pc.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 03/27/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/report-cloud-pc-actions.md b/windows-365/enterprise/report-cloud-pc-actions.md index d4f3012054a..d968c398635 100644 --- a/windows-365/enterprise/report-cloud-pc-actions.md +++ b/windows-365/enterprise/report-cloud-pc-actions.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 12/6/2023 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/report-cloud-pc-connection-quality.md b/windows-365/enterprise/report-cloud-pc-connection-quality.md index 70da0516fcb..86e6fbc3d8a 100644 --- a/windows-365/enterprise/report-cloud-pc-connection-quality.md +++ b/windows-365/enterprise/report-cloud-pc-connection-quality.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 03/27/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/report-cloud-pc-recommendations.md b/windows-365/enterprise/report-cloud-pc-recommendations.md index 9d0a3958b42..b790a3ed7da 100644 --- a/windows-365/enterprise/report-cloud-pc-recommendations.md +++ b/windows-365/enterprise/report-cloud-pc-recommendations.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 03/27/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/report-cloud-pc-utilization.md b/windows-365/enterprise/report-cloud-pc-utilization.md index b0f5aa3b705..2358d38d482 100644 --- a/windows-365/enterprise/report-cloud-pc-utilization.md +++ b/windows-365/enterprise/report-cloud-pc-utilization.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 03/07/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/report-cloud-pcs-not-available.md b/windows-365/enterprise/report-cloud-pcs-not-available.md index fb6fe8e6f4c..751476e1a15 100644 --- a/windows-365/enterprise/report-cloud-pcs-not-available.md +++ b/windows-365/enterprise/report-cloud-pcs-not-available.md @@ -7,10 +7,10 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 09/27/2023 +ms.date: 08/28/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: @@ -37,7 +37,7 @@ This report displays recent conditions up to 5 to 15 minutes ago. Therefore, Clo ## Use the Cloud PCs that aren't available report -To get to the **Cloud PCs that aren't available** report, sign in to [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Devices** > **Overview** > **Cloud PC performance** > **View report** (under **Cloud PCs that aren't available**). +To get to the **Cloud PCs that aren't available** report, sign in to [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Devices** > **Overview** > **Cloud PC performance** > **Cloud PCs that aren't available**. ![Screenshot of getting to the Cloud PCs that aren't available report](./media/report-cloud-pcs-not-available/view-report-cloud-pcs-not-available.png) diff --git a/windows-365/enterprise/report-connected-frontline-cloud-pcs.md b/windows-365/enterprise/report-connected-frontline-cloud-pcs.md index 911b970f8f9..18f7e47ce4d 100644 --- a/windows-365/enterprise/report-connected-frontline-cloud-pcs.md +++ b/windows-365/enterprise/report-connected-frontline-cloud-pcs.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 12/06/2023 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/report-remoting-connection.md b/windows-365/enterprise/report-remoting-connection.md index 21ee1160407..0c6800d6289 100644 --- a/windows-365/enterprise/report-remoting-connection.md +++ b/windows-365/enterprise/report-remoting-connection.md @@ -7,10 +7,10 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 07/25/2023 +ms.date: 08/28/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/report-resource-performance.md b/windows-365/enterprise/report-resource-performance.md index 874418bcc59..327427e6ba3 100644 --- a/windows-365/enterprise/report-resource-performance.md +++ b/windows-365/enterprise/report-resource-performance.md @@ -7,10 +7,10 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 09/13/2023 +ms.date: 08/28/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/reprovision-cloud-pc.md b/windows-365/enterprise/reprovision-cloud-pc.md index ba69c39a2d2..5b30f715780 100644 --- a/windows-365/enterprise/reprovision-cloud-pc.md +++ b/windows-365/enterprise/reprovision-cloud-pc.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 07/25/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/requirements-citrix.md b/windows-365/enterprise/requirements-citrix.md index fc2e0411830..432004934f0 100644 --- a/windows-365/enterprise/requirements-citrix.md +++ b/windows-365/enterprise/requirements-citrix.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 08/21/2023 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: @@ -55,8 +55,8 @@ To use Citrix HDX Plus for Windows 365, you must meet the following requirements - Microsoft Entra domain in the same tenant as Microsoft Intune - Windows 365 Enterprise licenses in the same tenant as Microsoft Intune - Azure admin account: - - Microsoft Entra Global Admin for required authorizations in Citrix Cloud. - - Intune Admin for enabling Citrix connector in Microsoft Intune. + - Intune Administrator for required authorizations in Citrix Cloud. + - Intune Administrator for enabling Citrix connector in Microsoft Intune. - For more information about the Windows 365 requirements, see [Windows 365 requirements](requirements.md). Citrix HDX Plus doesn't currently support Windows 365 Frontline. diff --git a/windows-365/enterprise/requirements-network.md b/windows-365/enterprise/requirements-network.md index 0f761e0bff4..701f2148e03 100644 --- a/windows-365/enterprise/requirements-network.md +++ b/windows-365/enterprise/requirements-network.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 07/31/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/requirements-omnissa-horizon.md b/windows-365/enterprise/requirements-omnissa-horizon.md index 7d1807b14bd..b4583552293 100644 --- a/windows-365/enterprise/requirements-omnissa-horizon.md +++ b/windows-365/enterprise/requirements-omnissa-horizon.md @@ -7,10 +7,10 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 08/01/2024 +ms.date: 08/21/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: @@ -54,8 +54,8 @@ To use Omnissa Horizon for Windows 365, you must meet the following requirements - Microsoft Entra domain in the same tenant as Microsoft Intune - Windows 365 Enterprise licenses in the same tenant as Microsoft Intune - Azure admin account: - - Microsoft Entra Global Admin for required authorizations in the Omnissa Cloud. - - Intune Admin for enabling the Omnissa connector in Microsoft Intune. + - Intune Administrator for required authorizations in the Omnissa Cloud. + - Intune Administrator for enabling the Omnissa connector in Microsoft Intune. - For more information about the Windows 365 requirements, see [Windows 365 requirements](requirements.md). ## Supported configurations diff --git a/windows-365/enterprise/requirements.md b/windows-365/enterprise/requirements.md index e1166baac74..7563cd8e369 100644 --- a/windows-365/enterprise/requirements.md +++ b/windows-365/enterprise/requirements.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 04/02/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/resilience.md b/windows-365/enterprise/resilience.md index ff107423671..ef7b894a036 100644 --- a/windows-365/enterprise/resilience.md +++ b/windows-365/enterprise/resilience.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 08/06/2024 ms.topic: conceptual ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: @@ -35,10 +35,6 @@ Windows 365 is designed to provide a resilient and reliable service for organiza Windows 365 uses the [Azure Virtual Desktop service](/azure/virtual-desktop/service-architecture-resilience) to connect and broker end user connections to their Cloud PC in any of the supported Azure regions from anywhere, on any device. To minimize outages and support end user and administrator requests, resilience is architected into these services. In addition to this, Windows 365 operates another set of platform infrastructure that provides the many administrator and end user features that manage and control the overall Windows 365 experience. Microsoft fully manages this infrastructure. -Example architecture of a Windows 365 service that enables administrators or end user operations: - -![Diagram of example architecture of a Windows 365 service.](media/resilience/diagram.png) - Windows 365 is a software-as-a-service (SaaS) service, where customers of the service don't have to architect, deploy, or manage complex infrastructure. As a SaaS service, Microsoft manages the underlying infrastructure for all of the individual Windows 365 services. This management maintains a global, fully available, resilient service that customers can rely upon for the daily use of their Cloud PCs. Microsoft continually works to improve the architecture of the service to improve the resilience and recovery times should there be an outage in any of the related Azure services. However, as a SaaS service, Windows 365 requires shared responsibility in overall service delivery to end users. Windows 365 aligns to the [Microsoft 365 guidance and recommendations for business continuity and cloud partner responsibilities](/compliance/assurance/assurance-customer-and-cloud-partner-ebcm-responsibilities) In addition to the Azure Virtual Desktop connectivity layer, Windows 365 operates many dedicated services that are architected as microservices to support agile operations and independence. Each of these services performs specific tasks related to administrator or end user requests. Some examples include: @@ -57,26 +53,40 @@ In addition to the Azure Virtual Desktop connectivity layer, Windows 365 operate Each of these services: - Is its own web service that uses standard Azure infrastructure services. Each service has a certain set of extra Azure infrastructure requirements like CosmosDB, Azure storage, and Event hubs. -- Is architected for resiliency. For example, for the services storage requirements an Azure Storage accounts with Globally Redundant Storage (GRS) is used. For database services such as CosmosDB, the data store is replicated across regions. +- Is architected for resiliency. For example, for the services storage requirements an Azure Storage account with Globally Redundant Storage (GRS) is used. For database services such as CosmosDB, the data store is replicated across regions. - Is architected to use Azure resilience services like Azure availability zones, and cross region failover. The following diagram shows the architecture of an example service. Windows 365 distributes its infrastructure across multiple availability zones within a region and across multiple Azure regions. The service operates in an active-active manner. This supports in-region and cross-region resiliency. If an outage occurs within a region, the service continues functioning. If a region fails, the service is transferred to the secondary region's infrastructure, and normal operations continue. +Example architecture of a Windows 365 service that enables administrators or end user operations: + +![Diagram of example architecture of a Windows 365 service.](media/resilience/diagram.png) + ## Virtual machine resiliency Each Windows 365 Cloud PC is a single instance Azure virtual machine. Resilience is provided at the Azure host level to mitigate any compute continuity issues. For more information, see [Business continuity and disaster recovery overview](business-continuity-disaster-recovery.md). +## Client resiliency + +[Windows App](/windows-app/overview) is the Windows 365 client used to connect to your Cloud PC. Windows App can also be used for connectivity to any Windows in the Cloud service, such as Azure Virtual Desktop, Microsoft DevBox and Remote Desktop Services, as well as RemotePC or direct RDP connections. Windows App is regularly updated to provide new functionality to end users. + +There are two deployment mechanisms to test the client after it has gone through extensive internal testing: + +- An Insiders ring where the client is tested by a set of users who have opted into this ring. Feedback is then provided and bugs can be fixed before rolling out to the Public ring. +- Windows App is hosted within the Windows Store, which enables a reliable global software distribution service. The Windows App uses the Microsoft Store gradual package rollout which lets Microsoft update groups of machines over a specified time period. By monitoring the feedback and usage analytics of these initial groups, we can ensure that the update is ready before rolling it out to a wider community. For more information, see [Gradual package rollout](/windows/apps/publish/gradual-package-rollout). + + ## Customer best practices As Windows 365 has a shared responsibility for overall service delivery, there are some best practices that customers should follow to increase the resiliency of the overall service. -**[Microsoft hosted network](deployment-options.md#microsoft-hosted-network)**. Use a Microsoft hosted network when creating a provisioning policy. Microsoft hosted network is a Microsoft managed networking option, where no Azure vNet or subscription is required for Cloud PC network connectivity. This option lets Microsoft make the placement decisions for the Cloud PC virtual machines and decreases the possibility of provisioning issues. +**Microsoft hosted network**. Use a Microsoft hosted network when creating a provisioning policy. Microsoft hosted network is a Microsoft managed networking option, where no Azure vNet or subscription is required for Cloud PC network connectivity. This option lets Microsoft make the placement decisions for the Cloud PC virtual machines and decreases the possibility of provisioning issues. For more information, see [Microsoft hosted network](deployment-options.md#microsoft-hosted-network) -**[Azure Network Connection](/azure/architecture/guide/virtual-desktop/windows-365-azure-network-connection)**. If you need granular control of your corporate network traffic – firewall rules, custom routes, or on-premises network access – the Azure Network Connection (ANC) feature lets you bring your own Azure vNet/subscription to Windows 365. For customers using the ANC, create multiple connections and prioritize these connections in order of failover usage. This prioritization provides a network connection failover if there's a networking outage. +**Azure Network Connection**. If you need granular control of your corporate network traffic – firewall rules, custom routes, or on-premises network access – the Azure Network Connection (ANC) feature lets you bring your own Azure vNet/subscription to Windows 365. For customers using the ANC, create multiple connections and prioritize these connections in order of failover usage. This prioritization provides a network connection failover if there's a networking outage. For more information, see [Azure Network Connection](/azure/architecture/guide/virtual-desktop/windows-365-azure-network-connection) -**[Point-in-time restore](restore-overview.md)**. This service allows you to fully restore your Cloud PC to a previous state. You can configure the service to automatically create restore points across short and longer time windows. +**Point-in-time restore**. This service allows you to fully restore your Cloud PC to a previous state. You can configure the service to automatically create restore points across short and longer time windows. For more information, see [Point-in-time restore](restore-overview.md) -**[Cross region disaster recovery](cross-region-disaster-recovery.md)**. This Windows 365 add-on feature that creates snapshots of Cloud PCs. These snapshots are placed in customer-defined, geographically distant locations. The snapshots can be recovered to Cloud PCs running in the selected location during a disaster recovery event. +**Cross region disaster recovery**. This Windows 365 add-on feature creates snapshots of Cloud PCs. These snapshots are placed in customer-defined, geographically distant locations. The snapshots can be recovered to Cloud PCs running in the selected location during a disaster recovery event. For more information, see [Cross region disaster recovery](cross-region-disaster-recovery.md) ## Next steps diff --git a/windows-365/enterprise/resize-cloud-pc.md b/windows-365/enterprise/resize-cloud-pc.md index 78b39796182..63cb93cc6b4 100644 --- a/windows-365/enterprise/resize-cloud-pc.md +++ b/windows-365/enterprise/resize-cloud-pc.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 07/09/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/restore-bulk.md b/windows-365/enterprise/restore-bulk.md index ce7ef3002ca..86f685c0d26 100644 --- a/windows-365/enterprise/restore-bulk.md +++ b/windows-365/enterprise/restore-bulk.md @@ -7,10 +7,10 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 06/24/2023 +ms.date: 08/28/2024 ms.topic: conceptual ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/restore-configure.md b/windows-365/enterprise/restore-configure.md index 7385f4608d6..796170bab13 100644 --- a/windows-365/enterprise/restore-configure.md +++ b/windows-365/enterprise/restore-configure.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 07/25/2024 ms.topic: conceptual ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/restore-overview.md b/windows-365/enterprise/restore-overview.md index 33cce2e4611..f7d82df4a5d 100644 --- a/windows-365/enterprise/restore-overview.md +++ b/windows-365/enterprise/restore-overview.md @@ -7,10 +7,10 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 06/15/2023 +ms.date: 08/28/2024 ms.topic: conceptual ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/restore-single-cloud-pc.md b/windows-365/enterprise/restore-single-cloud-pc.md index dbef9c0f4f8..c9f7628dc02 100644 --- a/windows-365/enterprise/restore-single-cloud-pc.md +++ b/windows-365/enterprise/restore-single-cloud-pc.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 07/25/2024 ms.topic: conceptual ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/restrict-office-365-cloud-pcs.md b/windows-365/enterprise/restrict-office-365-cloud-pcs.md index 9edf2f8dcd7..bc128eb9aea 100644 --- a/windows-365/enterprise/restrict-office-365-cloud-pcs.md +++ b/windows-365/enterprise/restrict-office-365-cloud-pcs.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 09/27/2023 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/retry-citrix-agent-installation.md b/windows-365/enterprise/retry-citrix-agent-installation.md index 348f243c6f5..069ed57c113 100644 --- a/windows-365/enterprise/retry-citrix-agent-installation.md +++ b/windows-365/enterprise/retry-citrix-agent-installation.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 03/28/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/role-based-access.md b/windows-365/enterprise/role-based-access.md index abff6e9d14f..1411704c8f3 100644 --- a/windows-365/enterprise/role-based-access.md +++ b/windows-365/enterprise/role-based-access.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 05/8/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/security-guidelines.md b/windows-365/enterprise/security-guidelines.md index 00d5b4d8a38..9106f29f482 100644 --- a/windows-365/enterprise/security-guidelines.md +++ b/windows-365/enterprise/security-guidelines.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 06/15/2023 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/security.md b/windows-365/enterprise/security.md index 534ecef6530..5e6fc627a48 100644 --- a/windows-365/enterprise/security.md +++ b/windows-365/enterprise/security.md @@ -7,10 +7,10 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 11/02/2023 +ms.date: 08/28/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/set-conditional-access-policies.md b/windows-365/enterprise/set-conditional-access-policies.md index 78a1f499cb0..62acbd9f643 100644 --- a/windows-365/enterprise/set-conditional-access-policies.md +++ b/windows-365/enterprise/set-conditional-access-policies.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 7/26/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/set-up-citrix.md b/windows-365/enterprise/set-up-citrix.md index a750f246ad2..e9aeaa41072 100644 --- a/windows-365/enterprise/set-up-citrix.md +++ b/windows-365/enterprise/set-up-citrix.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 08/21/2023 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: @@ -49,7 +49,7 @@ To set up Citrix HDX Plus for Windows 365 Enterprise, follow these steps. The fi To turn on the Citrix connector, follow these steps: -1. As a Global administrator, sign in to [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Tenant administration** > **Connectors and tokens**. +1. As an Intune Administrator, sign in to [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Tenant administration** > **Connectors and tokens**. ![Screenshot of navigating to Connectors and tokens](./media/set-up-citrix/connectors-tokens.png) diff --git a/windows-365/enterprise/set-up-omnissa-horizon.md b/windows-365/enterprise/set-up-omnissa-horizon.md index 0106e3bc4ed..28ccfe2d542 100644 --- a/windows-365/enterprise/set-up-omnissa-horizon.md +++ b/windows-365/enterprise/set-up-omnissa-horizon.md @@ -7,10 +7,10 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 08/01/2024 +ms.date: 08/21/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: @@ -48,7 +48,7 @@ To set up Omnissa Horizon for Windows 365 Enterprise, follow these steps. The fi To turn on the Omnissa connector, follow these steps: -1. As a Global administrator, sign in to [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Tenant administration** > **Connectors and tokens**. +1. As an Intune administrator, sign in to [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Tenant administration** > **Connectors and tokens**. ![Screenshot of navigating to Connectors and tokens.](./media/set-up-citrix/connectors-tokens.png) 2. Select **Windows partner connectors** > **Add**. 3. Under **Add connector**, select **Omnissa** in the drop-down list. diff --git a/windows-365/enterprise/set-up-tenants-windows-365-gcc.md b/windows-365/enterprise/set-up-tenants-windows-365-gcc.md index 3a79093afa0..ec7c952fd86 100644 --- a/windows-365/enterprise/set-up-tenants-windows-365-gcc.md +++ b/windows-365/enterprise/set-up-tenants-windows-365-gcc.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 08/11/2023 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/share-restore-points-storage.md b/windows-365/enterprise/share-restore-points-storage.md index 34e005f75c6..0ab1e097594 100644 --- a/windows-365/enterprise/share-restore-points-storage.md +++ b/windows-365/enterprise/share-restore-points-storage.md @@ -7,10 +7,10 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 04/29/2023 +ms.date: 08/28/2024 ms.topic: conceptual ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/teams-on-cloud-pc.md b/windows-365/enterprise/teams-on-cloud-pc.md index fdab78b8105..e63c81c2f1a 100644 --- a/windows-365/enterprise/teams-on-cloud-pc.md +++ b/windows-365/enterprise/teams-on-cloud-pc.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 07/01/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/troubleshoot-azure-network-connection.md b/windows-365/enterprise/troubleshoot-azure-network-connection.md index 199de7e2102..8f491982c94 100644 --- a/windows-365/enterprise/troubleshoot-azure-network-connection.md +++ b/windows-365/enterprise/troubleshoot-azure-network-connection.md @@ -7,10 +7,10 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 06/15/2023 +ms.date: 08/22/2024 ms.topic: troubleshooting ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: @@ -19,7 +19,7 @@ ms.assetid: #ROBOTS: #audience: -ms.reviewer: mattsha +ms.reviewer: ericor ms.suite: ems search.appverid: MET150 #ms.tgt_pltfrm: diff --git a/windows-365/enterprise/troubleshoot-partner-connector.md b/windows-365/enterprise/troubleshoot-partner-connector.md index ed41eceef6f..efb67d92cf8 100644 --- a/windows-365/enterprise/troubleshoot-partner-connector.md +++ b/windows-365/enterprise/troubleshoot-partner-connector.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 08/01/2024 ms.topic: troubleshooting ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/troubleshoot-windows-365-app.md b/windows-365/enterprise/troubleshoot-windows-365-app.md index 6632be473ee..78031acaa38 100644 --- a/windows-365/enterprise/troubleshoot-windows-365-app.md +++ b/windows-365/enterprise/troubleshoot-windows-365-app.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 03/28/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/troubleshoot-windows-365-boot.md b/windows-365/enterprise/troubleshoot-windows-365-boot.md index 190ad92c96d..3dfa6d9661e 100644 --- a/windows-365/enterprise/troubleshoot-windows-365-boot.md +++ b/windows-365/enterprise/troubleshoot-windows-365-boot.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 09/26/2023 ms.topic: troubleshooting ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/troubleshooting.md b/windows-365/enterprise/troubleshooting.md index dc25f2d7926..b61b9586331 100644 --- a/windows-365/enterprise/troubleshooting.md +++ b/windows-365/enterprise/troubleshooting.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 05/20/2024 ms.topic: troubleshooting ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/use-provisioning-policy-default-display-language.md b/windows-365/enterprise/use-provisioning-policy-default-display-language.md index 69d8e263d62..7383c9aaee1 100644 --- a/windows-365/enterprise/use-provisioning-policy-default-display-language.md +++ b/windows-365/enterprise/use-provisioning-policy-default-display-language.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 07/25/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/watermarking.md b/windows-365/enterprise/watermarking.md index 58e94b66adb..4c48aad2615 100644 --- a/windows-365/enterprise/watermarking.md +++ b/windows-365/enterprise/watermarking.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 08/07/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/whats-new.md b/windows-365/enterprise/whats-new.md index 61932d71ccd..1511fc45426 100644 --- a/windows-365/enterprise/whats-new.md +++ b/windows-365/enterprise/whats-new.md @@ -7,10 +7,10 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 08/1/2024 +ms.date: 08/29/2024 ms.topic: conceptual ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: @@ -55,6 +55,37 @@ For more information about public preview items, see [Public preview in Windows ### Windows 365 app --> + +## Week of August 26, 2024 (Service release 2408) + + +### Apps + +#### Azure Monitor support on Windows 365 Cloud PCs + +Azure Monitor Agent can now be installed on Windows 365 Enterprise and Windows 365 Government Cloud PCs. For more information, see [Azure Monitor overview](/azure/azure-monitor/overview). + + +### Device security + +#### Session lock experience configuration for single sign-on + +You can now configure the remote session lock experience when single sign-on is enabled between the default disconnect behavior and showing the remote lock screen. For more information, see [Configure single sign-on for Windows 365 using Microsoft Entra authentication](configure-single-sign-on.md). + +#### Windows 365 support for Microsoft Purview Customer Key is now generally available + +Windows 365 support for encrypting Cloud PCs by setting up Microsoft Purview Customer Key has moved out of preview and into general availability. For more information, see [Service encryption with Microsoft Purview Customer Key](/purview/customer-key-overview). + + +## Week of August 5, 2024 + + +### Documentation + +#### Updated documentation article: Windows 365 service resilience + +We’ve created a new article explaining Windows 365 service resilience. For more information, see [Windows 365 service resilience](resilience.md). + ## Week of July 29, 2024 (Service release 2407) @@ -82,6 +113,13 @@ Windows 365 Government now supports Microsoft Purview Customer Lockbox. For more information, see [Microsoft Purview Customer Lockbox](/purview/customer-lockbox-requests). + +### Monitor and troubleshoot + +#### New Intune report and device action for Windows enrollment attestation (public preview) + +Use the new device attestation status report in Microsoft Intune to find out if a device has attested and enrolled securely while being hardware-backed. For more information, see [Device attestation status report](/mem/intune/fundamentals/reports#device-attestation-status-report). + ### Partners @@ -121,11 +159,6 @@ Windows 365 Cloud PCs now support FIDO devices and passkeys for Microsoft Entra ## Week of July 8, 2024 - -### Cloud PC public preview support for FIDO devices and passkeys on macOS and iOS - -Windows 365 Cloud PCs now support FIDO devices and passkeys for Microsoft Entra ID sign in on macOS and iOS. - ### Device management diff --git a/windows-365/enterprise/windows-365-boot-guide.md b/windows-365/enterprise/windows-365-boot-guide.md index 72975d664f6..230beb2ab62 100644 --- a/windows-365/enterprise/windows-365-boot-guide.md +++ b/windows-365/enterprise/windows-365-boot-guide.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 08/05/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/windows-365-boot-known-issues.md b/windows-365/enterprise/windows-365-boot-known-issues.md index f690dd38087..68093cd4030 100644 --- a/windows-365/enterprise/windows-365-boot-known-issues.md +++ b/windows-365/enterprise/windows-365-boot-known-issues.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 09/26/2023 ms.topic: troubleshooting ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/windows-365-boot-overview.md b/windows-365/enterprise/windows-365-boot-overview.md index b9ddc00d94d..f906a403ef1 100644 --- a/windows-365/enterprise/windows-365-boot-overview.md +++ b/windows-365/enterprise/windows-365-boot-overview.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 06/26/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/windows-365-boot-physical-device-requirements.md b/windows-365/enterprise/windows-365-boot-physical-device-requirements.md index 35e1e56ba2c..b715d3d6623 100644 --- a/windows-365/enterprise/windows-365-boot-physical-device-requirements.md +++ b/windows-365/enterprise/windows-365-boot-physical-device-requirements.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 08/05/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/windows-365-boot-restrict-user-access-physical-device.md b/windows-365/enterprise/windows-365-boot-restrict-user-access-physical-device.md index 61b3967f751..e9ed94cf2ab 100644 --- a/windows-365/enterprise/windows-365-boot-restrict-user-access-physical-device.md +++ b/windows-365/enterprise/windows-365-boot-restrict-user-access-physical-device.md @@ -7,10 +7,10 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 09/26/2023 +ms.date: 08/28/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/windows-365-switch-known-issues.md b/windows-365/enterprise/windows-365-switch-known-issues.md index c66e698aa97..a0df9c3f15f 100644 --- a/windows-365/enterprise/windows-365-switch-known-issues.md +++ b/windows-365/enterprise/windows-365-switch-known-issues.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 06/27/2024 ms.topic: troubleshooting ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/windows-365-switch-overview.md b/windows-365/enterprise/windows-365-switch-overview.md index 107e1c08f37..d3a87545b97 100644 --- a/windows-365/enterprise/windows-365-switch-overview.md +++ b/windows-365/enterprise/windows-365-switch-overview.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 02/29/2024 ms.topic: overview ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/windows-update-frontline-cloud-pc.md b/windows-365/enterprise/windows-update-frontline-cloud-pc.md index de487ac34b8..0a5cb901f77 100644 --- a/windows-365/enterprise/windows-update-frontline-cloud-pc.md +++ b/windows-365/enterprise/windows-update-frontline-cloud-pc.md @@ -10,7 +10,7 @@ manager: dougeby ms.date: 02/28/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/enterprise/zoom-support.md b/windows-365/enterprise/zoom-support.md index 875505f957d..9c6ebba9233 100644 --- a/windows-365/enterprise/zoom-support.md +++ b/windows-365/enterprise/zoom-support.md @@ -7,10 +7,10 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 09/13/2023 +ms.date: 08/28/2024 ms.topic: how-to ms.service: windows-365 -ms.subservice: +ms.subservice: windows-365-enterprise ms.localizationpriority: high ms.assetid: diff --git a/windows-365/export-cloud-pc-names.md b/windows-365/export-cloud-pc-names.md index c1a2473236b..3608d3b09b5 100644 --- a/windows-365/export-cloud-pc-names.md +++ b/windows-365/export-cloud-pc-names.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 06/16/2023 +ms.date: 08/28/2024 ms.topic: how-to ms.service: windows-365 ms.subservice: diff --git a/windows-365/media/partners/nable.png b/windows-365/media/partners/nable.png new file mode 100644 index 00000000000..2570add30d7 Binary files /dev/null and b/windows-365/media/partners/nable.png differ diff --git a/windows-365/partners.md b/windows-365/partners.md index 2d120d7ea9e..04bfc80f89a 100644 --- a/windows-365/partners.md +++ b/windows-365/partners.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 06/16/2023 +ms.date: 08/22/2024 ms.topic: overview ms.service: windows-365 ms.subservice: @@ -71,6 +71,19 @@ Secure access to Windows 365 is further enhanced with IGEL OS: For more information, visit the [IGEL website](https://www.igel.com/windows365/). +## N-able + +![N-able image](./media/partners/nable.png) + +N-able Cloud Commander is a multi-tenant solution for Microsoft's cloud. In a single console, it enables MSPs and CSPs to manage, secure, standardize, and automate: + +- Microsoft 365 users +- Azure resources +- Intune devices +- Windows 365 Business/Enterprise/Frontline Cloud PCs + +For more information, visit the [N-able website](https://www.n-able.com/products/cloud-commander). + ## Nerdio ![Nerdio image](./media/partners/nerdio.png)