**Test your site on Microsoft Edge**
Test your site on Microsoft Edge for free instantly, with remote browser testing powered by BrowserStack. You can also use the linting tool sonarwhal to assess your site's accessibility, speed, security, and more.
Test your site on Microsoft Edge for free on BrowserStack
Use sonarwhal to improve your website.
**Improve compatibility with Enterprise Mode**
With Enterprise Mode you can use Microsoft Edge as your default browser, while ensuring apps continue working on IE11.
Use Enterprse mode to improve compatibility
Turn on Enterprise Mode and use a site list
Enterprise Site List Portal
Ultimate browser strategy on Windows 10
**Web Application Compatibility Lab Kit**
The Web Application Compatibility Lab Kit is a primer for the features and techniques used to provide web application compatibility during a typical enterprise migration to Microsoft Edge.
Find out more
**Test your site on Microsoft Edge** Test your site on Microsoft Edge for free instantly, with remote browser testing powered by BrowserStack. You can also use the linting tool sonarwhal to assess your site's accessibility, speed, security, and more. Test your site on Microsoft Edge for free on BrowserStack Use sonarwhal to improve your website. | **Improve compatibility with Enterprise Mode** With Enterprise Mode you can use Microsoft Edge as your default browser, while ensuring apps continue working on IE11. Use Enterprse mode to improve compatibility Turn on Enterprise Mode and use a site list Enterprise Site List Portal Ultimate browser strategy on Windows 10 | **Web Application Compatibility Lab Kit** The Web Application Compatibility Lab Kit is a primer for the features and techniques used to provide web application compatibility during a typical enterprise migration to Microsoft Edge. Find out more |
-
 **Deployment** Find resources, learn about features, and get answers to commonly asked questions to help you deploy Microsoft Edge in your organization. Microsoft Edge deployment guide Microsoft Edge FAQ System requirements and language support Group Policy and MDM settings in Microsoft Edge Download the Web Application Compatibility Lab Kit Microsoft Edge training and demonstrations |  **End user readiness** Help your users get started on Microsoft Edge quickly and learn about features like tab management, instant access to Office files, and more. Quick Start: Microsoft Edge (PDF, .98 MB) Find it faster with Microsoft Edge (PDF, 605 KB) Use Microsoft Edge to collaborate (PDF, 468 KB) Import bookmarks Password management Microsoft Edge tips and tricks (video, 20:26) |
**Deployment** Find resources, learn about features, and get answers to commonly asked questions to help you deploy Microsoft Edge in your organization. Microsoft Edge deployment guide Microsoft Edge FAQ System requirements and language support Group Policy and MDM settings in Microsoft Edge Download the Web Application Compatibility Lab Kit Microsoft Edge training and demonstrations | **End user readiness** Help your users get started on Microsoft Edge quickly and learn about features like tab management, instant access to Office files, and more. Quick Start: Microsoft Edge (PDF, .98 MB) Find it faster with Microsoft Edge (PDF, 605 KB) Use Microsoft Edge to collaborate (PDF, 468 KB) Import bookmarks Password management Microsoft Edge tips and tricks (video, 20:26) |
-
 **In-place upgrade** The simplest way to upgrade PCs that are currently running Windows 7, Windows 8, or Windows 8.1 is to do an in-place upgrade. Upgrade to Windows 10 with Configuration Manager Upgrade to Windows 10 with MDT |  **Traditional deployment** Some organizations may still need to opt for an image-based deployment of Windows 10. Deploy Windows 10 with Configuration Manager Deploy Windows 10 with MDT |
 **Dynamic provisioning** With Windows 10 you can create provisioning packages that let you quickly configure a device without having to install a new image. Provisioning packages for Windows 10 Build and apply a provisioning package Customize Windows 10 start and the taskbar |  **Other deployment scenarios** Get guidance on how to deploy Windows 10 for students, faculty, and guest users - and how to deploy line-of-business apps. Windows deployment for education environments Set up a shared or guest PC with Windows 10 Sideload apps in Windows 10 |
**In-place upgrade** The simplest way to upgrade PCs that are currently running Windows 7, Windows 8, or Windows 8.1 is to do an in-place upgrade. Upgrade to Windows 10 with Configuration Manager Upgrade to Windows 10 with MDT | **Traditional deployment** Some organizations may still need to opt for an image-based deployment of Windows 10. Deploy Windows 10 with Configuration Manager Deploy Windows 10 with MDT |
**Dynamic provisioning** With Windows 10 you can create provisioning packages that let you quickly configure a device without having to install a new image. Provisioning packages for Windows 10 Build and apply a provisioning package Customize Windows 10 start and the taskbar | **Other deployment scenarios** Get guidance on how to deploy Windows 10 for students, faculty, and guest users - and how to deploy line-of-business apps. Windows deployment for education environments Set up a shared or guest PC with Windows 10 Sideload apps in Windows 10 |
For example:
{
"windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d",
}
-
If you need to add Windows 10 mobile apps that aren't distributed through the Store for Business, you must use the **Windows Device Portal** feature.
>**Note**Your PC and phone must be on the same wireless network. @@ -173,10 +170,7 @@ To add **Desktop apps**, complete the following fields, based on what results yo
Classless Inter-Domain Routing (CIDR) notation isn’t supported for WIP configurations. +To define the network boundaries, click **App policy** > the name of your policy > **Advanced settings** > **Add network boundary**. -**To define where your protected apps can find and send enterprise data on you network** + -1. From the **App policy** blade, click the name of your policy, and then click **Advanced settings**. +Select the type of network boundary to add from the **Boundary type** box. Type a name for your boundary into the **Name** box, add your values to the **Value** box, based on the following options, and then click **OK**. -2. Click **Add network boundary** from the Network perimeter area. +### Cloud resources -  +Specify the cloud resources to be treated as corporate and protected by WIP. +For each cloud resource, you may also optionally specify a proxy server from your Internal proxy servers list to route traffic for this cloud resource. +Be aware that all traffic routed through your Internal proxy servers is considered enterprise. -3. Select the type of network boundary to add from the **Boundary type** box. +Separate multiple resources with the "|" delimiter. +If you don’t use proxy servers, you must also include the "," delimiter just before the "|". +For example: -4. Type a name for your boundary into the **Name** box, add your values to the **Value** box, based on the following options, and then click **OK**. +```code +URL <,proxy>|URL <,proxy> +``` -
| Boundary type | -Value format | -Description | -|
|---|---|---|---|
| Cloud Resources | -With proxy: contoso.sharepoint.com,contoso.internalproxy1.com| contoso.visualstudio.com,contoso.internalproxy2.com Without proxy: contoso.sharepoint.com|contoso.visualstudio.com |
- Specify the cloud resources to be treated as corporate and protected by WIP. For each cloud resource, you may also optionally specify a proxy server from your Internal proxy servers list to route traffic for this cloud resource. Be aware that all traffic routed through your Internal proxy servers is considered enterprise. If you have multiple resources, you must separate them using the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example: URL <,proxy>|URL <,proxy>.Personal applications will be able to access Enterprise Cloud Resources if the resource in the Enterprise Cloud Resource Policy has a blank space or an invalid character, such as a trailing dot in the URL. |
+Personal applications will be able to access a cloud resource that has a blank space or an invalid character, such as a trailing dot in the URL.
- Specify the cloud resources to be treated as corporate and protected by WIP. For each cloud resource, you may also optionally specify a proxy server from your Internal proxy servers list to route traffic for this cloud resource. Be aware that all traffic routed through your Internal proxy servers is considered enterprise. If you have multiple resources, you must separate them using the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example: URL <,proxy>|URL <,proxy>.Personal applications will be able to access Enterprise Cloud Resources if the resource in the Enterprise Cloud Resource Policy has a blank space or an invalid character, such as a trailing dot in the URL. |
-
| Protected domains | -exchange.contoso.com,contoso.com,region.contoso.com | -Specify the domains used for identities in your environment. All traffic to the fully-qualified domains appearing in this list will be protected. If you have multiple domains, you must separate them using the "," delimiter. |
- |
| Network domains | -corp.contoso.com,region.contoso.com | -Specify the DNS suffixes used in your environment. All traffic to the fully-qualified domains appearing in this list will be protected. If you have multiple resources, you must separate them using the "," delimiter. |
- |
| Proxy servers | -proxy.contoso.com:80;proxy2.contoso.com:443 | -Specify the proxy servers your devices will go through to reach your cloud resources. Using this server type indicates that the cloud resources you’re connecting to are enterprise resources. This list shouldn’t include any servers listed in your Internal proxy servers list. Internal proxy servers must be used only for WIP-protected (enterprise) traffic. If you have multiple resources, you must separate them using the ";" delimiter. |
- |
| Internal proxy servers | -contoso.internalproxy1.com;contoso.internalproxy2.com | -Specify the internal proxy servers your devices will go through to reach your cloud resources. Using this server type indicates that the cloud resources you’re connecting to are enterprise resources. This list shouldn’t include any servers listed in your Proxy servers list. Proxy servers must be used only for non-WIP-protected (non-enterprise) traffic. If you have multiple resources, you must separate them using the ";" delimiter. |
- |
| IPv4 ranges | -**Starting IPv4 Address:** 3.4.0.1 **Ending IPv4 Address:** 3.4.255.254 **Custom URI:** 3.4.0.1-3.4.255.254, 10.0.0.1-10.255.255.254 |
- Starting with Windows 10, version 1703, this field is optional. Specify the addresses for a valid IPv4 value range within your intranet. These addresses, used with your Network domain names, define your corporate network boundaries. If you have multiple ranges, you must separate them using the "," delimiter. |
- |
| IPv6 ranges | -**Starting IPv6 Address:** 2a01:110:: **Ending IPv6 Address:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff **Custom URI:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff, fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff |
- Starting with Windows 10, version 1703, this field is optional. Specify the addresses for a valid IPv6 value range within your intranet. These addresses, used with your Network domain names, define your corporate network boundaries. If you have multiple ranges, you must separate them using the "," delimiter. |
- |
| Neutral resources | -sts.contoso.com,sts.contoso2.com | -Specify your authentication redirection endpoints for your company. These locations are considered enterprise or personal, based on the context of the connection before the redirection. If you have multiple resources, you must separate them using the "," delimiter. |
-
10.0.0.1-10.255.255.254 + +### IPv6 ranges + +Starting with Windows 10, version 1703, this field is optional. + +Specify the addresses for a valid IPv6 value range within your intranet. +These addresses, used with your network domain names, define your corporate network boundaries. +Classless Inter-Domain Routing (CIDR) notation isn’t supported. + +Separate multiple ranges with the "," delimiter. + +**Starting IPv6 Address:** 2a01:110:: +**Ending IPv6 Address:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff +**Custom URI:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff,
fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + +### Neutral resources + +Specify your authentication redirection endpoints for your company. +These locations are considered enterprise or personal, based on the context of the connection before the redirection. +Separate multiple resources with the "," delimiter. + +```code +sts.contoso.com,sts.contoso2.com +``` + +Decide if you want Windows to look for additional network settings: + +- **Enterprise Proxy Servers list is authoritative (do not auto-detect).** Turn on if you want Windows to treat the proxy servers you specified in the network boundary definition as the complete list of proxy servers available on your network. If you turn this off, Windows will search for additional proxy servers in your immediate network. + +- **Enterprise IP Ranges list is authoritative (do not auto-detect).** Turn on if you want Windows to treat the IP ranges you specified in the network boundary definition as the complete list of IP ranges available on your network. If you turn this off, Windows will search for additional IP ranges on any domain-joined devices connected to your network. + + ## Upload your Data Recovery Agent (DRA) certificate After you create and deploy your WIP policy to your employees, Windows begins to encrypt your corporate data on the employees’ local device drive. If somehow the employees’ local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the Data Recovery Agent (DRA) certificate lets Windows use an included public key to encrypt the local data while you maintain the private key that can unencrypt the data. diff --git a/windows/security/information-protection/windows-information-protection/images/add-protected-domains.png b/windows/security/information-protection/windows-information-protection/images/add-protected-domains.png new file mode 100644 index 0000000000..848ff120a2 Binary files /dev/null and b/windows/security/information-protection/windows-information-protection/images/add-protected-domains.png differ diff --git a/windows/security/information-protection/windows-information-protection/images/create-app-protection-policy.png b/windows/security/information-protection/windows-information-protection/images/create-app-protection-policy.png new file mode 100644 index 0000000000..345093afc8 Binary files /dev/null and b/windows/security/information-protection/windows-information-protection/images/create-app-protection-policy.png differ diff --git a/windows/security/information-protection/windows-information-protection/images/mobility-provider.png b/windows/security/information-protection/windows-information-protection/images/mobility-provider.png new file mode 100644 index 0000000000..280a0531dc Binary files /dev/null and b/windows/security/information-protection/windows-information-protection/images/mobility-provider.png differ diff --git a/windows/security/information-protection/windows-information-protection/images/recommended-apps.png b/windows/security/information-protection/windows-information-protection/images/recommended-apps.png new file mode 100644 index 0000000000..658cbb343b Binary files /dev/null and b/windows/security/information-protection/windows-information-protection/images/recommended-apps.png differ