add Chandler's RS4 changes, waiting on note from Lily

windows/configuration/lock-down-windows-10-to-specific-apps.md

@@ -92,7 +92,12 @@ You can start your file by pasting the following XML (or any other examples in t
 
 ### Profile
 
-A profile section in the XML has the following entries: 
+There are two types of profiles tha tyou can specify in the XML:
+
+- **Lockdown profile**: Users assigned a lockdown profile will see the desktop in tablet mode with the specific apps on the Start screen.
+- **Kiosk profile**: New in Windows 10, version (1804?), this profile replaces the KioskModeApp node of the [AssignedAccess CSP](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp). Users assigned a kiosk profile will not see the desktop, but only the kiosk app running in full-screen mode.
+
+A lockdown profile section in the XML has the following entries: 
 
 - [**Id**](#id) 
 
@@ -102,6 +107,13 @@ A profile section in the XML has the following entries:
 
 - [**Taskbar**](#taskbar)
 
+A kiosk profile in the XML has the following entries:
+
+- [**Id**](#id) 
+
+- [**KioskModeApp**](#kioskmodeapp)
+
+
 
 #### Id
 
@@ -221,15 +233,32 @@ The following example hides the taskbar:
 >[!NOTE]
 >This is different from the **Automatically hide the taskbar** option in tablet mode, which shows the taskbar when swiping up from or moving the mouse pointer down to the bottom of the screen. Setting **ShowTaskbar** as **false** will always keep the taskbar hidden. 
 
+#### KioskModeApp 
+
+**KioskModeApp** is used for a [kiosk profile](#profile) only. Enter the AUMID for a single app.
+
+```xml
+<KioskModeApp AppUserModelId="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App"/>
+```
+
+>[!IMPORTANT]
+>The kiosk profile is designed for public-facing kiosk devices. We recommend that you use a local, non-administrator account. If the device is connected to your company network, using a domain or Azure Active Direcotry account could potentially compromise confidential information.  
+
 ### Configs
 
 Under **Configs**, define which user account will be associated with the profile. When this user account signs in on the device, the associated assigned access profile will be enforced, including the allowed apps, Start layout, and taskbar configuration, as well as other local group policies or mobile device management (MDM) policies set as part of the multi-app experience. 
 
 The full multi-app assigned access experience can only work for non-admin users. It’s not supported to associate an admin user with the assigned access profile; doing this in the XML file will result in unexpected/unsupported experiences when this admin user signs in.  
 
+Individual accounts can be local, domain, or Azure Active Directory (Azure AD). In Windows 10, version (1804?), group accounts are also supported. Group accounts can be local, Active Directory (domain), or Azure AD.
 
+>[!NOTE]
+>Configs that specify group accounts cannot use a kiosk profile, only a lockdown profile. If a group is configured to a kiosk profile, the CSP will reject the request.   
+
+#### Configs for individual accounts
+
+Individual accounts are specified using `<Account>`.
 
-The account can be local, domain, or Azure Active Directory (Azure AD). Groups are not supported.
 - Local account can be entered as `machinename\account` or `.\account` or just `account`.
 - Domain account should be entered as `domain\account`.
 - Azure AD account must be specified in this format: `AzureAD\{email address}`. **AzureAD** must be provided AS IS (consider it’s a fixed domain name), then follow with the Azure AD email address, e.g. **AzureAD\someone@contoso.onmicrosoft.com**.
@@ -253,7 +282,37 @@ Before applying the multi-app configuration, make sure the specified user accoun
 </Configs> 
 ```
 
+#### Configs for group accounts
 
+Group accounts are specified using `<UserGroup>`.
+
+- Local group: Specify the group type as **LocalGroup** and put the group name in Name attribute. 
+  ```xml
+  <Config> 
+    <UserGroup Type="LocalGroup" Name="mygroup" /> 
+    <DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"/> 
+</Config> 
+  ```
+- Domain group: Both security and distribution groups are supported. Specify the group type as **ActiveDirectoryGroup**. Use the domain name as the prefix in the name attribute.
+
+  ```xml
+  <Config> 
+    <UserGroup Type="ActiveDirectoryGroup" Name="mydomain\mygroup" /> 
+    <DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"/> 
+</Config> 
+  ```
+
+- Azure AD group: Use the group object ID from the Azure portal to uniquely identify the group in the Name attribute. You can find the object ID on the overview page for the group in **Users and groups** > **All groups**. Specify the group type as **AzureActiveDirectoryGroup**.
+
+  ```xml
+  <Config> 
+    <UserGroup Type="AzureActiveDirectoryGroup" Name="a8d36e43-4180-4ac5-a627-fb8149bba1ac" /> 
+    <DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"/> 
+</Config> 
+  ```
+
+  >[!NOTE]
+  >If an Azure AD group is configured with a lockdown profile on a device, a user in the Azure AD group must change their password (after the account has been created with default password on the portal) before they can sign in to this device. If the user uses the default password to sign in to the device, the user will be immediately signed out. 
 
 <span id="add-xml" />
 ## Add XML file to provisioning package