diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md
index 3b3a19e7b1..5270d3eb1d 100644
--- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md
+++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md
@@ -4,7 +4,7 @@ description: Learn about the ADMX-backed policies in Policy CSP.
author: vinaypamnani-msft
manager: aaroncz
ms.author: vinpa
-ms.date: 11/02/2022
+ms.date: 11/22/2022
ms.localizationpriority: medium
ms.prod: windows-client
ms.technology: itpro-manage
diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md
index 0b6dede6bb..f1cfc9181d 100644
--- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md
+++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md
@@ -4,7 +4,7 @@ description: Learn about the policies in Policy CSP supported by Group Policy.
author: vinaypamnani-msft
manager: aaroncz
ms.author: vinpa
-ms.date: 11/02/2022
+ms.date: 11/22/2022
ms.localizationpriority: medium
ms.prod: windows-client
ms.technology: itpro-manage
diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md
index fa72136ceb..283417da87 100644
--- a/windows/client-management/mdm/policy-configuration-service-provider.md
+++ b/windows/client-management/mdm/policy-configuration-service-provider.md
@@ -4,7 +4,7 @@ description: Learn more about the Policy CSP
author: vinaypamnani-msft
manager: aaroncz
ms.author: vinpa
-ms.date: 11/02/2022
+ms.date: 11/22/2022
ms.localizationpriority: medium
ms.prod: windows-client
ms.technology: itpro-manage
@@ -1073,6 +1073,7 @@ Specifies the name/value pair used in the policy. See the individual Area DDFs f
- [Browser](policy-csp-browser.md)
- [Camera](policy-csp-camera.md)
- [Cellular](policy-csp-cellular.md)
+- [CloudDesktop](policy-csp-clouddesktop.md)
- [CloudPC](policy-csp-cloudpc.md)
- [Connectivity](policy-csp-connectivity.md)
- [ControlPolicyConflict](policy-csp-controlpolicyconflict.md)
diff --git a/windows/client-management/mdm/policy-csp-clouddesktop.md b/windows/client-management/mdm/policy-csp-clouddesktop.md
new file mode 100644
index 0000000000..c31ce3ba2a
--- /dev/null
+++ b/windows/client-management/mdm/policy-csp-clouddesktop.md
@@ -0,0 +1,79 @@
+---
+title: CloudDesktop Policy CSP
+description: Learn more about the CloudDesktop Area in Policy CSP
+author: vinaypamnani-msft
+manager: aaroncz
+ms.author: vinpa
+ms.date: 11/22/2022
+ms.localizationpriority: medium
+ms.prod: windows-client
+ms.technology: itpro-manage
+ms.topic: reference
+---
+
+
+
+
+# Policy CSP - CloudDesktop
+
+
+
+
+
+
+## BootToCloudMode
+
+
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:x: Windows SE | :heavy_check_mark: Windows Insider Preview |
+
+
+
+```Device
+./Device/Vendor/MSFT/Policy/Config/CloudDesktop/BootToCloudMode
+```
+
+
+
+This policy is used by IT admin to set the configuration mode of cloud PC.
+
+
+
+
+
+
+
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | int |
+| Access Type | Add, Delete, Get, Replace |
+| Default Value | 0 |
+
+
+
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 0 (Default) | Not Configured |
+| 1 | Enable Boot to Cloud Desktop |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+## Related articles
+
+[Policy configuration service provider](policy-configuration-service-provider.md)
diff --git a/windows/client-management/mdm/policy-csp-windowslogon.md b/windows/client-management/mdm/policy-csp-windowslogon.md
index 7af2d1affc..95902680cc 100644
--- a/windows/client-management/mdm/policy-csp-windowslogon.md
+++ b/windows/client-management/mdm/policy-csp-windowslogon.md
@@ -1,522 +1,571 @@
---
-title: Policy CSP - WindowsLogon
-description: Use the Policy CSP - WindowsLogon setting to control whether a device automatically signs in and locks the last interactive user after the system restarts.
+title: WindowsLogon Policy CSP
+description: Learn more about the WindowsLogon Area in Policy CSP
+author: vinaypamnani-msft
+manager: aaroncz
ms.author: vinpa
-ms.topic: article
+ms.date: 11/22/2022
+ms.localizationpriority: medium
ms.prod: windows-client
ms.technology: itpro-manage
-author: vinaypamnani-msft
-ms.localizationpriority: medium
-ms.date: 09/27/2019
-ms.reviewer:
-manager: aaroncz
+ms.topic: reference
---
+
+
+
# Policy CSP - WindowsLogon
-
-
-
-## WindowsLogon policies
-
-
- -
- WindowsLogon/AllowAutomaticRestartSignOn
-
- -
- WindowsLogon/ConfigAutomaticRestartSignOn
-
- -
- WindowsLogon/DisableLockScreenAppNotifications
-
- -
- WindowsLogon/DontDisplayNetworkSelectionUI
-
- -
- WindowsLogon/EnableFirstLogonAnimation
-
- -
- WindowsLogon/EnableMPRNotifications
-
- -
- WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers
-
- -
- WindowsLogon/HideFastUserSwitching
-
-
-
> [!TIP]
-> Some of these are ADMX-backed policies and require a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](../understanding-admx-backed-policies.md).
+> Some of these are ADMX-backed policies and require a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
>
-> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](../understanding-admx-backed-policies.md#enabling-a-policy).
+> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
>
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
+
+
-
-**WindowsLogon/AllowAutomaticRestartSignOn**
+
+## AllowAutomaticRestartSignOn
-
-The table below shows the applicability of Windows:
+
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1903 [10.0.18362] and later |
+
-|Edition|Windows 10|Windows 11|
-|--- |--- |--- |
-|Home|Yes|Yes|
-|Pro|Yes|Yes|
-|Windows SE|No|Yes|
-|Business|Yes|Yes|
-|Enterprise|Yes|Yes|
-|Education|Yes|Yes|
+
+```Device
+./Device/Vendor/MSFT/Policy/Config/WindowsLogon/AllowAutomaticRestartSignOn
+```
+
-
-
+
+This policy setting controls whether a device will automatically sign in and lock the last interactive user after the system restarts or after a shutdown and cold boot.
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
+This only occurs if the last interactive user didn’t sign out before the restart or shutdown.
-> [!div class = "checklist"]
-> * Device
+If the device is joined to Active Directory or Azure Active Directory, this policy only applies to Windows Update restarts. Otherwise, this will apply to both Windows Update restarts and user-initiated restarts and shutdowns.
-
+If you don’t configure this policy setting, it is enabled by default. When the policy is enabled, the user is automatically signed in and the session is automatically locked with all lock screen apps configured for that user after the device boots.
-
-
-This policy setting controls whether a device automatically signs in and locks the last interactive user after the system restarts or after a shutdown and cold boot.
+After enabling this policy, you can configure its settings through the ConfigAutomaticRestartSignOn policy, which configures the mode of automatically signing in and locking the last interactive user after a restart or cold boot.
-This scenario occurs only if the last interactive user didn't sign out before the restart or shutdown.
+If you disable this policy setting, the device does not configure automatic sign in. The user’s lock screen apps are not restarted after the system restarts.
+
-If the device is joined to Active Directory or Azure Active Directory, this policy applies only to Windows Update restarts. Otherwise, this policy applies to both Windows Update restarts and user-initiated restarts and shutdowns.
+
+
+
-If you don't configure this policy setting, it's enabled by default. When the policy is enabled, the user is automatically signed in and the session is automatically locked with all lock screen apps configured for that user after the device boots.
+
+**Description framework properties**:
-After enabling this policy, you can configure its settings through the [ConfigAutomaticRestartSignOn](#windowslogon-configautomaticrestartsignon) policy, which configures the mode of automatically signing in and locking the last interactive user after a restart or cold boot.
+| Property name | Property value |
+|:--|:--|
+| Format | chr (string) |
+| Access Type | Add, Delete, Get, Replace |
+
-If you disable this policy setting, the device doesn't configure automatic sign in. The user’s lock screen apps aren't restarted after the system restarts.
+
+**ADMX mapping**:
-
+| Name | Value |
+|:--|:--|
+| Name | AutomaticRestartSignOnDescription |
+| Friendly Name | Sign-in and lock last interactive user automatically after a restart |
+| Location | Computer Configuration |
+| Path | Windows Components > Windows Logon Options |
+| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\System |
+| Registry Value Name | DisableAutomaticRestartSignOn |
+| ADMX File Name | WinLogon.admx |
+
-
-ADMX Info:
-- GP Friendly name: *Sign-in and lock last interactive user automatically after a restart*
-- GP name: *AutomaticRestartSignOn*
-- GP path: *Windows Components/Windows Logon Options*
-- GP ADMX file name: *WinLogon.admx*
+
+
+
-
-
+
-
-
+
+## ConfigAutomaticRestartSignOn
-
-
+
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1903 [10.0.18362] and later |
+
-
-
+
+```Device
+./Device/Vendor/MSFT/Policy/Config/WindowsLogon/ConfigAutomaticRestartSignOn
+```
+
-
-
-
-**WindowsLogon/ConfigAutomaticRestartSignOn**
-
-
-The table below shows the applicability of Windows:
-
-|Edition|Windows 10|Windows 11|
-|--- |--- |--- |
-|Home|Yes|Yes|
-|Pro|Yes|Yes|
-|Windows SE|No|Yes|
-|Business|Yes|Yes|
-|Enterprise|Yes|Yes|
-|Education|Yes|Yes|
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-This policy setting controls the configuration under which an automatic restart, sign in, and lock occurs after a restart or cold boot. If you chose “Disabled” in the [AllowAutomaticRestartSignOn](#windowslogon-allowautomaticrestartsignon) policy, then automatic sign in doesn't occur and this policy need not be configured.
+
+This policy setting controls the configuration under which an automatic restart and sign on and lock occurs after a restart or cold boot. If you chose “Disabled” in the “Sign-in and lock last interactive user automatically after a restart” policy, then automatic sign on will not occur and this policy does not need to be configured.
If you enable this policy setting, you can choose one of the following two options:
-- Enabled if BitLocker is on and not suspended: Specifies that automatic sign in and lock occurs only if BitLocker is active and not suspended during the reboot or shutdown. Personal data can be accessed on the device’s hard drive at this time if BitLocker isn't on or suspended during an update. BitLocker suspension temporarily removes protection for system components and data but may be needed in certain circumstances to successfully update boot-critical components.
+1. “Enabled if BitLocker is on and not suspended” specifies that automatic sign on and lock will only occur if BitLocker is active and not suspended during the reboot or shutdown. Personal data can be accessed on the device’s hard drive at this time if BitLocker is not on or suspended during an update. BitLocker suspension temporarily removes protection for system components and data but may be needed in certain circumstances to successfully update boot-critical components.
BitLocker is suspended during updates if:
- - The device doesn't have TPM 2.0 and PCR7
- - The device doesn't use a TPM-only protector
-- Always Enabled: Specifies that automatic sign in happens even if BitLocker is off or suspended during reboot or shutdown. When BitLocker isn't enabled, personal data is accessible on the hard drive. Automatic restart and sign in should only be run under this condition if you're confident that the configured device is in a secure physical location.
+- The device doesn’t have TPM 2.0 and PCR7, or
+- The device doesn’t use a TPM-only protector
+2. “Always Enabled” specifies that automatic sign on will happen even if BitLocker is off or suspended during reboot or shutdown. When BitLocker is not enabled, personal data is accessible on the hard drive. Automatic restart and sign on should only be run under this condition if you are confident that the configured device is in a secure physical location.
-If you disable or don't configure this setting, automatic sign in defaults to the “Enabled if BitLocker is on and not suspended” behavior.
+If you disable or don’t configure this setting, automatic sign on will default to the “Enabled if BitLocker is on and not suspended” behavior.
+
-
+
+
+
-
-ADMX Info:
-- GP Friendly name: *Configure the mode of automatically signing in and locking last interactive user after a restart or cold boot*
-- GP name: *ConfigAutomaticRestartSignOn*
-- GP path: *Windows Components/Windows Logon Options*
-- GP ADMX file name: *WinLogon.admx*
+
+**Description framework properties**:
-
-
+| Property name | Property value |
+|:--|:--|
+| Format | chr (string) |
+| Access Type | Add, Delete, Get, Replace |
+
-
-
+
+**ADMX mapping**:
-
-
+| Name | Value |
+|:--|:--|
+| Name | ConfigAutomaticRestartSignOnDescription |
+| Friendly Name | Configure the mode of automatically signing in and locking last interactive user after a restart or cold boot |
+| Location | Computer Configuration |
+| Path | Windows Components > Windows Logon Options |
+| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\System |
+| ADMX File Name | WinLogon.admx |
+
-
-
+
+
+
-
+
-
-**WindowsLogon/DisableLockScreenAppNotifications**
+
+## DisableLockScreenAppNotifications
-
-The table below shows the applicability of Windows:
+
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1703 [10.0.15063] and later |
+
-|Edition|Windows 10|Windows 11|
-|--- |--- |--- |
-|Home|No|No|
-|Pro|Yes|Yes|
-|Windows SE|No|Yes|
-|Business|Yes|Yes|
-|Enterprise|Yes|Yes|
-|Education|Yes|Yes|
+
+```Device
+./Device/Vendor/MSFT/Policy/Config/WindowsLogon/DisableLockScreenAppNotifications
+```
+
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
+
This policy setting allows you to prevent app notifications from appearing on the lock screen.
If you enable this policy setting, no app notifications are displayed on the lock screen.
-If you disable or don't configure this policy setting, users can choose which apps display notifications on the lock screen.
+If you disable or do not configure this policy setting, users can choose which apps display notifications on the lock screen.
+
-
+
+
+
-
-ADMX Info:
-- GP Friendly name: *Turn off app notifications on the lock screen*
-- GP name: *DisableLockScreenAppNotifications*
-- GP path: *System/Logon*
-- GP ADMX file name: *logon.admx*
+
+**Description framework properties**:
-
-
+| Property name | Property value |
+|:--|:--|
+| Format | chr (string) |
+| Access Type | Add, Delete, Get, Replace |
+
-
+
+**ADMX mapping**:
-
-**WindowsLogon/DontDisplayNetworkSelectionUI**
+| Name | Value |
+|:--|:--|
+| Name | DisableLockScreenAppNotifications |
+| Friendly Name | Turn off app notifications on the lock screen |
+| Location | Computer Configuration |
+| Path | System > Logon |
+| Registry Key Name | Software\Policies\Microsoft\Windows\System |
+| Registry Value Name | DisableLockScreenAppNotifications |
+| ADMX File Name | Logon.admx |
+
-
-The table below shows the applicability of Windows:
+
+
+
-|Edition|Windows 10|Windows 11|
-|--- |--- |--- |
-|Home|No|No|
-|Pro|Yes|Yes|
-|Windows SE|No|Yes|
-|Business|Yes|Yes|
-|Enterprise|Yes|Yes|
-|Education|Yes|Yes|
+
-
-
+
+## DontDisplayNetworkSelectionUI
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1703 [10.0.15063] and later |
+
-> [!div class = "checklist"]
-> * Device
+
+```Device
+./Device/Vendor/MSFT/Policy/Config/WindowsLogon/DontDisplayNetworkSelectionUI
+```
+
-
+
+This policy setting allows you to control whether anyone can interact with available networks UI on the logon screen.
-
-
-This policy setting allows you to control whether anyone can interact with available networks UI on the sign-in screen.
-
-If you enable this policy setting, the PC's network connectivity state can't be changed without signing into Windows.
+If you enable this policy setting, the PC's network connectivity state cannot be changed without signing into Windows.
If you disable or don't configure this policy setting, any user can disconnect the PC from the network or can connect the PC to other available networks without signing into Windows.
+
-Here's an example to enable this policy:
+
+
+
-```xml
-
-
-
- 300
-
- 301
- -
-
- ./Device/Vendor/MSFT/Policy/Config/WindowsLogon/DontDisplayNetworkSelectionUI
-
-
- chr
-
- ]]>
-
-
-
-
-
-
+
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | chr (string) |
+| Access Type | Add, Delete, Get, Replace |
+
+
+
+**ADMX mapping**:
+
+| Name | Value |
+|:--|:--|
+| Name | DontDisplayNetworkSelectionUI |
+| Friendly Name | Do not display network selection UI |
+| Location | Computer Configuration |
+| Path | System > Logon |
+| Registry Key Name | Software\Policies\Microsoft\Windows\System |
+| Registry Value Name | DontDisplayNetworkSelectionUI |
+| ADMX File Name | Logon.admx |
+
+
+
+
+
+
+
+
+
+## EnableFirstLogonAnimation
+
+
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1903 [10.0.18362] and later |
+
+
+
+```Device
+./Device/Vendor/MSFT/Policy/Config/WindowsLogon/EnableFirstLogonAnimation
```
+
-
+
+This policy setting allows you to control whether users see the first sign-in animation when signing in to the computer for the first time. This applies to both the first user of the computer who completes the initial setup and users who are added to the computer later. It also controls if Microsoft account users will be offered the opt-in prompt for services during their first sign-in.
-
-ADMX Info:
-- GP Friendly name: *Do not display network selection UI*
-- GP name: *DontDisplayNetworkSelectionUI*
-- GP path: *System/Logon*
-- GP ADMX file name: *logon.admx*
+If you enable this policy setting, Microsoft account users will see the opt-in prompt for services, and users with other accounts will see the sign-in animation.
-
-
+If you disable this policy setting, users will not see the animation and Microsoft account users will not see the opt-in prompt for services.
-
+If you do not configure this policy setting, the user who completes the initial Windows setup will see the animation during their first sign-in. If the first user had already completed the initial setup and this policy setting is not configured, users new to this computer will not see the animation.
-
-**WindowsLogon/EnableFirstLogonAnimation**
+Note: The first sign-in animation will not be shown on Server, so this policy will have no effect.
+
-
-The table below shows the applicability of Windows:
+
+
+
-|Edition|Windows 10|Windows 11|
-|--- |--- |--- |
-|Home|Yes|Yes|
-|Pro|Yes|Yes|
-|Windows SE|No|Yes|
-|Business|Yes|Yes|
-|Enterprise|Yes|Yes|
-|Education|Yes|Yes|
+
+**Description framework properties**:
-
-
+| Property name | Property value |
+|:--|:--|
+| Format | int |
+| Access Type | Add, Delete, Get, Replace |
+| Default Value | 1 |
+
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+**Allowed values**:
-> [!div class = "checklist"]
-> * Device
+| Value | Description |
+|:--|:--|
+| 0 | Disabled. |
+| 1 (Default) | Enabled. |
+
-
+
+**Group policy mapping**:
-
-
-This policy setting allows you to control whether users see the first sign-in animation when signing in to the computer for the first time. This view applies to both the first user of the computer who completes the initial setup and users who are added to the computer later. It also controls if Microsoft account users are offered the opt-in prompt for services during their first sign-in.
+| Name | Value |
+|:--|:--|
+| Name | EnableFirstLogonAnimation |
+| Friendly Name | Show first sign-in animation |
+| Location | Computer Configuration |
+| Path | System > Logon |
+| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\System |
+| Registry Value Name | EnableFirstLogonAnimation |
+| ADMX File Name | Logon.admx |
+
-If you enable this policy setting, Microsoft account users see the opt-in prompt for services, and users with other accounts see the sign-in animation.
+
+
+
-If you disable this policy setting, users don't see the animation and Microsoft account users don't see the opt-in prompt for services.
+
-If you don't configure this policy setting, the user who completes the initial Windows setup see the animation during their first sign-in. If the first user had already completed the initial setup and this policy setting isn't configured, users new to this computer don't see the animation.
+
+## EnableMPRNotifications
-> [!NOTE]
-> The first sign-in animation isn't displayed on Server, so this policy has no effect.
+
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later |
+
-
-
-ADMX Info:
-- GP Friendly name: *Show first sign-in animation*
-- GP name: *EnableFirstLogonAnimation*
-- GP path: *System/Logon*
-- GP ADMX file name: *Logon.admx*
+
+```Device
+./Device/Vendor/MSFT/Policy/Config/WindowsLogon/EnableMPRNotifications
+```
+
-
-
-Supported values:
-- 0 - disabled
-- 1 - enabled
-
-
+
+This policy controls the configuration under which winlogon sends MPR notifications in the system.
-
-
+If you enable this setting or do not configure it, winlogon sends MPR notifications if a credential manager is configured.
-
-
+If you disable this setting, winlogon does not send MPR notifications.
+
-
+
+
+
-
-**WindowsLogon/EnableMPRNotifications**
+
+**Description framework properties**:
-
-The table below shows the applicability of Windows:
+| Property name | Property value |
+|:--|:--|
+| Format | chr (string) |
+| Access Type | Add, Delete, Get, Replace |
+
-|Edition|Windows 10|Windows 11|
-|--- |--- |--- |
-|Home|No|No|
-|Pro|Yes|Yes|
-|Windows SE|No|Yes|
-|Business|Yes|Yes|
-|Enterprise|Yes|Yes|
-|Education|Yes|Yes|
+
+**ADMX mapping**:
-
-
+| Name | Value |
+|:--|:--|
+| Name | EnableMPRNotifications |
+| Friendly Name | Enable MPR notifications for the system |
+| Location | Computer Configuration |
+| Path | Windows Components > Windows Logon Options |
+| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\System |
+| Registry Value Name | EnableMPR |
+| ADMX File Name | WinLogon.admx |
+
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+
+
-> [!div class = "checklist"]
-> * Device
+
-
+
+## EnumerateLocalUsersOnDomainJoinedComputers
-
-
-This policy allows winlogon to send MPR notifications in the system if a credential manager is configured.
+
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later |
+
-If you disable (0), MPR notifications will not be sent by winlogon.
+
+```Device
+./Device/Vendor/MSFT/Policy/Config/WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers
+```
+
-If you enable (1) or do not configure this policy setting this policy, MPR notifications will be sent by winlogon.
-
-
-
-Supported values:
-
-- 0 - disabled
-- 1 (default)- enabled
-
-
-
-
-
-
-
-**WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers**
-
-
-The table below shows the applicability of Windows:
-
-|Edition|Windows 10|Windows 11|
-|--- |--- |--- |
-|Home|No|No|
-|Pro|Yes|Yes|
-|Windows SE|No|Yes|
-|Business|Yes|Yes|
-|Enterprise|Yes|Yes|
-|Education|Yes|Yes|
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
+
This policy setting allows local users to be enumerated on domain-joined computers.
If you enable this policy setting, Logon UI will enumerate all local users on domain-joined computers.
-If you disable or don't configure this policy setting, the Logon UI won't enumerate local users on domain-joined computers.
+If you disable or do not configure this policy setting, the Logon UI will not enumerate local users on domain-joined computers.
+
-
+
+
+
-
-ADMX Info:
-- GP Friendly name: *Enumerate local users on domain-joined computers*
-- GP name: *EnumerateLocalUsers*
-- GP path: *System/Logon*
-- GP ADMX file name: *logon.admx*
+
+**Description framework properties**:
-
-
+| Property name | Property value |
+|:--|:--|
+| Format | chr (string) |
+| Access Type | Add, Delete, Get, Replace |
+
-
+
+**ADMX mapping**:
-
-**WindowsLogon/HideFastUserSwitching**
+| Name | Value |
+|:--|:--|
+| Name | EnumerateLocalUsers |
+| Friendly Name | Enumerate local users on domain-joined computers |
+| Location | Computer Configuration |
+| Path | System > Logon |
+| Registry Key Name | Software\Policies\Microsoft\Windows\System |
+| Registry Value Name | EnumerateLocalUsers |
+| ADMX File Name | Logon.admx |
+
-
-The table below shows the applicability of Windows:
+
+
+
-|Edition|Windows 10|Windows 11|
-|--- |--- |--- |
-|Home|No|No|
-|Pro|Yes|Yes|
-|Windows SE|No|Yes|
-|Business|Yes|Yes|
-|Enterprise|Yes|Yes|
-|Education|Yes|Yes|
+
-
-
+
+## HideFastUserSwitching
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1703 [10.0.15063] and later |
+
-> [!div class = "checklist"]
-> * Device
+
+```Device
+./Device/Vendor/MSFT/Policy/Config/WindowsLogon/HideFastUserSwitching
+```
+
-
+
+This policy setting allows you to hide the Switch User interface in the Logon UI, the Start menu and the Task Manager.
-
-
-This policy setting allows you to hide the Switch account button on the sign-in screen, Start, and the Task Manager. If you enable this policy setting, the Switch account button is hidden from the user who is attempting to sign-in or is signed in to the computer that has this policy applied. If you disable or don't configure this policy setting, the Switch account button is accessible to the user in the three locations.
+If you enable this policy setting, the Switch User interface is hidden from the user who is attempting to log on or is logged on to the computer that has this policy applied.
-
-
-ADMX Info:
-- GP Friendly name: *Hide entry points for Fast User Switching*
-- GP name: *HideFastUserSwitching*
-- GP path: *System/Logon*
-- GP ADMX file name: *Logon.admx*
+The locations that Switch User interface appear are in the Logon UI, the Start menu and the Task Manager.
-
-
-The following list shows the supported values:
+If you disable or do not configure this policy setting, the Switch User interface is accessible to the user in the three locations.
+
-- 0 (default) - Disabled (visible).
-- 1 - Enabled (hidden).
+
+
+
-
-
-To validate on Desktop, do the following steps:
+
+**Description framework properties**:
-1. Enable policy.
-2. Verify that the Switch account button in Start is hidden.
+| Property name | Property value |
+|:--|:--|
+| Format | int |
+| Access Type | Add, Delete, Get, Replace |
+| Default Value | 0 |
+
-
-
-
+
+**Allowed values**:
-
+| Value | Description |
+|:--|:--|
+| 0 (Default) | Disabled (visible). |
+| 1 | Enabled (hidden). |
+
-## Related topics
+
+**Group policy mapping**:
-[Policy configuration service provider](policy-configuration-service-provider.md)
\ No newline at end of file
+| Name | Value |
+|:--|:--|
+| Name | HideFastUserSwitching |
+| Friendly Name | Hide entry points for Fast User Switching |
+| Location | Computer Configuration |
+| Path | System > Logon |
+| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\System |
+| Registry Value Name | HideFastUserSwitching |
+| ADMX File Name | Logon.admx |
+
+
+
+
+
+
+
+
+
+## OverrideShellProgram
+
+
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview |
+
+
+
+```Device
+./Device/Vendor/MSFT/Policy/Config/WindowsLogon/OverrideShellProgram
+```
+
+
+
+This policy is used by IT admin to override the registry based shell program.
+
+
+
+
+
+
+
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | int |
+| Access Type | Add, Delete, Get, Replace |
+| Default Value | 0 |
+
+
+
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 0 (Default) | Not Configured |
+| 1 | Apply Lightweight shell |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+## Related articles
+
+[Policy configuration service provider](policy-configuration-service-provider.md)
diff --git a/windows/client-management/mdm/toc.yml b/windows/client-management/mdm/toc.yml
index 9ff945c474..d1d4e1f569 100644
--- a/windows/client-management/mdm/toc.yml
+++ b/windows/client-management/mdm/toc.yml
@@ -366,6 +366,8 @@ items:
href: policy-csp-camera.md
- name: Cellular
href: policy-csp-cellular.md
+ - name: CloudDesktop
+ href: policy-csp-clouddesktop.md
- name: CloudPC
href: policy-csp-cloudpc.md
- name: Connectivity