Merge remote-tracking branch 'refs/remotes/Microsoft/master'

# Conflicts:
#	devices/surface-hub/device-reset-surface-hub.md

browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md

@@ -19,6 +19,10 @@ ms.sitesec: library
 
 Use Internet Explorer to collect data on computers running Windows Internet Explorer 8 through Internet Explorer 11 on Windows 10, Windows 8.1, or Windows 7. This inventory information helps you build a list of websites used by your company so you can make more informed decisions about your IE deployments, including figuring out which sites might be at risk or require overhauls during future upgrades.
 
+>**Upgrade Analytics and Windows upgrades**<br>
+>You can use Upgrade Analytics to help manage your Windows 10 upgrades on devices running Windows 8.1 and Windows 7 (SP1). You can also use Upgrade Analytics to review several site discovery reports. Check out Upgrade Analytics from [here](https://technet.microsoft.com/en-us/itpro/windows/deploy/upgrade-analytics-get-started).
+
+
 ## Before you begin
 Before you start, you need to make sure you have the following:
 

devices/surface-hub/TOC.md

@@ -1,8 +1,8 @@
 # [Microsoft Surface Hub](index.md)
 ## [Microsoft Surface Hub administrator's guide](surface-hub-administrators-guide.md)
 ### [Intro to Microsoft Surface Hub](intro-to-surface-hub.md)
-### [Physically install Microsoft Surface Hub](physically-install-your-surface-hub-device.md)
 ### [Prepare your environment for Microsoft Surface Hub](prepare-your-environment-for-surface-hub.md)
+#### [Physically install Microsoft Surface Hub](physically-install-your-surface-hub-device.md)
 #### [Create and test a device account](create-and-test-a-device-account-surface-hub.md)
 ##### [Online deployment](online-deployment-surface-hub-device-accounts.md)
 ##### [On-premises deployment](on-premises-deployment-surface-hub-device-accounts.md)
@@ -17,20 +17,22 @@
 #### [Setup worksheet](setup-worksheet-surface-hub.md)
 #### [First-run program](first-run-program-surface-hub.md)
 ### [Manage Microsoft Surface Hub](manage-surface-hub.md)
-#### [Accessibility](accessibility-surface-hub.md)
-#### [Change the Surface Hub device account](change-surface-hub-device-account.md)
-#### [Device reset](device-reset-surface-hub.md)
-#### [End a Surface Hub meeting with I'm Done](i-am-done-finishing-your-surface-hub-meeting.md)
+#### [Local management for Surface Hub settings](local-management-surface-hub-settings.md)
+#### [Remote Surface Hub management]()
+##### [Manage settings with an MDM provider](manage-settings-with-mdm-for-surface-hub.md)
+##### [Monitor your Surface Hub](monitor-surface-hub.md)
+##### [Windows updates](manage-windows-updates-for-surface-hub.md)
+#### [Manage Surface Hub settings]()
+##### [Accessibility](accessibility-surface-hub.md)
+##### [Change the Surface Hub device account](change-surface-hub-device-account.md)
+##### [Device reset](device-reset-surface-hub.md)
+##### [Use fully qualified domain name with Surface Hub](use-fully-qualified-domain-name-surface-hub.md)
+##### [Wireless network management](wireless-network-management-for-surface-hub.md)
 #### [Install apps on your Surface Hub](install-apps-on-surface-hub.md)
-#### [Manage settings with a local admin account](manage-settings-with-local-admin-account-surface-hub.md)
-#### [Manage settings with an MDM provider](manage-settings-with-mdm-for-surface-hub.md)
-#### [Monitor your Surface Hub](monitor-surface-hub.md)
+#### [End a Surface Hub meeting with I'm Done](i-am-done-finishing-your-surface-hub-meeting.md)
 #### [Save your BitLocker key](save-bitlocker-key-surface-hub.md)
 #### [Connect other devices and display with Surface Hub](connect-and-display-with-surface-hub.md)
-#### [Use fully qualified domain name with Surface Hub](use-fully-qualified-domain-name-surface-hub.md)
 #### [Using a room control system](use-room-control-system-with-surface-hub.md)
-#### [Windows updates](manage-windows-updates-for-surface-hub.md)
-#### [Wireless network management](wireless-network-management-for-surface-hub.md)
 ### [Troubleshoot Microsoft Surface Hub](troubleshoot-surface-hub.md)
 ### [Appendix: PowerShell](appendix-a-powershell-scripts-for-surface-hub.md)
-
+### [Change history for Surface Hub](change-history-surface-hub.md)

devices/surface-hub/admin-group-management-for-surface-hub.md

@@ -32,7 +32,6 @@ To create a local admin, [choose to use a local admin during first run](first-ru
 
 Note that the local admin account information is not backed by any directory service. We recommend you only choose a local admin if the device does not have access to Active Directory (AD) or Azure Active Directory (Azure AD). If you decide to change the local admin’s password, you can do so in Settings. However, if you want to change from using the local admin account to using a group from your domain or Azure AD tenant, then you’ll need to [reset the device](device-reset-surface-hub.md) and go through the first-time program again.
 
-
 ### Domain join the device to Active Directory (AD)
 
 You can domain join the Surface Hub to your AD domain to allow users from a specified security group to configure settings. During first run, choose to use [Active Directory Domain Services](first-run-program-surface-hub.md#a-href-iduse-active-directoryause-active-directory-domain-services). You'll need to provide credentials that are capable of joining the domain of your choice, and the name of an existing security group. Anyone who is a member of that security group can enter their credentials and unlock Settings.
@@ -67,16 +66,10 @@ Surface Hubs use Azure AD join to:
 > [!IMPORTANT]
 > Surface Hub does not currently support automatic enrollment to Microsoft Intune through Azure AD join. If your organization automatically enrolls Azure AD joined devices into Intune, you must disable this policy for Surface Hub before joining the device to Azure AD.
 
-
 ### Which should I choose?
 
 If your organization is using AD or Azure AD, we recommend you either domain join or Azure AD join, primarily for security reasons. People will be able to authenticate and unlock Settings with their own credentials, and can be moved in or out of the security groups associated with your domain.
 
-
-### Summary
-
-
-
 | Option                                            | Requirements                            | Which credentials can be used to access the Settings app?  |
 |---------------------------------------------------|-----------------------------------------|-------|
 | Create a local admin account                      | None                                    | The user name and password specified during first run |
@@ -84,3 +77,4 @@ If your organization is using AD or Azure AD, we recommend you either domain joi
 | Azure Active Directory (Azure AD) join the device | Your organization uses Azure AD Basic   | Global administators only |
 |                                              | Your organization uses Azure AD Premium or Enterprise Mobility Suite (EMS) | Global administrators and additional administrators |
 
+

devices/surface-hub/change-history-surface-hub.md

@@ -0,0 +1,34 @@
+---
+title: Change history for Surface Hub
+description: This topic lists new and updated topics for Surface Hub.
+keywords: change history
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.sitesec: library
+ms.pagetype: surfacehub
+author: TrudyHa
+localizationpriority: medium
+---
+
+# Change history for Surface Hub
+
+This topic lists new and updated topics in the [Surface Hub Admin Guide]( surface-hub-administrators-guide.md).
+
+## RELEASE: Windows Anniversary Update for Surface Hub (Windows 10, version 1607)
+The topics in this library have been updated for Windows 10, version 1607 (also known as Windows Anniversary Update for Surface Hub). These topics had significant updates for this release:
+- [Windows Updates (Surface Hub)](manage-windows-updates-for-surface-hub.md)
+- [Manage settings with an MDM provider (Surface Hub)](manage-settings-with-mdm-for-surface-hub.md)
+- [Monitor your Microsoft Surface Hub](monitor-surface-hub.md)
+- [Create provisioning packages (Surface Hub)](provisioning-packages-for-certificates-surface-hub.md)
+- [Install apps on your Microsoft Surface Hub](install-apps-on-surface-hub.md)
+- [Device reset (Surface Hub)](device-reset-surface-hub.md)
+
+## October 2016
+| New or changed topic | Description |
+| --- | --- |
+| [Admin group management (Surface Hub)](admin-group-management-for-surface-hub.md) |Add note about automatic enrollment, and update table. |
+| [Password management (Surface Hub)](password-management-for-surface-hub-device-accounts.md) | Updates to content. |
+| [Create and test a device account (Surface Hub)](create-and-test-a-device-account-surface-hub.md) | Reorganize and streamline guidance on creating a device account.  |
+| [Introduction to Surface Hub](intro-to-surface-hub.md) | Move Surface Hub dependencies table to [Prepare your environment for Surface Hub](prepare-your-environment-for-surface-hub.md). |
+| [Prepare your environment for Surface Hub](prepare-your-environment-for-surface-hub.md) | Add dependency table and reorganize topic. | 
+| [Local management for Surface Hub settings](local-management-surface-hub-settings.md) | New topic. |

devices/surface-hub/local-management-surface-hub-settings.md

@@ -0,0 +1,57 @@
+---
+title: Local management Surface Hub settings
+description: How to manage Surface Hub settings with Settings.
+keywords: manage Surface Hub, Surface Hub settings
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.sitesec: library
+ms.pagetype: surfacehub
+author: TrudyHa
+localizationpriority: medium
+---
+
+# Local management for Surface Hub settings
+
+After initial setup of Microsoft Surface Hub, the device’s settings and configuration can be modified or changed in a couple ways:
+
+- **Local management** - Every Surface Hub can be configured locally using the **Settings** app on the device. To prevent unauthorized users from changing settings, the Settings app requires admin credentials to open the app.
+- **Remote management** - Surface Hub allow IT admins to manage settings and policies using a mobile device management (MDM) provider, such as Microsoft Intune, System Center Configuration Manager, and other third-party providers. Additionally, admins can monitor Surface Hubs using Microsoft Operations Management Suite (OMS). For more information, see [Manage settings with an MDM provider](manage-settings-with-mdm-for-surface-hub.md), and [Monitor your Microsoft Surface Hub](monitor-surface-hub.md). 
+
+> [!NOTE]
+> These management methods are not mutually exclusive. Devices can be both locally and remotely managed if you choose. However, MDM policies and settings will overwrite any local changes when the Surface Hub syncs with the management server.
+
+## Surface Hub settings
+
+Surface Hubs have many settings that are common to other Windows devices, but also have settings which are only configurable on Surface Hubs. This table lists settings only cofigurable on Surface Hubs. 
+
+| Setting | Location | Description |
+| ------- | -------- | ----------- |
+| Device account | This device > Accounts | Set or change the Surface Hub's device account. |
+| Device account sync status | This device > Accounts | Check the sync status of the device account’s mail and calendar on the Surface Hub. |
+| Password rotation | This device > Accounts | Choose whether to let the Surface Hub automatically rotate the device account's password. |
+| Change admin account password  | This device > Accounts | Change the password for the local admin account. This is only available if you configured the device to use a local admin during first run. |
+| Configure Operations Management Suite (OMS) | This device > Device management | Set up monitoring for your Surface Hub using OMS. |
+| Open the Windows Store app | This device > Apps & features | The Windows Store app is only available to admins through the Settings app. |
+| Skype for Business domain name | This device > Calling | Configure a domain name for your Skype for Business server. |
+| Default microphone and speaker settings | This device > Calling | Configure a default microphone and speaker for calls, and a default speaker for media playback. |
+| Turn off wireless projection using Miracast | This device > Wireless projection | Choose whether presenters can wirelessly project to the Surface Hub using Miracast. |
+| Require a PIN for wireless projection | This device > Wireless projection | Choose whether people are required to enter a PIN before they use wireless projection. |
+| Wireless projection (Miracast) channel | This device > Wireless projection | Set the channel for Miracast projection. |
+| Meeting info shown on the welcome screen | This device > Welcome screen | Choose whether meeting organizer, time, and subject show up on the welcome screen. |
+| Welcome screen background |  This device > Welcome screen | Choose a background image for the welcome screen. |
+| Turn on screen with motion sensors | This device > Session & clean up | Choose whether the screen turns on when motion is detected. |
+| Session time out | This device > Session & clean up | Choose how long the device needs to be inactive before returning to the welcome screen. |
+| Sleep time out | This device > Session & clean up | Choose how long the device needs to be inactive before going to sleep mode. |
+| Friendly name | This device > About | Set the Surface Hub name that people will see when connecting wirelessly. |
+| Maintenance hours | Update & security > Windows Update > Advanced options | Configure when updates can be installed. |
+| Configure Windows Server Update Services (WSUS) server | Update & security > Windows Update > Advanced options | Change whether Surface Hub receives updates from a WSUS server instead of Windows Update. |
+| Save BitLocker key | Update & security > Recovery | Backup your Surface Hub's BitLocker key to a USB drive. |
+| Collect logs | Update & security > Recovery | Save logs to a USB drive to send to Microsoft later. | 
+
+## Related topics
+
+[Manage Surface Hub settings](manage-surface-hub-settings.md)
+
+[Remote Surface Hub management](remote-surface-hub-management.md)
+
+[Microsoft Surface Hub administrator's guide](surface-hub-administrators-guide.md)

devices/surface-hub/manage-settings-with-local-admin-account-surface-hub.md

@@ -2,6 +2,7 @@
 title: Manage settings with a local admin account (Surface Hub)
 description: A local admin account will be set up on every Microsoft Surface Hub as part of the first run program. The only way to change the local admin options that you chose at that time is to reset the device.
 ms.assetid: B4B3668B-985D-427E-8495-E30ABEECA679
+redirect_url: https://technet.microsoft.com/itpro/surface-hub/admin-group-management-for-surface-hub
 keywords: local admin account, Surface Hub, change local admin options
 ms.prod: w10
 ms.mktglfcycl: manage
@@ -10,113 +11,3 @@ ms.pagetype: surfacehub
 author: TrudyHa
 localizationpriority: medium
 ---
-
-# Manage settings with a local admin account (Surface Hub)
-
-
-A local admin account will be set up on every Microsoft Surface Hub as part of the first run program. The only way to change the local admin options that you chose at that time is to reset the device.
-
-Every device can be configured individually by opening the Settings app on the device you want to configure. However, to prevent people who are not administrators from changing the devices’ settings, the Settings app requires local administrator credentials to open the app and change settings.
-
-You can set up a local administrator in one of three ways (see [Setting up admins for this device](first-run-program-surface-hub.md#setup-admins)):
-
-1.  Create a local admin
-2.  Domain join the device (AD)
-3.  Azure Active Directory (Azure AD) join the device.
-
-### Which method should I choose?
-
-If your organization is using Active Directory or Azure AD, we recommend you either domain join or join Azure AD, primarily for security reasons. People will be able to authenticate and unlock Settings with their own credentials, and can be moved in or out of the security groups associated with your domain or organization.
-
-Preferably, a local admin is set up only if you do not have Active Directory or Azure AD, or if you cannot connect to your Active Directory or Azure AD during first run.
-
-### Summary table
-
-<table>
-<tr>
-<th>How is the local admin set up?</th>
-<th>Requirements</th>
-<th>Which credentials will open Settings?</th>
-</tr>
-<tr>
-<td>A local admin was created<p></p>
-</td>
-<td>
-<p>None</p>
-</td>
-<td>
-<p>The credentials of the local admin account.</p>
-</td>
-</tr>
-<tr>
-<td>
-<p>The device is joined to a domain (AD)</p>
-</td>
-<td>
-<p>Your organization is using Active Directory</p>
-</td>
-<td>
-<p>Credentials of any Active Directory account from the security group that was specified furing first run.</p>
-</td>
-</tr>
-<tr>
-<td rowspan="2">
-<p>The device is joined to Azure AD</p>
-</td>
-<td>
-<p>Your organization is using Azure AD Basic</p>
-</td>
-<td>
-<p>Tenant or device admins</p>
-</td>
-</tr>
-<tr>
-<td>
-<p>Your organization is using Azure AD Premium</p>
-</td>
-<td>
-<p>Tenant or device admins, plus additional specified employees</p>
-</td>
-</tr>
-</table>
-
-### Create a local admin
-
-To create a local admin, choose to use a local admin during first run. This will create a single local admin account on the Surface Hub with the username and password of your choice. These same credentials will unlock the Settings app (see [Setting up admins for this device](first-run-program-surface-hub.md#setup-admins)). Note that the local admin account information is not backed by any directory service. We recommend you only choose a local admin if the device does not have access to Active Directory or Azure Active Directory. If you decide to change the local admin’s password, you can do so in Settings. However, if you want to change from a local admin you created to a group from your domain or Azure AD organization, then you’ll need to reset the device and go through first-time setup again.
-
-### Domain join the device
-
-After you domain join the device, you can set up a security group from your domain as local administrators on the Surface Hub. You will need to provide credentials that are capable of joining the domain of your choice. After you domain join successfully, you will be asked to pick an existing security group to be set as the local admins. When the Setting app is opened, any user who is a member of that security group can enter their credentials and unlock Settings.
-
->**Note**  Surface Hubs domain join for the sole purpose of using a security group as local admins. Group policies are not applied after the device is domain joined.
-
- 
-
-### Azure AD join the device
-
-You can set up people from your Azure Active Directory (Azure AD) organization as local administrators on the Surface Hub after you Azure AD join the device. The people that are provisioned as local admins on your device depend on what Azure AD subscription you have. You will need to provide credentials that are capable of joining the Azure AD organization of your choice. After you join Azure AD successfully, the appropriate people will be set as local admins on the device. When the Setting app is opened, any user who was set up as a local admin as a result of joining Azure AD can enter their credentials and unlock Settings. We recommend that you use the device account to join Azure AD.
-
-Otherwise, if you don’t want to use the device account to join Azure AD, you can use either of the following accounts:
-
--   The org account of an admin who will manage the device, or
--   A separate account that is part of your organization and used only for joining Surface Hubs.
-
->**Note**  If your Azure AD organization is also configured with MDM enrollment, Surface Hubs will also be enrolled into MDM as a result of joining Azure AD. Surface Hubs that have joined Azure AD are subject to receiving MDM policies, and can be widely managed using an MDM solution, which opts these devices into remote management. You may want to choose an account to join Azure AD that benefits how you manage devices—you find more info about this in the [Enroll a Surface Hub into MDM](manage-settings-with-mdm-for-surface-hub.md#enroll-into-mdm) section.
-
- 
-
-## Related topics
-
-
-[Manage Microsoft Surface Hub](manage-surface-hub.md)
-
-[Microsoft Surface Hub administrator's guide](surface-hub-administrators-guide.md)
-
- 
-
- 
-
-
-
-
-

devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md

@@ -27,12 +27,12 @@ You can enroll your Surface Hubs using automatic, bulk, or manual enrollment.
 
 > [!NOTE]
 > You can join your Surface Hub to Azure Active Directory (Azure AD) to manage admin groups on the device. However, Surface Hub does not currently support automatic enrollment to Microsoft Intune through Azure AD join. If your organization automatically enrolls Azure AD joined devices into Intune, you must disable this policy for Surface Hub before joining the device to Azure AD.
-> **To disable automatic enrollment for Microsoft Intune**
-> 1. In the [Azure classic portal](https://manage.windowsazure.com/), navigate to the **Active Directory** node and select your directory.
-> 2. Click the **Applications** tab, then click **Microsoft Intune**.
-> 3. Under **Manage devices for these users**, click **Groups**.
-> 4. Click **Select Groups**, then select the groups of users you want to automatically enroll into Intune. Do not include accounts that are used to enroll Surface Hubs into Intune.
-> 5. Click the checkmark button, then click **Save**.
+
+**To disable automatic enrollment for Microsoft Intune**
+1. In the [Azure classic portal](https://manage.windowsazure.com/), navigate to the **Active Directory** node and select your directory. 
+2. Click the **Applications** tab, then click **Microsoft Intune**.
+3. Under **Manage devices for these users**, click **Groups**. 
+4. Click **Select Groups**, then select the groups of users you want to automatically enroll into Intune. Do not include accounts that are used to enroll Surface Hubs into Intune. 5. Click the checkmark button, then click **Save**.
 
 ### Bulk enrollment
 **To configure bulk enrollment**
@@ -52,7 +52,7 @@ You can manually enroll with an MDM using the **Settings** app on your Surface H
 
 ## Manage Surface Hub settings with MDM
 
-You can use MDM to manage some [Surface Hub CSP settings](#supported-surface-hub-csp-settings), and some [Windows 10 settings](#supported-windows-10-settings). Depending on the MDM provider that you use, you may set these settings using a built-in user interface, or by deploying custom SyncML. Microsoft Intune and System Center Configuration Manager provide built-in experiences to help create policy templates for Surface Hub. Refer to documentation from your MDM provider to learn how to create and deploy SyncML.
+You can use MDM to manage some [Surface Hub CSP settings](#supported-surface-hub-csp-settings). Depending on the MDM provider that you use, you may set these settings using a built-in user interface, or by deploying custom SyncML. Microsoft Intune and System Center Configuration Manager provide built-in experiences to help create policy templates for Surface Hub. Refer to documentation from your MDM provider to learn how to create and deploy SyncML.
 
 ### Supported Surface Hub CSP settings
 
@@ -73,92 +73,6 @@ For more information, see [SurfaceHub configuration service provider](https://ms
 | Friendly name for wireless projection | Properties/FriendlyName | Yes. <br> Use a custom policy. | Yes.<br> Use a custom setting. | Yes |
 | Device account, including password rotation | DeviceAccount/\<name of policy\> <br> See [SurfaceHub CSP](https://msdn.microsoft.com/library/windows/hardware/mt608323.aspx). | No | No | Yes |
 
-
-### Supported Windows 10 settings 
-
-In addition to Surface Hub specific settings, there are numerous settings common to all Windows 10 devices. These settings are defined in the [Configuration service provider reference](https://msdn.microsoft.com/en-us/library/windows/hardware/dn920025.aspx). 
-
-The following tables include info on Windows 10 settings that have been validated with Surface Hub. There is a table with settings for these areas: security, browser, Windows Updates, Windows Defender, remote reboot, certificates, and logs. Each table also tells if the setting is supported with Microsoft Intune, System Center Configuration Manager, or SyncML.
-
-#### Security settings 
-
-| Setting  | Details  | CSP reference | Supported with<br>Intune? | Supported with<br>Configuration Manager? | Supported with<br>SyncML? |
-| -------- | -------- | ------------- |-------------------------- | ---------------------------------------- | ------------------------- |
-| Allow Bluetooth | Keep this enabled to support Bluetooth peripherals. | [Connectivity/AllowBluetooth](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx#Connectivity_AllowBluetooth) | Yes. <br> Use a custom policy. | Yes.<br> Use a custom setting. | Yes |
-| Bluetooth policies | Use to set the Bluetooth device name, and block advertising, discovery, and automatic pairing. | Bluetooth/\<name of policy\> <br> See [Policy CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx) | Yes. <br> Use a custom policy. | Yes.<br> Use a custom setting. | Yes |
-| Allow camera | Keep this enabled for Skype for Business. | [Camera/AllowCamera](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx#Camera_AllowCamera) | Yes. <br> Use a custom policy. | Yes.<br> Use a custom setting. | Yes |
-| Allow location | Keep this enabled to support apps such as Maps. | [System/AllowLocation](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx#System_AllowLocation) | Yes. <br> Use a custom policy. | Yes.<br> Use a custom setting. | Yes |
-| Allow telemetry | Keep this enabled to help Microsoft improve Surface Hub. | [System/AllowTelemetry](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx#System_AllowTelemetry) | Yes. <br> Use a custom policy. | Yes.<br> Use a custom setting. | Yes |
-
-#### Browser settings
-
-| Setting  | Details          | CSP reference | Supported with<br>Intune? | Supported with<br>Configuration Manager? | Supported with<br>SyncML? |
-| -------- | ---------------- | ------------- |-------------------------- | ---------------------------------------- | ------------------------- |
-| Homepages | Use to configure the default homepages in Microsoft Edge. | [Browser/Homepages](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx#Browser_Homepages)  | Yes. <br> Use a custom policy. | Yes. <br> Use a custom setting. | Yes |
-| Allow cookies | Surface Hub automatically deletes cookies at the end of a session. Use this to block cookies within a session. | [Browser/AllowCookies](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx#Browser_AllowCookies) | Yes. <br> Use a custom policy. | Yes. <br> Use a custom setting. | Yes |
-| Allow developer tools  | Use to stop users from using F12 Developer Tools. | [Browser/AllowDeveloperTools](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx#Browser_AllowDeveloperTools) | Yes. <br>  Use a custom policy. | Yes. <br> Use a custom setting. | Yes |
-| Allow Do Not Track | Use to enable Do Not Track headers. | [Browser/AllowDoNotTrack](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx#Browser_AllowDoNotTrack) | Yes. <br> Use a custom policy. | Yes. <br> Use a custom setting. | Yes |
-| Allow pop-ups | Use to block pop-up browser windows. | [Browser/AllowPopups](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx#Browser_AllowPopups) | Yes. <br> Use a custom policy. | Yes. <br> Use a custom setting. | Yes |
-| Allow search suggestions | Use to block search suggestions in the address bar| [Browser/AllowSearchSuggestionsinAddressBar](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx#Browser_AllowSearchSuggestionsinAddressBar) | Yes. <br> Use a custom policy. | Yes. <br> Use a custom setting. | Yes |
-| Allow SmartScreen | Keep this enabled to turn on SmartScreen | [Browser/AllowSmartScreen](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx#Browser_AllowSmartScreen) | Yes. <br> Use a custom policy. | Yes. <br> Use a custom setting. | Yes |
-| Prevent ignoring SmartScreen Filter warnings for websites | For extra security, use to stop users from ignoring SmartScreen Filter warnings and block them from accessing potentially malicious websites. | [Browser/PreventSmartScreenPromptOverride](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx#Browser_PreventSmartScreenPromptOverride) | Yes. <br> Use a custom policy. | Yes. <br> Use a custom setting. | Yes |
-| Prevent ignoring SmartScreen Filter warnings for files | For extra security, use to stop users from ignoring SmartScreen Filter warnings and block them from downloading unverified files from Microsoft Edge. | [Browser/PreventSmartScreenPromptOverrideForFiles](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx#Browser_PreventSmartScreenPromptOverrideForFiles) | Yes. <br> Use a custom policy. | Yes. <br> Use a custom setting. | Yes |
-
-#### Windows Update settings
-
-| Setting     | Details          | CSP reference | Supported with<br>Intune? | Supported with<br>Configuration Manager? | Supported with<br>SyncML? |
-| ----------- | ---------------- | ------------- |-------------------------- | ---------------------------------------- | ------------------------- |
-| Use Current Branch or Current Branch for Business | Use to configure Windows Update for Business – see [Windows updates](manage-windows-updates-for-surface-hub.md). | [Update/BranchReadinessLevel](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx#Update_BranchReadinessLevel) | Yes. Use a custom policy. | Yes. Use a custom setting. | Yes |
-| Defer feature updates| See above. | [Update/ DeferFeatureUpdatesPeriodInDays](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx#Update_DeferFeatureUpdatesPeriodInDays) | Yes. <br> Use a custom policy. | Yes. <br> Use a custom setting. | Yes |
-| Defer quality updates | See above. | [Update/DeferQualityUpdatesPeriodInDays](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx#Update_DeferQualityUpdatesPeriodInDays) | Yes. <br> Use a custom policy. | Yes. <br> Use a custom setting. | Yes |
-| Pause feature updates | See above. | [Update/PauseFeatureUpdates](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx#Update_PauseFeatureUpdates) | Yes. <br> Use a custom policy. | Yes. <br> Use a custom setting. | Yes |
-| Pause quality updates | See above. | [Update/PauseQualityUpdates](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx#Update_PauseQualityUpdates) | Yes. <br> Use a custom policy. | Yes. <br> Use a custom setting. | Yes|
-| Configure device to use WSUS| Use to connect your Surface Hub to WSUS instead of Windows Update – see [Windows updates](manage-windows-updates-for-surface-hub.md). | [Update/UpdateServiceUrl](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx#Update_UpdateServiceUrl) | Yes. <br> Use a custom policy. | Yes. <br> Use a custom setting. | Yes |
-| Delivery optimization | Use peer-to-peer content sharing to reduce bandwidth issues during updates. See [Configure Delivery Optimization for Windows 10](https://technet.microsoft.com/itpro/windows/manage/waas-delivery-optimization) for details. | DeliveryOptimization/\<name of policy\> <br> See [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) | Yes. <br> Use a custom policy. | Yes. <br> Use a custom setting. | Yes |
-
-#### Windows Defender settings
-
-| Setting     | Details          | CSP reference | Supported with<br>Intune? | Supported with<br>Configuration Manager? | Supported with<br>SyncML? |
-| ----------- | ---------------- | ------------- |-------------------------- | ---------------------------------------- | ------------------------- |
-| Defender policies. |Use to configure various Defender settings, including a scheduled scan time. | Defender/\<name of policy\> <br> See [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) | Yes. <br>  Use a custom policy. | Yes. <br> Use a custom setting. | Yes
-| Defender status | Use to initiate a Defender scan, force a signature update, query any threats detected. | [Defender CSP](https://msdn.microsoft.com/library/windows/hardware/mt187856.aspx) | No. | No. | Yes |
-
-#### Remote reboot settings
-
-| Setting     | Details          | CSP reference | Supported with<br>Intune? | Supported with<br>Configuration Manager? | Supported with<br>SyncML? |
-| ----------- | ---------------- | ------------- |-------------------------- | ---------------------------------------- | ------------------------- |
-| Reboot the device immediately| Use in conjunction with OMS to minimize support costs – see [Monitor your Microsoft Surface Hub](monitor-surface-hub.md). | ./Vendor/MSFT/Reboot/RebootNow <br> See [Reboot CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/mt720802(v=vs.85).aspx) | No | No | Yes |
-| Reboot the device at a scheduled date and time| See above. | ./Vendor/MSFT/Reboot/Schedule/Single <br> See [Reboot CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/mt720802(v=vs.85).aspx) | Yes. <br> Use a custom policy. | Yes. <br> Use a custom setting. | Yes |
-| Reboot the device daily at a scheduled date and time| See above. | ./Vendor/MSFT/Reboot/Schedule/DailyRecurrent <br> See [Reboot CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/mt720802(v=vs.85).aspx) | Yes. <br> Use a custom policy. | Yes. <br> Use a custom setting. | Yes |
-
-#### Certficate settings
-
-| Setting     | Details          | CSP reference | Supported with<br>Intune? | Supported with<br>Configuration Manager? | Supported with<br>SyncML? |
-| ----------- | ---------------- | ------------- |-------------------------- | ---------------------------------------- | ------------------------- |
-| Install certificates | Use to deploy certificates to the Surface Hub. | [RootCATrustedCertificates CSP](https://msdn.microsoft.com/library/windows/hardware/dn904970.aspx) <br> [ClientCertificateInstall CSP](https://msdn.microsoft.com/library/windows/hardware/dn920023.aspx) | Yes. <br> See [Secure resource access with certificate profiles](https://docs.microsoft.com/intune/deploy-use/secure-resource-access-with-certificate-profiles). | Yes. <br> See [How to create certificate profiles in Configuration Manager](https://technet.microsoft.com/library/dn270541.aspx). | Yes |
-
-#### Log settings
-
-| Setting     | Details          | CSP reference | Supported with<br>Intune? | Supported with<br>Configuration Manager? | Supported with<br>SyncML? |
-| ----------- | ---------------- | ------------- |-------------------------- | ---------------------------------------- | ------------------------- |
-| Log collection | Use to remotely collect ETW logs from Surface Hub. | [DiagnosticLog CSP](https://msdn.microsoft.com/library/windows/hardware/mt219118.aspx) | No | No | Yes |
-
-### Generate OMA URIs for settings 
-You need to use a setting’s OMA URI to create a custom policy in Intune, or a custom setting in System Center Configuration Manager.
-
-**To generate the OMA URI for any setting in the CSP documentation**
-1. In the CSP documentation, identify the root node of the CSP. Generally, this looks like `./Vendor/MSFT/<name of CSP>`. <br>
-For example, the root node of the [SurfaceHub CSP](https://msdn.microsoft.com/library/windows/hardware/mt608323.aspx) is `./Vendor/MSFT/SurfaceHub`.
-2. Identify the node path for the setting you want to use. <br>
-For example, the node path for the setting to enable wireless projection is `InBoxApps/WirelessProjection/Enabled`.
-3. Append the node path to the root node to generate the OMA URI. <br>
-For example, the OMA URI for the setting to enable wireless projection is `./Vendor/MSFT/SurfaceHub/InBoxApps/WirelessProjection/Enabled`.
-
-The data type is also stated in the CSP documentation. The most common data types are:
-- char (String)
-- int (Integer)
-- bool (Boolean)
-
 ## Example: Manage Surface Hub settings with Micosoft Intune
 
 You can use Microsoft Intune to manage Surface Hub settings. 
@@ -216,8 +130,7 @@ System Center Configuration Manager supports managing modern devices that do not
 18. Once you're done, on the **Browse Settings** dialog, click **Close**.
 19. Complete the wizard. <br> You can view the new configuration item in the **Configuration Items** node of the **Assets and Compliance** workspace.
 
-For more information, see [Create configuration items for Windows 8.1 and Windows 10 devices managed without the System Center Configuration Manager client](https://docs.microsoft.com/en-us/sccm/compliance/deploy-use/create-configuration-items-for-windows-8.1-and-windows-10-devices-managed-without-the-client).
-
+For more information, see [Create configuration items for Windows 8.1 and Windows 10 devices managed without the System Center Configuration Manager client](https://docs.microsoft.com/sccm/compliance/deploy-use/create-configuration-items-for-windows-8.1-and-windows-10-devices-managed-without-the-client).
 
 ## Related topics
 

devices/surface-hub/manage-surface-hub-settings.md

@@ -0,0 +1,23 @@
+---
+title: Manage Surface Hub settings
+description: This section lists topics for managing Surface Hub settings.
+keywords: Surface Hub accessibility settings, device account, device reset, windows updates, wireless network management
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.sitesec: library
+ms.pagetype: surfacehub
+author: TrudyHa
+localizationpriority: medium
+---
+
+# Manage Surface Hub settings
+
+## In this section
+
+|Topic | Description|
+| ------ | --------------- |
+| [Accessibility](https://technet.microsoft.com/itpro/surface-hub/accessibility-surface-hub) | Accessibility settings for the Surface Hub can be changed by using the Settings app. You'll find them under Ease of Access. Your Surface Hub has the same accessibility options as Windows 10.|
+| [Change the Surface Hub device account](https://technet.microsoft.com/itpro/surface-hub/change-surface-hub-device-account) | You can change the device account in Settings to either add an account if one was not already provisioned, or to change any properties of an account that was already provisioned.|
+| [Device reset]( https://technet.microsoft.com/en-us/itpro/surface-hub/device-reset-suface-hub) | You may need to reset your Surface Hub.|
+| [Windows updates](https://technet.microsoft.com/itpro/surface-hub/manage-windows-updates-for-surface-hub) | You can manage Windows updates on your Surface Hub by setting the maintenance window, deferring updates, or using WSUS.|
+| [Wireless network management](https://technet.microsoft.com/itpro/surface-hub/wireless-network-management-for-surface-hub) | Surface Hub offers two options for network connectivity to your corporate network and Internet: wireless, and wired. While both provide network access, we recommend you use a wired connection. |

devices/surface-hub/manage-surface-hub.md

@@ -13,212 +13,17 @@ localizationpriority: medium
 
 # Manage Microsoft Surface Hub
 
-
-How to manage your Surface Hub after finishing the first-run program.
-
-## Introduction
-
-
-After initial setup of Microsoft Surface Hub, the device’s settings and configuration can be modified or changed in several ways:
-
--   Local management: using the Settings app on the device
--   Remote management: using a mobile device management (MDM) solution, like Microsoft Intune, AirWatch, or System Center 2012 R2 Configuration Manager.
-
-For locally-managed devices, administrator credentials are required to use the Settings app. These can be login credentials for Active Directory, Azure Active Directory (Azure AD), or a local admin account. One of these will have been selected during first run (see [Set up admins for this device](first-run-program-surface-hub.md#setup-admins)).
-
-For remotely-managed devices, the device must be enrolled into an MDM solution, either during first run or in the Settings app.
-
-Be aware that the two management methods are not mutually exclusive—every device will have the capability to be locally managed, and devices can be remotely managed if you choose.
-
->**Note**  If a device is remotely managed, then any changes to local settings that are also remotely managed will only persist until the next time your Surface Hub syncs with your MDM solution. Once a sync occurs, the settings and policies defined on your MDM solution will be pushed to the device, overwriting the local changes.
-
- 
-
-## Surface Hub-only settings
-
-
-Surface Hubs have many settings that are common to other Windows devices, but also have settings which are only configurable on Surface Hubs.
-
-<table>
-<colgroup>
-<col width="33%" />
-<col width="33%" />
-<col width="33%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Setting</th>
-<th align="left">Location</th>
-<th align="left">Description</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Change friendly name</p></td>
-<td align="left"><p>System - About</p></td>
-<td align="left"><p>Set the Surface Hub name that people will see when connecting wirelessly.</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Collect logs</p></td>
-<td align="left"><p>System - About</p></td>
-<td align="left"><p>Collect logs to give to Microsoft Support.</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Change meeting info shown on the welcome screen</p></td>
-<td align="left"><p>System – Microsoft Surface Hub</p></td>
-<td align="left"><p>Choose whether meeting organizer, time, and subject show up on the welcome screen.</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Session time out</p></td>
-<td align="left"><p>System – Microsoft Surface Hub</p></td>
-<td align="left"><p>Choose how long the device needs to be inactive before returning to the welcome screen.</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Turn on screen with motion sensors</p></td>
-<td align="left"><p>System – Microsoft Surface Hub</p></td>
-<td align="left"><p>Choose whether the screen turns on when motion is detected.</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Configure Microsoft Operational Management Suite (MOMS)</p></td>
-<td align="left"><p>System – Microsoft Surface Hub</p></td>
-<td align="left"><p>Add information to set up monitoring using MOMS.</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Change Skype for Business fully qualified domain name (FQDN)</p></td>
-<td align="left"><p>System – Microsoft Surface Hub</p></td>
-<td align="left"><p>Add the FQDN for a Skype for Business certificate.</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Save BitLocker key</p></td>
-<td align="left"><p>System – Microsoft Surface Hub</p></td>
-<td align="left"><p>Set the default destination for saving the BitLocker recovery key to a USB drive.</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Turn off wireless projection using Miracast</p></td>
-<td align="left"><p>Devices - Connect</p></td>
-<td align="left"><p>Choose whether presenters can wirelessly project to the Surface Hub using Miracast.</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Require a PIN for wireless projection</p></td>
-<td align="left"><p>Devices - Connect</p></td>
-<td align="left"><p>Choose whether people are required to enter a PIN before they use wireless projection.</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Wireless projection (Miracast) channel</p></td>
-<td align="left"><p>Devices - Connect</p></td>
-<td align="left"><p>Change the channel for Miracast projection.</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Change device account</p></td>
-<td align="left"><p>Accounts - All accounts</p></td>
-<td align="left"><p>Change the Surface Hub's device account.</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Check sync status</p></td>
-<td align="left"><p>Accounts - All accounts</p></td>
-<td align="left"><p>Check the sync status of the device account’s mail and calendar on the Surface Hub.</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Turn on password rotation</p></td>
-<td align="left"><p>Accounts - All accounts</p></td>
-<td align="left"><p>Choose whether the device account’s password will automatically change every day (Active Directory only).</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Edit admin account</p></td>
-<td align="left"><p>Accounts - All accounts</p></td>
-<td align="left"><p>Change the password for the local admin account.</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Change maintenance hours</p></td>
-<td align="left"><p>Updates &amp; security – Windows Update – Advanced settings</p></td>
-<td align="left"><p>Set the hours when updates can be installed.</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Configure Windows Server Update Services (WSUS) server</p></td>
-<td align="left"><p>Updates &amp; security – Windows Update – Advanced settings</p></td>
-<td align="left"><p>Change whether the device receives updates from the WSUS you choose.</p></td>
-</tr>
-</tbody>
-</table>
-
- 
-
-## Which should I choose?
-
-
-If you plan to deploy multiple Surface Hubs, we recommend that you manage your devices remotely. This requires that your organization use an MDM solution to deploy policies.
-
-Every Surface Hub can be managed locally by an admin who physically logs in to the device. Which method is used to log in is decided during first run (see [Set up admins for this device](first-run-program-surface-hub.md#setup-admins)).
+Learn about managing and updating Surface Hub. 
 
 ## In this section
 
-
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Topic</th>
-<th align="left">Description</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>[Accessibility](accessibility-surface-hub.md)</p></td>
-<td align="left"><p>Accessibility settings for the Surface Hub can be changed by using the Settings app. You'll find them under <strong>Ease of Access</strong>. Your Surface Hub has the same accessibility options as Windows 10.</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>[Change the Surface Hub device account](change-surface-hub-device-account.md)</p></td>
-<td align="left"><p>You can change the device account in Settings to either add an account if one was not already provisioned, or to change any properties of an account that was already provisioned.</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>[Device reset](device-reset-suface-hub.md)</p></td>
-<td align="left"><p>You may wish to reset your Surface Hub.</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>[Install apps on your Surface Hub](install-apps-on-surface-hub.md)</p></td>
-<td align="left"><p>Admins can install apps can from either the Windows Store or the Windows Store for Business.</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>[Manage settings with a local admin account](manage-settings-with-local-admin-account-surface-hub.md)</p></td>
-<td align="left"><p>A local admin account will be set up on every Surface Hub as part of the first run program. The only way to change the local admin options that you chose at that time is to reset the device.</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>[Manage settings with an MDM provider](manage-settings-with-mdm-for-surface-hub.md)</p></td>
-<td align="left"><p>Surface Hub provides an enterprise management solution to help IT administrators manage policies and business applications on these devices using a mobile device management (MDM) solution.</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>[Monitor your Surface Hub](monitor-surface-hub.md)</p></td>
-<td align="left"><p>Monitoring for Surface Hub devices is enabled through Microsoft Operations Management Suite (OMS).</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>[Save your BitLocker key](save-bitlocker-key-surface-hub.md)</p></td>
-<td align="left"><p>Every Surface Hub is automatically set up with BitLocker drive encryption software. Microsoft strongly recommends that you make sure you back up your BitLocker recovery keys.</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>[Using a room control system](use-room-control-system-with-surface-hub.md)</p></td>
-<td align="left"><p>Room control systems can be used with your Surface Hub.</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>[Windows updates](manage-windows-updates-for-surface-hub.md)</p></td>
-<td align="left"><p>You can manage Windows updates on your Surface Hub by setting the maintenance window, deferring updates, or using WSUS.</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>[Wireless network management](wireless-network-management-for-surface-hub.md)</p></td>
-<td align="left"><p>Surface Hub offers two options for network connectivity to your corporate network and Internet: wireless, and wired. While both provide network access, we recommend you use a wired connection.</p></td>
-</tr>
-</tbody>
-</table>
-
- 
-
- 
-
- 
-
-
-
-
+| Topic | Description |
+| ----- | ----------- |
+| [Local management for Surface Hub settings](local-management-surface-hub-settings.md) | Settings specific to Surface Hub.  |
+| [Remote Surface Hub management](remote-surface-hub-management.md) |Topics related to managing your Surface Hub remotely. Include install apps, managing settings with MDM and monitoring with Operations Management Suite. |
+| [Manage Surface Hub settings](manage-surface-hub-settings.md) |Topics related to managing Surface Hub settings: accessibility, device account, device reset, fully qualified domain name, Windows Update settings, and wireless network |
+| [Save your BitLocker key](https://technet.microsoft.com/itpro/surface-hub/save-bitlocker-key-surface-hub) | Every Surface Hub is automatically set up with BitLocker drive encryption software. Microsoft strongly recommends that you make sure you back up your BitLocker recovery keys.|
+| [End a meeting with I’m done](https://technet.microsoft.com/itpro/surface-hub/i-am-done-finishing-your-surface-hub-meeting) | At the end of a meeting, users can tap I'm Done to clean up any sensitive data and prepare the device for the next meeting.|
+| [Connect other devices and display with Surface Hub](https://technet.microsoft.com/itpro/surface-hub/connect-and-display-with-surface-hub) | You can connect other device to your Surface Hub to display content.|
+| [Using a room control system]( https://technet.microsoft.com/itpro/surface-hub/use-room-control-system-with-surface-hub) | Room control systems can be used with your Microsoft Surface Hub.|
 

devices/surface-hub/manage-windows-updates-for-surface-hub.md

@@ -13,61 +13,125 @@ localizationpriority: medium
 
 # Windows updates (Surface Hub)
 
+New releases of the Surface Hub operating system are published through Windows Update, just like releases of Windows 10. There are a couple of ways you can manage which updates are installed on your Surface Hubs, and the timing for when updates are applied.
+- **Windows Update for Business** - New in Windows 10, Windows Update for Business is a set of features designed to provide enterprises additional control over how and when Windows Update installs releases, while reducing device management costs. Using this method, Surface Hubs are directly connected to Microsoft’s Windows Update service.
+- **Windows Server Update Services (WSUS)** - Set of services that enable IT administrators to obtain the updates that Windows Update determines are applicable to the devices in their enterprise, perform additional testing and evaluation on the updates, and select the updates they want to install. Using this method, Surface Hubs will receive updates from WSUS rather than Windows Update.
 
-You can manage Windows updates on your Microsoft Surface Hub by setting the maintenance window, deferring updates, or using Windows Server Update Services (WSUS).
+You can also configure Surface Hub to receive updates from both Windows Update for Business and WSUS. See [Integrate Windows Update for Business with Windows Server Update Services](https://technet.microsoft.com/en-us/itpro/windows/manage/waas-integrate-wufb#integrate-windows-update-for-business-with-windows-server-update-services) for details.
 
-### Maintenance window
+| Capabilities | Windows Update for Business | Windows server Update Services (WSUS) |
+| ------------ | --------------------------- | ------------------------------------- |
+| Receive updates directly from Microsoft's Windows Update service, with no additional infrastructure required.  | Yes  | No  |
+| Defer updates to provide additional time for testing and evaluation. | Yes  | Yes  |
+| Deploy updates to select groups of devices. | Yes | Yes |
+| Define maintenance windows for installing updates. | Yes  | Yes  |
+
+> [!TIP]
+> Use peer-to-peer content sharing to reduce bandwidth issues during updates. See [Optimize update delivery for Windows 10 updates](https://technet.microsoft.com/en-us/itpro/windows/manage/waas-optimize-windows-10-updates) for details.
+
+> [!NOTE]
+> Surface Hub does not currently support rolling back updates.
+
+
+## Surface Hub servicing model
+
+Surface Hub uses the Windows 10 servicing model, referred to as Windows as a Service (WaaS). Traditionally, new features are added only in new versions of Windows that are released every few years. Each new version required lengthy and expensive processes to deploy in an organization. As a result, end users and organizations don't frequently enjoy the benefits of new innovation. The goal of Windows as a Service is to continually provide new capabilities while maintaining a high level of quality.
+
+Microsoft publishes two types of Surface Hub releases broadly on an ongoing basis:
+- **Feature updates** - Updates that install the latest new features, experiences, and capabilities. Microsoft expects to publish an average of two to three new feature upgrades per year.
+- **Quality updates** - Updates that focus on the installation of security fixes, drivers, and other servicing updates. Microsoft expects to publish one cumulative quality update per month.
+
+In order to improve release quality and simplify deployments, all new releases that Microsoft publishes for Windows 10, including Surface Hub, will be cumulative. This means new feature updates and quality updates will contain the payloads of all previous releases (in an optimized form to reduce storage and networking requirements), and installing the release on a device will bring it completely up to date. Also, unlike earlier versions of Windows, you cannot install a subset of the contents of a Windows 10 quality update. For example, if a quality update contains fixes for three security vulnerabilities and one reliability issue, deploying the update will result in the installation of all four fixes.
+
+The Surface Hub operating system is available on **Current Branch (CB)** and **Current Branch for Business (CBB)**. Like other editions of Windows 10, the servicing lifetime of CB or CBB is finite. You must install new feature updates on machines running these branches in order to continue receiving quality updates.
+
+For more information on Windows as a Service, see [Overview of Windows as a service](https://technet.microsoft.com/en-us/itpro/windows/manage/waas-overview).
+
+
+## Use Windows Update for Business
+Surface Hubs, like all Windows 10 devices, include **Windows Update for Business (WUfB)** to enable you to control how your devices are being updated. Windows Update for Business helps reduce device management costs, provide controls over update deployment, offer quicker access to security updates, as well as provide access to the latest innovations from Microsoft on an ongoing basis. For more information, see [Manage updates using Windows Update for Business](https://technet.microsoft.com/en-us/itpro/windows/manage/waas-manage-updates-wufb).
+
+**To set up Windows Update for Business:**
+1. [Group Surface Hub into deployment rings](#group-surface-hub-into-deployment-rings)
+2. [Configure Surface Hub to use Current Branch or Current Branch for Business](#configure-surface-hub-to-use-current-branch-or-current-branch-for-business).
+2. [Configure when Surface Hub receives updates](#configure-when-surface-hub-receives-updates).
+
+> [!NOTE]
+> You can use Microsoft Intune, System Center Configuration Manager, or a supported third-party MDM provider to set up WUfB. [Walkthrough: use Microsoft Intune to configure Windows Update for Business.](https://technet.microsoft.com/en-us/itpro/windows/manage/waas-wufb-intune)
+
+
+### Group Surface Hub into deployment rings
+Use deployment rings to control when updates roll out to your Surface Hubs, giving you time to validate them. For example, you can update a small pool of devices first to verify quality before a broader roll-out to your organization. Depending on who manages Surface Hub in your organization, consider incorporating Surface Hub into the deployment rings that you've built for your other Windows 10 devices. For more information about deployment rings, see [Build deployment rings for Windows 10 updates](https://technet.microsoft.com/en-us/itpro/windows/manage/waas-deployment-rings-windows-10-updates).
+
+This table gives examples of deployment rings.
+
+| Deployment ring | Ring size | Servicing branch | Deferral for feature updates | Deferral for quality updates (security fixes, drivers, and other updates) | Validation step |
+| --------- | --------- | --------- | --------- | --------- | --------- |
+| Evaluation (e.g. non-critical or test devices) | Small | Current Branch (CB) | None. Devices receive feature updates immediately after CB is released. | None. Devices receive quality updates immediately after CB is released. | Manually test and evaluate new functionality. Pause updates if there are issues. |
+| Pilot (e.g. devices used by select teams) | Medium | Current Branch for Business (CBB) | None. Devices receive feature updates immediately once CBB is released. | None. Devices receive quality updates immediately after CBB is released. | Monitor device usage and user feedback. Pause updates if there are issues. |
+| Broad deployment (e.g. most of the devices in your organization) | Large | Current Branch for Business (CBB) |  60 days after CBB is released. | 14 days after CBB is released. | Monitor device usage and user feedback. Pause updates if there are issues. |
+| Mission critical (e.g. devices in executive boardrooms) | Small | Current Branch for Business (CBB) |  180 days after CBB is released (maximum deferral for feature updates). | 30 days after CBB is released (maximum deferral for quality updates). | Monitor device usage and user feedback. |
+
+
+### Configure Surface Hub to use Current Branch or Current Branch for Business
+By default, Surface Hubs are configured to receive updates from Current Branch (CB). CB receives feature updates as soon as they are released by Microsoft. Current Branch for Business (CBB), on the other hand, receives feature updates at least four months after they have been initially offered to CB devices, and includes all of the quality updates that have been released in the interim. For more information on the differences between CB and CBB, see [Servicing branches](https://technet.microsoft.com/en-us/itpro/windows/manage/waas-overview#servicing-branches).
+
+**To manually configure Surface Hub to use CB or CBB:**
+1. Open **Settings** > **Update & Security** > **Windows Update**, and then select **Advanced Options**. 
+2. Select **Defer feature updates**.
+
+To configure Surface Hub to use CB or CBB remotely using MDM, set an appropriate [Update/BranchReadinessLevel](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx#Update_BranchReadinessLevel) policy.
+
+
+### Configure when Surface Hub receives updates
+Once you've determined deployment rings for your Surface Hubs, configure update deferral policies for each ring:
+- To defer feature updates, set an appropriate [Update/DeferFeatureUpdatesPeriodInDays](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx#Update_DeferFeatureUpdatesPeriodInDays) policy for each ring.
+- To defer quality updates, set an appropriate [Update/DeferQualityUpdatesPeriodInDays](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx#Update_DeferQualityUpdatesPeriodInDays) policy for each ring.
+
+> [!NOTE]
+> If you encounter issues during the update rollout, you can pause updates using [Update/PauseFeatureUpdates](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx#Update_PauseFeatureUpdates) and [Update/PauseQualityUpdates](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx#Update_PauseQualityUpdates).
+
+
+## Use Windows Server Update Services (WSUS)
+
+You can connect Surface Hub to your WSUS server to manage updates. Updates will be controlled through approvals or automatic deployment rules configured in your WSUS server, so new upgrades will not be deployed until you choose to deploy them.
+
+**To manually connect a Surface Hub to a WSUS server:**
+1. Open **Settings** on your Surface Hub.
+2. Enter the device admin credentials when prompted.
+3. Navigate to **Update & security** > **Windows Update** > **Advanced options** > **Configure Windows Server Update Services (WSUS) server**.
+4. Click **Use WSUS Server to download updates** and type the URL of your WSUS server.
+
+To connect Surface Hub to a WSUS server using MDM, set an appropriate [Update/UpdateServiceUrl](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx#Update_UpdateServiceUrl) policy.
+
+
+## Maintenance window
+
+To ensure the device is always available for use during business hours, Surface Hub performs its administrative functions during a specified maintenance window. During the maintenance window, the Surface Hub automatically installs updates through Windows Update or WSUS, and reboots the device if needed.
+
+Surface Hub follows these guidelines to apply updates:
+-   Install the update during the next maintenance window. If a meeting is scheduled to start during a maintenance window, or the Surface Hub sensors detect that the device is being used, the pending update will be postponed to the following maintenance window.
+-   If the next maintenance window is past the update’s prescribed grace period, the device will calculate the next available slot during business hours using the estimated install time from the update’s metadata. It will continue to postpone the update if a meeting is scheduled, or the Surface Hub sensors detect that the device is being used.
+-   If a pending update is past the update’s prescribed grace period, the update will be immediately installed. If a reboot is needed, the Surface Hub will automatically reboot during the next maintenance window.
+
+> [!NOTE]
+> Allow time for updates when you first setup your Surface Hub. For example, a backlog of virus definitions may be available, which should be immediately installed.
 
 A default maintenance window is set for all new Surface Hubs:
+-   **Start time:** 3:00 AM
+-   **Duration:** 1 hour
 
--   Start time: 3:00 AM
--   Duration: 1 hour
+**To manually change the maintenance window:**
+1.  Open **Settings** on your Surface Hub.
+2.  Navigate to **Update & security** > **Windows Update** > **Advanced options**.
+3.  Under **Maintenance hours**, select **Change**.
 
-Most Windows updates are downloaded and installed automatically by Surface Hub. You can change the maintenance window to limit when the device can be automatically rebooted after a Windows update installation. For those updates that require a reboot of the device, the update installation will be postponed until the maintenance window begins. If a meeting is scheduled to start during the maintenance window, or if the Surface Hub sensors detect that the device is being used, the pending installation will be postponed to the next maintenance window.
+To change the maintenance window using MDM, set the **MOMAgent** node in the [SurfaceHub configuration service provider](https://msdn.microsoft.com/en-us/library/windows/hardware/mt608323.aspx). See [Manage settings with an MDM provider](manage-settings-with-mdm-for-surface-hub.md) for more details.
 
->**Note**: If an update installation has been pending for 28 days, on the 28th day the update will be forcibly installed. The device will ignore meetings or sensor status and reboot during the maintenance window.
-
- 
-
-To change the default maintenance window:
-
-1.  Open the Settings app.
-2.  Navigate to **Update and Security** > **Advanced Options**.
-3.  Under **Maintenance hours**, click **Change**.
-
-### Deferring Windows updates
-
-You can choose to defer downloading or installing updates that install new Windows features. When you do, new Windows features won’t be downloaded or installed for up to several months. Deferring updates doesn’t affect security updates, which will be downloaded and installed as usual.
-
-To defer Windows feature updates:
-
-1.  Open the Settings app.
-2.  Navigate to **Update and Security** > **Advanced Options**.
-3.  Click on the checkbox for **Defer upgrades**.
-
-### Using WSUS
-
-You can use WSUS to manage the download and installation of Windows updates on your Surface Hub.
-
-To connect a Surface Hub to a WSUS server:
-
-1.  Open the Settings app.
-2.  Navigate to **Update and Security** > **Advanced Options**.
-3.  Click on the checkbox for **Configure Windows Server Update Services (WSUS) server**.
-4.  Check the box for **Use WSUS Server to download updates** and enter the WSUS endpoint.
 
 ## Related topics
 
-
 [Manage Microsoft Surface Hub](manage-surface-hub.md)
 
 [Microsoft Surface Hub administrator's guide](surface-hub-administrators-guide.md)
 
- 
-
- 
-
-
-
-
-

devices/surface-hub/monitor-surface-hub.md

@@ -40,9 +40,11 @@ From the **Overview** page in your OMS workspace, click the Surface Hub tile to
 
 Use this view to get an inventory of all your Surface Hubs. Once connected to OMS, each Surface Hub periodically sends a "heartbeat" event to the server. This view shows Surface Hubs that have reported a heartbeat in the past 24 hours.
 
+<!--
 **Skype meetings**
 
 Use this view to get usage data for Skype over the past 30 days. The graph shows the total number of Skype Meetings started across your Surface Hubs, and a breakdown between scheduled meetings, ad hoc meetings, and PSTN calls.
+-->
  
 **Wireless projection**
 

devices/surface-hub/remote-surface-hub-management.md

@@ -0,0 +1,21 @@
+---
+title: Remote Surface Hub management
+description: This section lists topics for managing Surface Hub.
+keywords: remote management, MDM, install apps, monitor Surface Hub, Operations Management Suite, OMS
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.sitesec: library
+ms.pagetype: surfacehub
+author: TrudyHa
+localizationpriority: medium
+---
+
+# Remote Surface Hub management
+
+## In this section
+
+|Topic | Description|
+| ------ | --------------- |
+| [Install apps on your Surface Hub]( https://technet.microsoft.com/itpro/surface-hub/install-apps-on-surface-hub) | Admins can install apps can from either the Windows Store or the Windows Store for Business.|
+| [Manage settings with an MDM provider]( https://technet.microsoft.com/itpro/surface-hub/manage-settings-with-mdm-for-surface-hub) | Surface Hub provides an enterprise management solution to help IT administrators manage policies and business applications on these devices using a mobile device management (MDM) solution.|
+| [Monitor your Surface Hub]( https://technet.microsoft.com/itpro/surface-hub/monitor-surface-hub) | Monitoring for Surface Hub devices is enabled through Microsoft Operations Management Suite.|

devices/surface-hub/save-bitlocker-key-surface-hub.md

@@ -24,11 +24,11 @@ There are several ways to manage your BitLocker key on the Surface Hub.
 
 2.  If you’ve joined the Surface Hub to Azure Active Directory (Azure AD), the BitLocker key will be stored under the account that was used to join the device.
 
-3.  If you’re using a local admin account to manage the device, you can save the BitLocker key by going to Settings and navigating to **System** > **Microsoft Surface Hub**. Insert a USB drive and select the option to save the BitLocker key. The key will be saved to a text file on the USB drive.
+3.  If you’re using a local admin account to manage the device, you can save the BitLocker key by going to the **Settings** app and navigating to **Update & security** > **Recovery**. Insert a USB drive and select the option to save the BitLocker key. The key will be saved to a text file on the USB drive.
+
 
 ## Related topics
 
-
 [Manage Microsoft Surface Hub](manage-surface-hub.md)
 
 [Microsoft Surface Hub administrator's guide](surface-hub-administrators-guide.md)

devices/surface-hub/wireless-network-management-for-surface-hub.md

@@ -36,10 +36,7 @@ If a wired network connection is not available, the Surface Hub can use a wirele
 
 1.  On the Surface Hub, open **Settings** and enter your admin credentials.
 2.  Click **System**, click **Network & Internet**, then **Wi-Fi**, and then click **Advanced options**.
-
-    ![Image showing where to find Advanced options for Network & Internect, Wi-Fi settings.](images/networkmgtwireless-03.png)
-
-3.  The system will show you the properties for the wireless network connection.
+3.  Surface Hub shows you the properties for the wireless network connection.
 
     ![Image showing properties for connected Wi-Fi.](images/networkmgtwireless-04.png)
 

windows/keep-secure/TOC.md

@@ -34,6 +34,7 @@
 ### [General guidance and best practices for Windows Information Protection (WIP)](guidance-and-best-practices-wip.md)
 #### [Mandatory tasks and settings required to turn on Windows Information Protection (WIP)](mandatory-settings-for-wip.md)
 #### [Enlightened apps for use with Windows Information Protection (WIP)](enlightened-microsoft-apps-and-wip.md)
+#### [Unenlightened and enlightened app behavior while using Windows Information Protection (WIP)](app-behavior-with-wip.md)
 #### [Testing scenarios for Windows Information Protection (WIP)](testing-scenarios-for-wip.md)
 #### [Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md)
 ## [Use Windows Event Forwarding to help with intrusion detection](use-windows-event-forwarding-to-assist-in-instrusion-detection.md)

windows/keep-secure/app-behavior-with-wip.md

@@ -0,0 +1,131 @@
+---
+title: Unenlightened and enlightened app behavior while using Windows Information Protection (WIP) (Windows 10)
+description: How unenlightened and enlightened apps might behave, based on Windows Information Protection (WIP) networking policies, app configuration, and potentially whether the app connects to network resources directly by using IP addresses or by using hostnames.
+keywords: WIP, Enterprise Data Protection, EDP, Windows Information Protection, unenlightened apps, enlightened apps
+ms.prod: w10
+ms.mktglfcycl: explore
+ms.pagetype: security
+ms.sitesec: library
+localizationpriority: high
+---
+
+# Unenlightened and enlightened app behavior while using Windows Information Protection (WIP)
+**Applies to:**
+
+- Windows 10, version 1607
+- Windows 10 Mobile
+
+Windows Information Protection (WIP) classifies apps into two categories: enlightened and unenlightened. Enlighted apps can differentiate between corporate and personal data, correctly determining which to protect based on internal policies. Corporate data is encrypted on the managed device and attempts to copy/paste or share this information with non-corporate apps or people will fail. Unenlightened apps, when marked as corporate-managed, consider all data corporate and encrypt everything by default.
+
+To avoid the automatic encryption of data, developers can enlighten apps by adding and compiling code using the Windows Information Protection application programming interfaces. The most likely candidates for enlightenment are apps that:
+
+- Don’t use common controls for saving files.
+- Don’t use common controls for text boxes.
+- Simultaneously work on personal and corporate data (for example, contact apps that display personal and corporate data in a single view or a browser that displays personal and corporate web pages on tabs within a single instance).
+
+We strongly suggest that the only unenlightened apps you add to your allowed apps list are Line-of-Business (LOB) apps.
+
+>[!Note]
+>For more info about creating enlightened apps, see the [Windows Information Protection (WIP)](https://msdn.microsoft.com/en-us/windows/uwp/enterprise/wip-hub) topic in the Windows Dev Center.
+
+## Unenlightened app behavior
+This table includes info about how unenlightened apps might behave, based on your Windows Information Protection (WIP) networking policies, your app configuration, and potentially whether the app connects to network resources directly by using IP addresses or by using hostnames.
+
+<table>
+   <tr>
+     <th>App rule setting</th>
+     <th align="center" colspan="2">Networking policy configuration</th>
+   </tr>
+   <tr>
+        <th>&nbsp;</th>
+        <th align="center">Name-based policies, without the <code>/*AppCompat*/</code> string</th>
+        <th align="center">Name-based policies, using the <code>/*AppCompat*/</code> string or proxy-based policies</th>
+    </tr>
+   <tr align="left">
+     <td><strong>Not required.</strong> App connects to enterprise cloud resources directly, using an IP address.</td>
+     <td>
+        <ul>
+            <li>App is entirely blocked from both personal and enterprise cloud resources.</li>
+            <li>No encryption is applied.</li>
+            <li>App can’t access local Work files.</li>
+        </ul>
+    </td>
+    <td>
+        <ul>
+            <li>App can access both personal and enterprise cloud resources. However, you might encounter apps using policies that restrict access to enterprise cloud resources.</li>
+            <li>No encryption is applied.</li>
+            <li>App can’t access local Work files.</li>
+        </ul>
+    </td>
+   </tr>
+    <tr align="left">
+     <td><strong>Not required.</strong> App connects to enterprise cloud resources, using a hostname.</td>
+     <td colspan="2">
+        <ul>
+            <li>App is blocked from accessing enterprise cloud resources, but can access other network resources.</li>
+            <li>No encryption is applied.</li>
+            <li>App can’t access local Work files.</li>
+        </ul>
+    </td>
+   </tr>
+    <tr align="left">
+     <td><strong>Allow.</strong> App connects to enterprise cloud resources, using an IP address or a hostname.</td>
+     <td colspan="2">
+        <ul>
+            <li>App can access both personal and enterprise cloud resources.</li>
+            <li>Auto-encryption is applied.</li>
+            <li>App can access local Work files.</li>
+        </ul>
+    </td>
+   </tr>
+    <tr align="left" colspan="2">
+     <td><strong>Exempt.</strong> App connects to enterprise cloud resources, using an IP address or a hostname.</td>
+     <td colspan="2">
+        <ul>
+            <li>App can access both personal and enterprise cloud resources.</li>
+            <li>No encryption is applied.</li>
+            <li>App can access local Work files.</li>
+        </ul>
+    </td>
+   </tr>
+</table>
+
+## Enlightened app behavior
+This table includes info about how enlightened apps might behave, based on your Windows Information Protection (WIP) networking policies, your app configuration, and potentially whether the app connects to network resources directly by using IP addresses or by using hostnames.
+
+<table>
+   <tr>
+     <th>App rule setting</th>
+     <th>Networking policy configuration for name-based policies, possibly using the <code>/*AppCompat*/</code> string, or proxy-based policies</th>
+   </tr>
+    <tr>
+        <td><strong>Not required.</strong> App connects to enterprise cloud resources, using an IP address or a hostname.</td>
+        <td>
+            <ul>
+                <li>App is blocked from accessing enterprise cloud resources, but can access other network resources.</li>
+                <li>No encryption is applied.</li>
+                <li>App can't access local Work files.</li>
+            </ul>
+        </td>
+    </tr>
+    <tr>
+        <td><strong>Allow.</strong> App connects to enterprise cloud resources, using an IP address or a hostname.</td>
+        <td>
+            <ul>
+                <li>App can access both personal and enterprise cloud resources.</li>
+                <li>App protects work data and leaves personal data unprotected.</li>
+                <li>App can access local Work files.</li>
+            </ul>
+        </td>
+    </tr>
+    <tr>
+        <td><strong>Exempt.</strong> App connects to enterprise cloud resources, using an IP address or a hostname.</td>
+        <td>
+            <ul>
+                <li>App can access both personal and enterprise cloud resources.</li>
+                <li>App protects work data and leaves personal data unprotected.</li>
+                <li>App can access local Work files.</li>
+            </ul>
+        </td>
+    </tr>
+</table>

windows/keep-secure/change-history-for-keep-windows-10-secure.md

@@ -16,7 +16,9 @@ This topic lists new and updated topics in the [Keep Windows 10 secure](index.md
 
 | New or changed topic | Description |
 | --- | --- |
-| [VPN technical guide](vpn-guide.md) | Multiple new topics, replacing previous **VPN profile options** topic |
+|[Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md) |Added content about using ActiveX controls.|
+|[Unenlightened and enlightened app behavior while using Windows Information Protection (WIP)](app-behavior-with-wip.md) |New |
+|[VPN technical guide](vpn-guide.md) | Multiple new topics, replacing previous **VPN profile options** topic |
 
 ## September 2016
 

windows/keep-secure/limitations-with-wip.md

@@ -71,7 +71,12 @@ This table provides info about the most common problems you might encounter whil
     </tr>
     <tr>
         <td>You can't upload an enterprise file to a personal location using Microsoft Edge or Internet Explorer.</td>
-        <td>A message appears stating that the content is marked as **Work** and the user isn't given an option to override to **Personal**.</td>
-        <td>Open File Explorer and change the file ownership to **Personal** before you upload.</td>
+        <td>A message appears stating that the content is marked as <strong>Work</strong> and the user isn't given an option to override to <strong>Personal</strong>.</td>
+        <td>Open File Explorer and change the file ownership to <strong>Personal</strong> before you upload.</td>
+    </tr>
+    <tr>
+        <td>ActiveX controls should be used with caution.</td>
+        <td>Webpages that use ActiveX controls can potentially communicate with other outside processes that aren’t protected by using WIP.</td>
+        <td>We recommend that you switch to using Microsoft Edge, the more secure and safer browser that prevents the use of ActiveX controls. We also recommend that you limit the usage of Internet Explorer 11 to only those line-of-business apps that require legacy technology.<p>For more info, see [Out-of-date ActiveX control blocking](https://technet.microsoft.com/en-us/itpro/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking).</td>
     </tr>
 </table>                 

windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md

@@ -29,6 +29,9 @@ Configure your browser to allow cookies.
 ### No data is shown on the portal
 If no data is displayed on the Dashboard portal even if no errors were encountered in the portal logs or in the browser console, you'll need to whitelist the threat intelligence, data access, and detonation endpoints that also use this protocol.
 
+> [!NOTE]
+> You must use the HTTPS protocol when adding the following endpoints.
+
 Depending on your region, add the following endpoints to the whitelist:
 
 U.S. region:
@@ -37,9 +40,6 @@ U.S. region:
 - daasmon-eus-prd.cloudapp.net			
 - dataaccess-cus-prd.cloudapp.net			
 - dataaccess-eus-prd.cloudapp.net			
-- onboardingservice-prd.trafficmanager.net			
-- sevillefeedback-prd.trafficmanager.net			
-- sevillesettings-prd.trafficmanager.net			
 - threatintel-cus-prd.cloudapp.net			
 - threatintel-eus-prd.cloudapp.net
 - winatpauthorization.windows.com
@@ -51,9 +51,6 @@ EU region:
 
 - dataaccess-neu-prd.cloudapp.net
 - dataaccess-weu-prd.cloudapp.net
-- onboardingservice-prd.trafficmanager.net
-- sevillefeedback-prd.trafficmanager.net
-- sevillesettings-prd.trafficmanager.net
 - threatintel-neu-prd.cloudapp.net
 - threatintel-weu-prd.cloudapp.net
 - winatpauthorization.windows.com

windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md

@@ -11,9 +11,7 @@ author: brianlic-msft
 ---
 
 # Manage connections from Windows operating system components to Microsoft services
-
-<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span> 
-
+ 
 **Applies to**
 
 -   Windows 10