/EXE`
-10. In the **Custom OMA-URI Settings** blade, click **Add**.
+13. Open File Explorer, go to the location where you saved your new XML file, and open it using an XML editor, such as Notepad.
-11. In the **Add Row** blade, type:
+14. Copy the text that has a **Type** of `EXE`, within in the **RuleCollection** tags, and then go back to Intune and paste the text into the **Value** box of the **Add or edit OMA-URI Setting** box. For example:
- - **Name.** Type a name for your setting, such as *AllowedDesktopAppsURI*.
-
- - **Description.** Type an optional description for your setting.
-
- - **OMA-URI.** Type _./Vendor/MSFT/AppLocker/EnterpriseDataProtection/>your_enterprise_name</EXE_ into the box.
+ ```
+
+ ```
- - **Data type.** Select **String** from the dropdown box.
-
- - **Value.** To find the text to type here, follow these steps:
-
- 1. Open File Explorer, go to the location where you saved your exported XML file from above, and open it using an XML editor, such as Notepad.
-
- 2. Copy the text that includes the **Type** of `Exe` within the **RuleCollection** tags, pasting this info into the **Value** box. For example:
-
- ```
-
- ```
-
- 
-
-5. Click **OK** to save your setting info in the **Add Row** blade, and then click **OK** in the **Custom OMA-URI Settings** blade to save the setting with your policy.
-
-6. Click **Create** to create the policy, including your OMA_URI info.
+15. Click **OK** to close the **Add or edit OMA-URI Setting** box, and then click **Save Policy**.
After saving the policy, you’ll need to deploy it to your employee’s devices. For more info, see the [Deploy your Windows Information Protection (WIP) policy](deploy-wip-policy-using-intune.md) topic.
@@ -178,16 +127,8 @@ You can add apps to your Windows Information Protection (WIP) protected app list
>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).
## Related topics
-- [Create a Windows Information Protection (WIP) policy using Microsoft Azure Intune](create-wip-policy-using-intune.md)
+- [Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune.md)
+
- [Deploy your Windows Information Protection (WIP) policy](deploy-wip-policy-using-intune.md)
-- [Create and deploy a VPN policy for Windows Information Protection (WIP) using Microsoft Azure Intune](create-vpn-and-wip-policy-using-intune.md)
-
-
-
-
-
-
-
-
-
+- [Create and deploy a VPN policy for Windows Information Protection (WIP) using Microsoft Intune](create-vpn-and-wip-policy-using-intune.md)
diff --git a/windows/keep-secure/create-vpn-and-wip-policy-using-intune.md b/windows/keep-secure/create-vpn-and-wip-policy-using-intune.md
index d1c2061bb5..a7f261c3e7 100644
--- a/windows/keep-secure/create-vpn-and-wip-policy-using-intune.md
+++ b/windows/keep-secure/create-vpn-and-wip-policy-using-intune.md
@@ -11,66 +11,103 @@ author: eross-msft
localizationpriority: high
---
-# Create and deploy a VPN policy for Windows Information Protection (WIP) using Microsoft Azure Intune
+# Create and deploy a VPN policy for Windows Information Protection (WIP) using Microsoft Intune
**Applies to:**
-- Windows 10, version 1703
-- Windows 10 Mobile, version 1703
+- Windows 10, version 1607
+- Windows 10 Mobile
-After you've created and deployed your Windows Information Protection (WIP) policy, you can use Microsoft Azure Intune to create and deploy your Virtual Private Network (VPN) policy, linking it to your WIP policy.
+After you've created and deployed your Windows Information Protection (WIP) policy, you can use Microsoft Intune to create and deploy your Virtual Private Network (VPN) policy, linking it to your WIP policy.
-## Create your VPN policy using Microsoft Azure Intune
+## Create your VPN policy using Microsoft Intune
Follow these steps to create the VPN policy you want to use with WIP.
**To create your VPN policy**
-1. Open the Microsoft Azure Intune mobile application management console, click **Device configuration**, and then click **Create Profile**.
+1. Open the Intune administration console, and go to the **Policy** node, and then click **Add Policy**.
- 
+2. Go to **Windows**, click the **VPN Profile (Windows 10 Desktop and Mobile and later)**, click **Create and Deploy a Custom Policy**, and then click **Create Policy**.
-2. In the **Create Profile** blade, type a name for your profile, such as *Contoso_VPN_Win10*, into the **Name** box, add an optional description for your policy into the **Description** box, select **Windows 10 and later** from the **Platform** dropdown box, select **Custom** from the **Profile type** dropdown box, and then click **Configure**.
+ 
- 
+3. Type *Contoso_VPN_Win10* into the **Name** box, along with an optional description for your policy into the **Description** box.
-3. In the **Custom OMA-URI Settings** blade, click **Add**.
+ 
-4. In the **Add Row** blade, type:
+4. In the **VPN Settings** area, type the following info:
- - **Name.** Type a name for your setting, such as *EDPModeID*.
-
- - **Description.** Type an optional description for your setting.
-
- - **OMA-URI.** Type _./Vendor/MSFT/VPNv2/<VPNProfileName>/EDPModeId_ into the box.
+ - **VPN connection name.** This name is also what appears to your employees, so it's important that it be clear and understandable.
- - **Data type.** Select **String** from the dropdown box
-
- - **Value.** Type your fully-qualified domain that should be used by the OMA-URI setting. For example, _corp.contoso.com_.
+ - **Connection type.** Pick the connection type that matches your infrastructure. The options are **Pulse Secure**, **F5 Edge Client**, **Dell SonicWALL Mobile Connect**, or **Check Point Capsule VPN**.
- 
+ - **VPN server description.** A descriptive name for this connection. Only you will see it, but it should be unique and readable.
-5. Click **OK** to save your setting info in the **Add Row** blade, and then click **OK** in the **Custom OMA-URI Settings** blade to save the setting with your policy.
+ - **Server IP address or FQDN.** The server's IP address or fully-qualified domain name (FQDN).
-6. Click **Create** to create the policy, including your OMA_URI info.
+ 
-## Deploy your VPN policy using Microsoft Azure Intune
+5. In the **Authentication** area, choose the authentication method that matches your VPN infrastructure, either **Username and Password** or **Certificates**.
+It's your choice whether you check the box to **Remember the user credentials at each logon**.
+
+ 
+
+6. You can leave the rest of the default or blank settings, and then click **Save Policy**.
+
+## Deploy your VPN policy using Microsoft Intune
After you’ve created your VPN policy, you'll need to deploy it to the same group you deployed your Windows Information Protection (WIP) policy.
-**To deploy your Custom VPN policy**
+**To deploy your VPN policy**
-1. On the **App policy** blade, click your newly-created policy, click **User groups** from the menu that appears, and then click **Add user group**.
+1. On the **Configuration policies** page, locate your newly-created policy, click to select it, and then click the **Manage Deployment** button.
- A list of user groups, made up of all of the security groups in your Azure Active Directory, appear in the **Add user group** blade.
+2. In the left pane of the **Manage Deployment** box, click the employees or groups that should get the policy, and then click **Add**.
+The added people move to the **Selected Groups** list on the right-hand pane.
-2. Choose the group you want your policy to apply to, and then click **Select** to deploy the policy.
+ 
- The policy is deployed to the selected users' devices.
+3. After you've picked all of the employees and groups that should get the policy, click **OK**.
+The policy is deployed to the selected users' devices.
- 
+## Link your WIP and VPN policies and deploy the custom configuration policy
+The final step to making your VPN configuration work with WIP, is to link your two policies together. To do this, you must first create a custom configuration policy, setting it to use your **EDPModeID** setting, and then deploying the policy to the same group you deployed your WIP and VPN policies
+
+**To link your VPN policy**
+
+1. Open the Intune administration console, and go to the **Policy** node, and then click **Add Policy**.
+
+2. Go to **Windows**, click the **Custom Configuration (Windows 10 Desktop and Mobile and later)**, click **Create and Deploy a Custom Policy**, and then click **Create Policy**.
+
+ 
+
+3. Type a name (required) and an optional description for your policy into the **Name** and **Description** boxes.
+
+ 
+
+4. In the **OMA-URI Settings** area, click **Add** to add your **EDPModeID** info.
+
+5. In the **OMA-URI Settings** area, type the following info:
+
+ - **Setting name.** Type **EDPModeID** as the name.
+
+ - **Data type.** Pick the **String** data type.
+
+ - **OMA-URI.** Type `./Vendor/MSFT/VPNv2//EDPModeId`, replacing <*VPNProfileName*> with the name you gave to your VPN policy. For example, `./Vendor/MSFT/VPNv2/W10-Checkpoint-VPN1/EDPModeId`.
+
+ - **Value.** Your fully-qualified domain that should be used by the OMA-URI setting.
+
+ 
+
+6. Click **OK** to save your new OMA-URI setting, and then click **Save Policy.**
+
+ **To deploy your linked policy**
+
+1. On the **Configuration policies** page, locate your newly-created policy, click to select it, and then click the **Manage Deployment** button.
+
+2. In the left pane of the **Manage Deployment** box, click the employees or groups that should get the policy, and then click **Add**. The added people move to the **Selected Groups** list on the right-hand pane.
+
+ 
+
+3. After you've picked all of the employees and groups that should get the policy, click **OK**. The policy is deployed to the selected users' devices.
>[!NOTE]
->Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).
-
-
-
-
-
+>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).
\ No newline at end of file