cookbook update

education/windows/TOC.yml

@@ -17,8 +17,7 @@ items:
       - name: Settings and CSP list
         href: windows-11-se-settings-list.md
     - name: Windows in S Mode
-      items: 
+      items:
-      - name: Overview
       - name: Test Windows 10 in S mode on existing Windows 10 education devices
         href: test-windows10s-for-edu.md
       - name: Enable Windows 10 in S mode on Surface Go devices

education/windows/index.yml

@@ -1,7 +1,7 @@
 ### YamlMime:Landing
 
 title: Windows for Education # < 60 chars
-summary: Built with Zero Trust principles... BLURB TO UPDATE  # < 160 chars
+summary: Evaluate, plan, deploy, and manage Windows devices in an education environment. # < 160 chars
 
 metadata:
   title: Windows security # Required; page title displayed in search results. Include the brand. < 60 chars.

education/windows/tutorial-school-deployment/configure-device-apps.md

@@ -4,7 +4,7 @@ description: Configure applications with Microsoft Intune in preparation to devi
 ms.date: 08/31/2022
 ms.prod: windows
 ms.technology: windows
-ms.topic: conceptual #reference troubleshooting how-to end-user-help overview (more in contrib guide)
+ms.topic: tutorial
 ms.localizationpriority: medium
 author: paolomatarazzo
 ms.author: paoloma

education/windows/tutorial-school-deployment/configure-device-settings.md

@@ -4,7 +4,7 @@ description: Configure policies with Microsoft Intune in preparation to device d
 ms.date: 08/31/2022
 ms.prod: windows
 ms.technology: windows
-ms.topic: conceptual #reference troubleshooting how-to end-user-help overview (more in contrib guide)
+ms.topic: tutorial
 ms.localizationpriority: medium
 author: paolomatarazzo
 ms.author: paoloma

education/windows/tutorial-school-deployment/configure-devices-overview.md

@@ -4,7 +4,7 @@ description: Configure policies and applications in preparation to device deploy
 ms.date: 08/31/2022
 ms.prod: windows
 ms.technology: windows
-ms.topic: conceptual #reference troubleshooting how-to end-user-help overview (more in contrib guide)
+ms.topic: tutorial
 ms.localizationpriority: medium
 author: paolomatarazzo
 ms.author: paoloma
@@ -36,15 +36,18 @@ By organizing devices, students, classrooms, or learning curricula into groups,
 By default, Intune for Education creates two default groups: *All devices* and *All users*.
 Two additional groups are pre-created if you use **Microsoft School Data Sync (SDS)**: *All teachers* and *All students*. SDS can also be configured to automatically create and maintain groups of students and teachers for each school.
 
-:::image type="content" source="./images/intune-education-groups.png" alt-text="Intune for Education - Groups blade" border="false":::
+:::image type="content" source="./images/intune-education-groups.png" alt-text="Intune for Education - Groups blade" border="true":::
 
-Beyond the defaults, groups can be customized to suit various needs. For example, if you have both Windows and iPad devices in your school, you can create groups, such as *All Windows devices* and *All iPad devices*, to assign policies and applications to.
+Beyond the defaults, groups can be customized to suit various needs. For example, if you have both *Windows 10* and *Windows 11 SE* devices in your school, you can create groups, such as *Windows 10 devices* and *Windows 11 SE devices*, to assign different policies and applications to.
 
 Two group types can be created:
 
 - **Assigned groups** are used when you want to manually add users or devices to a group
 - **Dynamic groups** reference rules that you create to assign students or devices to groups, which automate the membership's maintenance of those groups
 
+> [!TIP]
+> If you target applications and policies to a *device dynamic group*, they will be applied to the devices as soon as they are enrolled in Intune, before users signs in. This can be useful in bulk enrollment scenarios, where devices are enrolled without requiring users to sign in. Devices can be configured and prepared in advance, before distribution.
+
 For more information, see:
 
 - [Create groups in Intune for Education][EDU-1]

education/windows/tutorial-school-deployment/enroll-aadj.md

@@ -4,7 +4,7 @@ description: how to join Azure AD for OOBE and automatically get the device enro
 ms.date: 08/31/2022
 ms.prod: windows
 ms.technology: windows
-ms.topic: conceptual #reference troubleshooting how-to end-user-help overview (more in contrib guide)
+ms.topic: tutorial
 ms.localizationpriority: medium
 author: paolomatarazzo
 ms.author: paoloma

education/windows/tutorial-school-deployment/enroll-autopilot.md

@@ -1,10 +1,10 @@
 ---
-title: Windows Autopilot
+title: Enrollment in Intune with Windows Autopilot
-description: Windows Autopilot
+description: how to join Azure AD and enroll in Intune using Windows Autopilot
 ms.date: 08/31/2022
 ms.prod: windows
 ms.technology: windows
-ms.topic: conceptual #reference troubleshooting how-to end-user-help overview (more in contrib guide)
+ms.topic: tutorial
 ms.localizationpriority: medium
 author: paolomatarazzo
 ms.author: paoloma
@@ -19,9 +19,9 @@ appliesto:
 
 # Windows Autopilot
 
-Windows Autopilot is designed to simplify all parts of the lifecycle of Windows devices, for both IT and end users, from initial deployment through the eventual end of life. Leveraging cloud-based services, it can reduce the overall costs for deploying, managing, and retiring devices by reducing the amount of time that IT needs to spend on these processes and the amount of infrastructure that they need to maintain, while ensuring ease of use for all types of end users.
+Windows Autopilot is designed to simplify all parts of Windows devices lifecycle, from initial deployment through end of life. Using cloud-based services, Windows Autopilot can reduce the overall costs for deploying, managing, and retiring devices.
 
-Traditionally, IT pros spend a lot of time building and customizing images that will later be deployed to devices. Windows Autopilot introduces a new, simplified approach. Devices do not need to be re-imaged, rather they can be deployed with the OEM image, and customized using cloud-based services.
+Traditionally, IT pros spend a significant amount of time building and customizing images that will later be deployed to devices. Windows Autopilot introduces a new, simplified approach. Devices don't need to be reimaged, rather they can be deployed with the OEM image, and customized using cloud-based services.
 
 From the user's perspective, it only takes a few simple operations to make their device ready to use. The only interaction required from the end user is to set their language and regional settings, connect to a network, and verify their credentials. Everything beyond that is automated.
 
@@ -30,7 +30,7 @@ From the user's perspective, it only takes a few simple operations to make their
 Before setting up Windows Autopilot, consider these prerequisites:
 
 - **Software requirements.** Ensure your school and devices meet the [software, networking, licensing, and configuration requirements][WIN-1] for Windows Autopilot
-- **Devices ordered and registered.** Ensure your school IT administrator or Microsoft partner has ordered the devices from an original equipment manufacturer (OEM) and registered them for the Autopilot deployment service. We recommend that you connect with a partner through the [Microsoft Partner Center][MSFT-1] and work with them to register your devices
+- **Devices ordered and registered.** Ensure your school IT administrator or Microsoft partner has ordered the devices from an original equipment manufacturer (OEM) and registered them for the Autopilot deployment service. To connect with a partner, you can use the [Microsoft Partner Center][MSFT-1] and work with them to register your devices
 - **Networking requirements.** Ensure students know to connect to the school network during OOBE setup. For more information on managing devices behind firewalls and proxy servers, see [Network endpoints for Microsoft Intune][MEM-1]
 
 > [!NOTE]
@@ -38,7 +38,7 @@ Before setting up Windows Autopilot, consider these prerequisites:
 
 ## Register devices to Windows Autopilot
 
-Before deployment, devices must be registered in the Windows Autopilot service. Each device's unique hardware identity (known as a *hardware hash*) must be uploaded to the Autopilot service, so that the Autopilot service can recognize which tenant devices belong to and which OOBE experience they should offer to the users. There are three main ways to register devices to Autopilot:
+Before deployment, devices must be registered in the Windows Autopilot service. Each device's unique hardware identity (known as a *hardware hash*) must be uploaded to the Autopilot service. In this way, the Autopilot service can recognize which tenant devices belong to, and which OOBE experience it should present. There are three main ways to register devices to Autopilot:
 
 - **OEM registration process.** When you purchase devices from an OEM or Reseller, that company can automatically register devices to Windows Autopilot and associate them to your tenant. Before this registration can happen, a *Global Administrator* must grant the OEM/Reseller permissions to register devices. For more information, see [OEM registration][MEM-2]
     > [!NOTE]
@@ -53,7 +53,7 @@ Before deployment, devices must be registered in the Windows Autopilot service.
 ## Create groups for Autopilot devices
 
 **Windows Autopilot deployment profiles** determine the Autopilot *deployment mode* and define the out-of-box experience of your devices. A device group is required to assign a Windows Autopilot deployment profile to the devices.
-For this task, it is recommended to create dynamic device groups using Autopilot attributes.
+For this task, it's recommended to create dynamic device groups using Autopilot attributes.
 
 Here are the steps for creating a dynamic group for the devices that have an assigned Autopilot group tag:
 
@@ -62,7 +62,7 @@ Here are the steps for creating a dynamic group for the devices that have an ass
 1. Specify a **Group name** and select **Dynamic**
 1. Under **Rules**, select **I want to manage: Devices** and use the clause **Where: Device group tag starts with**, specifying the required tag value
 1. Select **Create group**
-    :::image type="content" source="./images/intune-education-autopilot-group.png" alt-text="Intune for Education - creation of a dynamic group for Autopilot devices" border="false":::
+    :::image type="content" source="./images/intune-education-autopilot-group.png" alt-text="Intune for Education - creation of a dynamic group for Autopilot devices" border="true":::
 
 More advanced dynamic membership rules can be created from Microsoft Endpoint Manager admin center. For more information, see [Create an Autopilot device group using Intune][MEM-3].
 
@@ -74,7 +74,7 @@ More advanced dynamic membership rules can be created from Microsoft Endpoint Ma
 For Autopilot devices to offer a customized OOBE experience, you must create **Windows Autopilot deployment profiles** and assign them to a group containing the devices.
 A deployment profile is a collection of settings that determine the behavior of the device during OOBE. Among other settings, a deployment profile specifies a **deployment mode**, which can either be:
 1. **User-driven:** devices with this profile are associated with the user enrolling the device. User credentials are required to complete the Azure AD join process during OOBE
-1. **Self-deploying:** devices with this profile are not associated with the user enrolling the device. User credentials are not required to complete the Azure AD join process. Rather, the device is joined automatically and, for this reason, specific hardware requirements must be met to use this mode.
+1. **Self-deploying:** devices with this profile aren't associated with the user enrolling the device. User credentials aren't required to complete the Azure AD join process. Rather, the device is joined automatically and, for this reason, specific hardware requirements must be met to use this mode.
 
 To create an Autopilot deployment profile:
 
@@ -91,27 +91,36 @@ While Intune for Education offers simple options for Autopilot configurations, m
 ### Configure an Enrollment Status Page
 
 An Enrollment Status Page (ESP) is a greeting page displayed to users while enrolling or signing in for the first time to Windows devices. The ESP displays provisioning progress, showing applications and profiles installation status.
-Some Windows Autopilot deployment profiles require the ESP to be configured.
+
+:::image type="content" source="./images/win11-oobe-esp.png" alt-text="Windows OOBE - enrollment status page" border="false":::
+
+> [!NOTE]
+> Some Windows Autopilot deployment profiles **require** the ESP to be configured.
 
 To deploy the ESP to devices, you need to create an ESP profile in Microsoft Endpoint Manager.
 
-:::image type="content" source="./images/win11-oobe-esp.png" alt-text="Windows OOBE - enrollment status page" border="false":::
+> [!TIP]
+> While testing the deployment process, you can configure the ESP to:
+> - allow the reset of the devices in case the installation fails
+> - allow the use of the  device if installation error occurs
+>
+> This enables you to troubleshoot the installation process in case any issues arise and to easily reset the OS. You can turn these settings off once you are done testing.
 
 For more information, see [Set up the Enrollment Status Page][MEM-3].
 
 > [!CAUTION]
-> When targeting an ESP to **Windows 11 SE devices**, only approved apps should be included as part of the ESP configuration.
+> When targeting an ESP to **Windows 11 SE** devices, only applications included in the [<u>approved app list</u>][EDU-1] should part of the ESP configuration.
 
 ### Autopilot end-user experience
 
-Once configuration is complete and devices are distributed, students and teachers are able to complete the out-of-box experience with Autopilot. They can set up their devices at home, at school, or wherever there is a reliable Internet connection.
+Once configuration is complete and devices are distributed, students and teachers are able to complete the out-of-box experience with Autopilot. They can set up their devices at home, at school, or wherever there's a reliable Internet connection.
 When a Windows device is turned on for the first time, the end-user experience with Windows Autopilot is as follows:
 
 1. Identify the language and region
 1. Select the keyboard layout and decide on the option for a second keyboard layout
 1. Connect to the internet: if connecting through Wi-Fi, the user will be prompted to connect to a wireless network. If the device is connected through an ethernet cable, Windows will skip this step
 1. Apply updates: the device will look for and apply required updates
-1. Windows will detect if the device has an Autopilot profile assigned to it. If so, it will proceed with the customized OOBE experience. If the Autopilot profile specifies a naming convention for the device, the device will be renamed and a reboot will occur
+1. Windows will detect if the device has an Autopilot profile assigned to it. If so, it will proceed with the customized OOBE experience. If the Autopilot profile specifies a naming convention for the device, the device will be renamed, and a reboot will occur
 1. The user authenticates to Azure AD, using the school account
 1. The device joins Azure AD, enrolls in Intune and all the settings and applications are configured
 
@@ -143,6 +152,7 @@ With the devices joined to Azure AD tenant and managed by Intune, you can use In
 
 [M365-1]: https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2
 
+[EDU-1]: /education/windows/windows-11-se-overview
 [EDU-2]: /intune-education/windows-11-se-overview#windows-autopilot
 
 [SURF-1]: /surface/surface-autopilot-registration-support

education/windows/tutorial-school-deployment/enroll-package.md

@@ -1,10 +1,10 @@
 ---
 title: Enrollment of Windows devices with provisioning packages
-description: options how to enroll Windows devices with provisioning packages, using Set 
+description: options how to enroll Windows devices with provisioning packages using SUSPCs and Windows Configuration Designer
 ms.date: 08/31/2022
 ms.prod: windows
 ms.technology: windows
-ms.topic: conceptual
+ms.topic: tutorial
 ms.localizationpriority: medium
 author: paolomatarazzo
 ms.author: paoloma
@@ -22,14 +22,14 @@ appliesto:
 Enrolling devices with provisioning packages is an efficient way to deploy a large number of Windows devices. Some of the benefits of provisioning packages are:
 
 - There are no particular hardware dependencies on the devices to complete the enrollment process
-- Devices do not need to be registered in advance
+- Devices don't need to be registered in advance
 - Enrollment is a simple task: just open a provisioning package and the process is automated
 
 You can create provisioning packages using either **Set Up School PCs** or **Windows Configuration Designer** applications, which are described in the following sections.
 
 ## Set up School PCs
 
-With a guided experience, Set up School PCs app helps an IT administrator to create a package containing the most common features and settings that students need, and enroll the devices in Intune. The package is saved on a USB stick, which can then be plugged into devices during OOBE to complete the enrollment process.
+With Set up School PCs, you can create a package containing the most common device configurations that students need, and enroll devices in Intune. The package is saved on a USB stick, which can then be plugged into devices during OOBE. Applications and settings will be automatically applied to the devices, including the Azure AD join and Intune enrollment process.
 
 ### Create a provisioning package
 
@@ -37,10 +37,10 @@ The Set Up School PCs app guides you through configuration choices for school-ow
 
 :::image type="content" source="./images/supcs-win11se.png" alt-text="Configure device settings in Set Up School PCs app" border="false":::
 
-> [!IMPORTANT]
+> [!CAUTION]
 > If you are creating a provisioning package for **Windows 11 SE** devices, ensure to select the correct *OS version* in the *Configure device settings* page.
 
-Note that the Set Up School PCs app will configure many settings, allowing you to optimize devices for shared use and other scenarios.
+Set Up School PCs will configure many settings, allowing you to optimize devices for shared use and other scenarios.
 
 For more information on prerequisites, configuration, and recommendations, see [Use the Set Up School PCs app][EDU-1].
 

education/windows/tutorial-school-deployment/manage-inventory-reporting.md

@@ -4,7 +4,7 @@ description: Device inventory and reporting
 ms.date: 08/31/2022
 ms.prod: windows
 ms.technology: windows
-ms.topic: conceptual #reference troubleshooting how-to end-user-help overview (more in contrib guide)
+ms.topic: tutorial
 ms.localizationpriority: medium
 author: paolomatarazzo
 ms.author: paoloma

education/windows/tutorial-school-deployment/manage-overview.md

@@ -4,7 +4,7 @@ description: Manage devices with Microsoft Intune
 ms.date: 08/31/2022
 ms.prod: windows
 ms.technology: windows
-ms.topic: conceptual #reference troubleshooting how-to end-user-help overview (more in contrib guide)
+ms.topic: tutorial
 ms.localizationpriority: medium
 author: paolomatarazzo
 ms.author: paoloma
@@ -14,12 +14,15 @@ ms.collection: education
 appliesto:
 - ✅ <b>Windows 10</b>
 - ✅ <b>Windows 11</b>
+- ✅ <b>Windows 11 SE</b>
 ---
 
 # Manage devices with Microsoft Intune
 
 Microsoft Intune delivers streamlined remote management throughout the school year, giving IT the ability to manage apps, control security and privacy remotely, and generate compliance reports.
 
+:::image type="content" source="./images/protect-manage.png" alt-text="The device lifecycle for Intune-managed devices - protect and manage devices" border="false":::
+
 ## Remote device management
 
 With Intune for Education, you can manage groups, applications, resources, and individual needs of multiple students. There are several ways to manage students' devices, including organizing what groups they belong to; determining what apps they have access to; and configuring device settings, customizations, and restrictions. You can also monitor when users sign in and troubleshoot devices remotely.
@@ -108,18 +111,4 @@ To access and use the Surface Management Portal:
 
 To see the device's warranty information, select **Device warranty and coverage**.
 
-5. To see support requests and their status, select **Support requests**.
+5. To see support requests and their status, select **Support requests**.
-
-
-## Autopilot motherboard replacement
-
-Repairing Autopilot-enrolled devices can be complex, as OEM requirements must be balanced with Autopilot requirements. If a motherboard replacement is needed on an Autopilot device, we recommend the following process:
-
-1. [Deregister the device](/mem/autopilot/autopilot-mbr) from Autopilot.
-1. [Replace the motherboard](/mem/autopilot/autopilot-mbr).
-1. [Capture a new device ID (4K HH)](/mem/autopilot/autopilot-mbr).
-1. [Reregister the device](/mem/autopilot/autopilot-mbr) with Autopilot. **NOTE:** For DFCI management, the device must be reregistered by a partner or OEM. Self-registration of devices is not supported with DFCI management.
-1. [Reset the device](/mem/autopilot/autopilot-mbr).
-1. [Return the device](/mem/autopilot/autopilot-mbr).
-
-For more information, see [Autopilot motherboard replacement scenario guidance](/mem/autopilot/autopilot-mbr).

education/windows/tutorial-school-deployment/manage-remote-actions.md

@@ -4,7 +4,7 @@ description: Microsoft Endpoint Manager support
 ms.date: 08/31/2022
 ms.prod: windows
 ms.technology: windows
-ms.topic: conceptual #reference troubleshooting how-to end-user-help overview (more in contrib guide)
+ms.topic: tutorial
 ms.localizationpriority: medium
 author: paolomatarazzo
 ms.author: paoloma

education/windows/tutorial-school-deployment/microsoft-education.md

@@ -4,7 +4,7 @@ description: overview of Microsoft Education
 ms.date: 08/31/2022
 ms.prod: windows
 ms.technology: windows
-ms.topic: conceptual #reference troubleshooting how-to end-user-help overview (more in contrib guide)
+ms.topic: conceptual
 ms.localizationpriority: medium
 author: paolomatarazzo
 ms.author: paoloma

education/windows/tutorial-school-deployment/reset-wipe.md

@@ -4,7 +4,7 @@ description: reset and wipe
 ms.date: 08/31/2022
 ms.prod: windows
 ms.technology: windows
-ms.topic: conceptual #reference troubleshooting how-to end-user-help overview (more in contrib guide)
+ms.topic: tutorial
 ms.localizationpriority: medium
 author: paolomatarazzo
 ms.author: paoloma

education/windows/tutorial-school-deployment/set-up-azure-ad.md

@@ -4,7 +4,7 @@ description: How to create and prepare your Azure AD tenant for an education env
 ms.date: 08/31/2022
 ms.prod: windows
 ms.technology: windows
-ms.topic: conceptual
+ms.topic: tutorial
 ms.localizationpriority: medium
 author: paolomatarazzo
 ms.author: paoloma

education/windows/tutorial-school-deployment/set-up-microsoft-intune.md

@@ -4,7 +4,7 @@ description: How to configure the Intune service and set up the environment for
 ms.date: 08/31/2022
 ms.prod: windows
 ms.technology: windows
-ms.topic: conceptual
+ms.topic: tutorial
 ms.localizationpriority: medium
 author: paolomatarazzo
 ms.author: paoloma

education/windows/tutorial-school-deployment/troubleshoot-overview.md

@@ -36,5 +36,18 @@ Follow these steps to obtain support in Microsoft Endpoint Manager:
 
 For more information, see [Microsoft Endpoint Manager support page][MEM-1]
 
+## Autopilot motherboard replacement
+
+Repairing Autopilot-enrolled devices can be complex, as OEM requirements must be balanced with Autopilot requirements. If a motherboard replacement is needed on an Autopilot device, we recommend the following process:
+
+1. [Deregister the device](/mem/autopilot/autopilot-mbr) from Autopilot.
+1. [Replace the motherboard](/mem/autopilot/autopilot-mbr).
+1. [Capture a new device ID (4K HH)](/mem/autopilot/autopilot-mbr).
+1. [Reregister the device](/mem/autopilot/autopilot-mbr) with Autopilot. **NOTE:** For DFCI management, the device must be reregistered by a partner or OEM. Self-registration of devices is not supported with DFCI management.
+1. [Reset the device](/mem/autopilot/autopilot-mbr).
+1. [Return the device](/mem/autopilot/autopilot-mbr).
+
+For more information, see [Autopilot motherboard replacement scenario guidance](/mem/autopilot/autopilot-mbr).
+
 <!-- Reference links in article -->
 [MEM-1]: /mem/get-support