diff --git a/windows/configuration/assigned-access/assigned-access-configuration-file.md b/windows/configuration/assigned-access/assigned-access-configuration-file.md index 31856ba00e..c9ed3130d3 100644 --- a/windows/configuration/assigned-access/assigned-access-configuration-file.md +++ b/windows/configuration/assigned-access/assigned-access-configuration-file.md @@ -714,119 +714,17 @@ For more details, review the Assigned Access XSD reference article. This sample demonstrates that both UWP and Win32 apps can be configured to automatically launch, when Assigned Access account logs in. One profile can have at most one app configured for auto launch. AutoLaunchArguments are passed to the apps as is and the app needs to handle the arguments explicitly. -```xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - aauser1 - - - - aauser2 - - - - - -``` - -## Microsoft Edge Kiosk XML Sample - -```xml - - - - - - - - - - - - EdgeKioskUser - - - - -``` - -## `GlobalProfile` - -With `GlobalProfile` you can define a profile that will be applied to every non-admin account that signs in. This can be useful in scenarios like front line workers or student devices, where you want to ensure that every user has a consistent experience. - -This sample demonstrates that only a global profile is used, with no active user configured. Global Profile will be applied when every non-admin account signs in. - ```xml - - - - - - - - - - - - - -``` - -Below sample shows dedicated profile and global profile mixed usage, a user would use one profile, everyone else that's non-admin will use another profile. - -```xml - - - - - - - + @@ -846,9 +744,12 @@ Below sample shows dedicated profile and global profile mixed usage, a user woul - - aauser + aauser1 + + + + aauser2 @@ -856,173 +757,28 @@ Below sample shows dedicated profile and global profile mixed usage, a user woul ``` +## Examples -```xml - - - - - - - - - - - - - - - - - - - - - - - - - -``` +### Kiosk - Microsoft Edge +[!INCLUDE [assigned-access-example-kiosk-edge](includes/assigned-access-example-kiosk-edge.md)] +### Kiosk - Global profile +With `GlobalProfile` you can define an Assigned Access profile that is applied to every non-admin account that signs in. This can be useful in scenarios like front line workers or student devices, where you want to ensure that every user has a consistent experience. -## Folder Access sample xml +The following configuration demonstrates that only a global profile is used, with no user configured. + +[!INCLUDE [assigned-access-example-global-profile](includes/assigned-access-example-global-profile.md)] + +> [!NOTE] +> You can combine a global profile with other profiles. If you assign a user a non-global profile, the global profile won't be applied to that user. + +## File Explorer restrictions Folder access is locked down so that when common file dialog is opened, IT Admin can specify if the user has access to the Downloads folder, or no access to any folder at all. You can specify user access to Downloads folder, Removable drives, or no restrictions at all. Downloads and Removable Drives can be allowed at the same time. -```xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - multi1 - - - - multi2 - - - - multi3 - - - - multi4 - - - - multi5 - - - - multi6 - - - - +[!INCLUDE [assigned-access-example-file-explorer-restrictions](includes/assigned-access-example-file-explorer-restrictions.md)] -``` - -To authorize a compatible configuration XML that includes elements and attributes from Windows 10 version 1809 or newer / Windows 11, always include the namespace of these add-on schemas, and decorate the attributes and elements accordingly with the namespace alias. - -For example, to configure the autolaunch feature that was added in Windows 10 version 1809 / Windows 11, use the following sample. Notice an alias r1809 is given to the 201810 namespace for Windows 10 version 1809 / Windows 11, and the alias is tagged on AutoLaunch and AutoLaunchArguments inline. - -## Single app Assigned Access XML example - -## Multi-app Assigned Access XML example diff --git a/windows/configuration/assigned-access/images/settings-choose-app.png b/windows/configuration/assigned-access/images/settings-choose-app.png index 62d64ce232..f73c6083d5 100644 Binary files a/windows/configuration/assigned-access/images/settings-choose-app.png and b/windows/configuration/assigned-access/images/settings-choose-app.png differ diff --git a/windows/configuration/assigned-access/includes/assigned-access-example-file-explorer-restrictions.md b/windows/configuration/assigned-access/includes/assigned-access-example-file-explorer-restrictions.md new file mode 100644 index 0000000000..e202e7a1c8 --- /dev/null +++ b/windows/configuration/assigned-access/includes/assigned-access-example-file-explorer-restrictions.md @@ -0,0 +1,62 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 02/05/2024 +ms.topic: include +--- + + + +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ]]> + + + + + + + + + + + +``` diff --git a/windows/configuration/assigned-access/includes/assigned-access-example-global-profile.md b/windows/configuration/assigned-access/includes/assigned-access-example-global-profile.md new file mode 100644 index 0000000000..493ce4f0ef --- /dev/null +++ b/windows/configuration/assigned-access/includes/assigned-access-example-global-profile.md @@ -0,0 +1,51 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 02/05/2024 +ms.topic: include +--- + + + +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + +``` diff --git a/windows/configuration/assigned-access/includes/assigned-access-example-kiosk-edge.md b/windows/configuration/assigned-access/includes/assigned-access-example-kiosk-edge.md new file mode 100644 index 0000000000..c69151effd --- /dev/null +++ b/windows/configuration/assigned-access/includes/assigned-access-example-kiosk-edge.md @@ -0,0 +1,28 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 02/05/2024 +ms.topic: include +--- + + + +```xml + + + + + + + + + + + Edge kiosk + + + + +``` diff --git a/windows/configuration/assigned-access/includes/assigned-access-example-kiosk-uwp.md b/windows/configuration/assigned-access/includes/assigned-access-example-kiosk-uwp.md new file mode 100644 index 0000000000..57a8fd7018 --- /dev/null +++ b/windows/configuration/assigned-access/includes/assigned-access-example-kiosk-uwp.md @@ -0,0 +1,24 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 02/05/2024 +ms.topic: include +--- + + + +```xml + + + + + + + + + Weather app + + + + +``` diff --git a/windows/configuration/assigned-access/includes/assigned-access-example-two-profiles.md b/windows/configuration/assigned-access/includes/assigned-access-example-two-profiles.md new file mode 100644 index 0000000000..6a05e36828 --- /dev/null +++ b/windows/configuration/assigned-access/includes/assigned-access-example-two-profiles.md @@ -0,0 +1,60 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 02/05/2024 +ms.topic: include +--- + + + +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + Weather app + + + + Library Kiosk + + + + +``` diff --git a/windows/configuration/assigned-access/includes/assigned-access-quickstart-kiosk-intune.md b/windows/configuration/assigned-access/includes/assigned-access-quickstart-kiosk-intune.md index dbe8a4d3a0..8d9a12c9f0 100644 --- a/windows/configuration/assigned-access/includes/assigned-access-quickstart-kiosk-intune.md +++ b/windows/configuration/assigned-access/includes/assigned-access-quickstart-kiosk-intune.md @@ -3,7 +3,6 @@ author: paolomatarazzo ms.author: paoloma ms.date: 02/05/2024 ms.topic: include -ms.prod: windows-client --- ```msgraph-interactive diff --git a/windows/configuration/assigned-access/includes/assigned-access-quickstart-kiosk-ps.md b/windows/configuration/assigned-access/includes/assigned-access-quickstart-kiosk-ps.md index 6a9f83025a..ad66e9a20d 100644 --- a/windows/configuration/assigned-access/includes/assigned-access-quickstart-kiosk-ps.md +++ b/windows/configuration/assigned-access/includes/assigned-access-quickstart-kiosk-ps.md @@ -3,7 +3,6 @@ author: paolomatarazzo ms.author: paoloma ms.date: 02/05/2024 ms.topic: include -ms.prod: windows-client --- ```powershell diff --git a/windows/configuration/assigned-access/includes/assigned-access-quickstart-kiosk-xml.md b/windows/configuration/assigned-access/includes/assigned-access-quickstart-kiosk-xml.md index cfa269931e..1824fa971c 100644 --- a/windows/configuration/assigned-access/includes/assigned-access-quickstart-kiosk-xml.md +++ b/windows/configuration/assigned-access/includes/assigned-access-quickstart-kiosk-xml.md @@ -3,7 +3,6 @@ author: paolomatarazzo ms.author: paoloma ms.date: 02/05/2024 ms.topic: include -ms.prod: windows-client --- ```xml diff --git a/windows/configuration/assigned-access/includes/assigned-access-quickstart-restricted-experience-intune-10.md b/windows/configuration/assigned-access/includes/assigned-access-quickstart-restricted-experience-intune-10.md index b09e5a66dd..24c674fcd1 100644 --- a/windows/configuration/assigned-access/includes/assigned-access-quickstart-restricted-experience-intune-10.md +++ b/windows/configuration/assigned-access/includes/assigned-access-quickstart-restricted-experience-intune-10.md @@ -3,7 +3,6 @@ author: paolomatarazzo ms.author: paoloma ms.date: 02/05/2024 ms.topic: include -ms.prod: windows-client --- ```msgraph-interactive diff --git a/windows/configuration/assigned-access/includes/assigned-access-quickstart-restricted-experience-intune-11.md b/windows/configuration/assigned-access/includes/assigned-access-quickstart-restricted-experience-intune-11.md index cdd0da6fb2..fa89d14b4b 100644 --- a/windows/configuration/assigned-access/includes/assigned-access-quickstart-restricted-experience-intune-11.md +++ b/windows/configuration/assigned-access/includes/assigned-access-quickstart-restricted-experience-intune-11.md @@ -3,7 +3,6 @@ author: paolomatarazzo ms.author: paoloma ms.date: 02/05/2024 ms.topic: include -ms.prod: windows-client --- ```msgraph-interactive diff --git a/windows/configuration/assigned-access/includes/assigned-access-quickstart-restricted-experience-ps-10.md b/windows/configuration/assigned-access/includes/assigned-access-quickstart-restricted-experience-ps-10.md index 8e9345b7ff..b6747b82fa 100644 --- a/windows/configuration/assigned-access/includes/assigned-access-quickstart-restricted-experience-ps-10.md +++ b/windows/configuration/assigned-access/includes/assigned-access-quickstart-restricted-experience-ps-10.md @@ -3,7 +3,6 @@ author: paolomatarazzo ms.author: paoloma ms.date: 02/05/2024 ms.topic: include -ms.prod: windows-client --- ```powershell diff --git a/windows/configuration/assigned-access/includes/assigned-access-quickstart-restricted-experience-ps-11.md b/windows/configuration/assigned-access/includes/assigned-access-quickstart-restricted-experience-ps-11.md index fdf12e7a24..63d7e42d6e 100644 --- a/windows/configuration/assigned-access/includes/assigned-access-quickstart-restricted-experience-ps-11.md +++ b/windows/configuration/assigned-access/includes/assigned-access-quickstart-restricted-experience-ps-11.md @@ -3,7 +3,6 @@ author: paolomatarazzo ms.author: paoloma ms.date: 02/05/2024 ms.topic: include -ms.prod: windows-client --- ```powershell diff --git a/windows/configuration/assigned-access/includes/assigned-access-quickstart-restricted-experience-xml-10.md b/windows/configuration/assigned-access/includes/assigned-access-quickstart-restricted-experience-xml-10.md index ce71f0a134..33c7a95b9f 100644 --- a/windows/configuration/assigned-access/includes/assigned-access-quickstart-restricted-experience-xml-10.md +++ b/windows/configuration/assigned-access/includes/assigned-access-quickstart-restricted-experience-xml-10.md @@ -3,7 +3,6 @@ author: paolomatarazzo ms.author: paoloma ms.date: 02/05/2024 ms.topic: include -ms.prod: windows-client --- ```xml diff --git a/windows/configuration/assigned-access/includes/assigned-access-quickstart-restricted-experience-xml-11.md b/windows/configuration/assigned-access/includes/assigned-access-quickstart-restricted-experience-xml-11.md index cfc07c38fc..7aace4d399 100644 --- a/windows/configuration/assigned-access/includes/assigned-access-quickstart-restricted-experience-xml-11.md +++ b/windows/configuration/assigned-access/includes/assigned-access-quickstart-restricted-experience-xml-11.md @@ -3,7 +3,6 @@ author: paolomatarazzo ms.author: paoloma ms.date: 02/05/2024 ms.topic: include -ms.prod: windows-client --- ```xml diff --git a/windows/configuration/assigned-access/includes/quickstart-shell-launcher-xml.md b/windows/configuration/assigned-access/includes/quickstart-shell-launcher-xml.md index 85d730dcb0..9670bbe38b 100644 --- a/windows/configuration/assigned-access/includes/quickstart-shell-launcher-xml.md +++ b/windows/configuration/assigned-access/includes/quickstart-shell-launcher-xml.md @@ -3,7 +3,6 @@ author: paolomatarazzo ms.author: paoloma ms.date: 02/05/2024 ms.topic: include -ms.prod: windows-client --- ```xml diff --git a/windows/configuration/assigned-access/includes/shell-launcher-quickstart-intune.md b/windows/configuration/assigned-access/includes/shell-launcher-quickstart-intune.md index 2c5922c1ef..01925a8285 100644 --- a/windows/configuration/assigned-access/includes/shell-launcher-quickstart-intune.md +++ b/windows/configuration/assigned-access/includes/shell-launcher-quickstart-intune.md @@ -3,7 +3,6 @@ author: paolomatarazzo ms.author: paoloma ms.date: 02/05/2024 ms.topic: include -ms.prod: windows-client --- ```msgraph-interactive diff --git a/windows/configuration/assigned-access/includes/shell-launcher-quickstart-ps.md b/windows/configuration/assigned-access/includes/shell-launcher-quickstart-ps.md index f3133df6d5..e660b8a458 100644 --- a/windows/configuration/assigned-access/includes/shell-launcher-quickstart-ps.md +++ b/windows/configuration/assigned-access/includes/shell-launcher-quickstart-ps.md @@ -3,7 +3,6 @@ author: paolomatarazzo ms.author: paoloma ms.date: 02/05/2024 ms.topic: include -ms.prod: windows-client --- ```PowerShell diff --git a/windows/configuration/assigned-access/includes/shell-launcher-quickstart-xml.md b/windows/configuration/assigned-access/includes/shell-launcher-quickstart-xml.md index b4e15a314b..f126949118 100644 --- a/windows/configuration/assigned-access/includes/shell-launcher-quickstart-xml.md +++ b/windows/configuration/assigned-access/includes/shell-launcher-quickstart-xml.md @@ -3,7 +3,6 @@ author: paolomatarazzo ms.author: paoloma ms.date: 02/05/2024 ms.topic: include -ms.prod: windows-client --- ```xml diff --git a/windows/configuration/assigned-access/index.md b/windows/configuration/assigned-access/index.md index 6b10c47a99..19ee5f8831 100644 --- a/windows/configuration/assigned-access/index.md +++ b/windows/configuration/assigned-access/index.md @@ -7,33 +7,42 @@ ms.date: 02/26/2024 # Configure kiosks and restricted user experiences -Organization may want to set up special purpose devices, such as a device in the lobby that customers can use to view product catalogs, or a device displaying visual content as a digital sign. Windows client offers two different locked-down experiences for public or specialized use: +Organization may want to set up special purpose devices, such as a device in the lobby that customers can use to view product catalogs, or a device displaying visual content as a digital sign. Windows client offers two different experiences for public or specialized use: :::row::: :::column span="1"::: :::image type="content" source="images/kiosk.png" alt-text="Icon representing a kiosk." border="false"::: :::column-end::: :::column span="3"::: - #### Kiosk + #### Kiosk experience :::column-end::: :::row-end::: -Runs a single Universal Windows Platform (UWP) application in full screen above the lock screen. People using the kiosk can see only that app. When the kiosk account (a local standard user account) signs in, the kiosk app launches automatically. If the kiosk app is closed, it will automatically restart +This experience runs a single application in full screen, and people using the device can only use that app. When the designated kiosk account signs in, the kiosk app launches automatically. If the kiosk app is closed, it will automatically restart. This experience is sometimes referred to as *single-app kiosk*. + +Windows offers two different features to configure a kiosk experience: + +- **Assigned Access**: used to execute a single Universal Windows Platform (UWP) app or Microsoft Edge in full screen above the lock screen. When the kiosk account signs in, the kiosk app launches automatically. If the UWP app is closed, it will automatically restart +- **Shell Launcher**: used to configure a device to execure a Windows desktop application as the user interface. The application that you specify replaces the default Windows shell (`Explorer.exe`) that usually runs when a user signs in. This type of single-app kiosk doesn't run above the lock screen. :::row::: :::column span="1"::: :::image type="content" source="images/restricted-user-experience.png" alt-text="Icon representing a restricted user experience." border="false"::: :::column-end::: :::column span="3"::: - #### Restrictedd user experience + #### Restricted user experience :::column-end::: :::row-end::: -Runs one or more applications from the desktop. People using the kiosk see a customized Start menu that shows only the apps that are allowed to execute. With this approach, you can configure a locked-down experience for different account types. +This experience loads the Windows desktop, but it only allows to run a defined set of applications. When the designated user signs in, the user can only run the apps that are allowed. This experience is sometimes referred to as *multi-app kiosk*. The Start menu is customized to show only the apps that are allowed to execute. With this approach, you can configure a locked-down experience for different account types. + +To configure a restricted user experience you use a feature called **Assgined Access**. + +## Choose the right experience + + -## Kiosk -A single-app kiosk is ideal for public use. Using [Shell Launcher](kiosk-shelllauncher.md), you can configure a kiosk device that runs a Windows desktop application as the user interface. The application that you specify replaces the default shell (explorer.exe) that usually runs when a user signs in. This type of single-app kiosk doesn't run above the lock screen. A multi-app kiosk is appropriate for devices that are shared by multiple people. When you configure a multi-app kiosk, [specific policies are enforced](kiosk-policies.md) that affects **all** non-administrator users on the device.