From 4657a7cbf4b4488187c89c811a8ed6b155b1cfcf Mon Sep 17 00:00:00 2001
From: JC <47532346+Jcoetsee@users.noreply.github.com>
Date: Tue, 26 Mar 2019 16:09:10 +0200
Subject: [PATCH] Update policy-csp-restrictedgroups.md

---
 .../mdm/policy-csp-restrictedgroups.md           | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/windows/client-management/mdm/policy-csp-restrictedgroups.md b/windows/client-management/mdm/policy-csp-restrictedgroups.md
index d31379fc55..271a9a0054 100644
--- a/windows/client-management/mdm/policy-csp-restrictedgroups.md
+++ b/windows/client-management/mdm/policy-csp-restrictedgroups.md
@@ -113,9 +113,15 @@ Here is an example:
 
 ```
 <groupmembership>
- <accessgroup desc="Group SID for Administrators">
-    <member name = "S-188-5-5666-5-688"/>
-  </accessgroup>
+    <accessgroup desc="Administrators">
+        <member name="AzureAD\CSPTest@contoso.com" />
+        <member name="CSPTest22306\administrator" />
+        <member name = "AzureAD\patlewis@contoso.com" />
+    </accessgroup>
+    <accessgroup desc = "testcsplocal">
+        <member name = "CSPTEST22306\patlewis" />
+        <member name = "AzureAD\CSPTest@contoso.com" />
+    </accessgroup>
 </groupmembership>
 ```
 <!--/Example-->
@@ -125,6 +131,10 @@ Here is an example:
 <!--/Policy-->
 <hr/>
 
+Take note:
+* You must include the local administrator in the administrators group or the policy will fail
+* Include the entire UPN after AzureAD
+
 Footnote:
 
 -   1 - Added in Windows 10, version 1607.