From a8ac2c2e24dde3052424337fb00e45708f60af9e Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 14 Dec 2016 09:49:34 -0800 Subject: [PATCH 01/42] Adding new topic --- ...ended-office-365-configurations-for-wip.md | 23 +++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 windows/keep-secure/recommended-office-365-configurations-for-wip.md diff --git a/windows/keep-secure/recommended-office-365-configurations-for-wip.md b/windows/keep-secure/recommended-office-365-configurations-for-wip.md new file mode 100644 index 0000000000..15765e4001 --- /dev/null +++ b/windows/keep-secure/recommended-office-365-configurations-for-wip.md @@ -0,0 +1,23 @@ +--- +title: Recommended Office 365 Exchange Online and Outlook configuration with Windows Information Protection (WIP) (Windows 10) +description: Recommendations about how to configure Office 365 Exchange Online and Outlook while using Windows Information Protection (WIP). +ms.assetid: 6cca0119-5954-4757-b2bc-e0ea4d2c7032 +keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, configure Office 365 with WIP, WIP and Office 365 Mail +ms.prod: w10 +ms.mktglfcycl: explore +ms.sitesec: library +ms.pagetype: security +localizationpriority: high +--- + +# Recommended Office 365 Exchange Online and Outlook configuration with Windows Information Protection (WIP) +**Applies to:** + +- Windows 10, version 1607 +- Windows 10 Mobile + +>Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). + +Because Office 365 Exchange Online and Outlook can be used both personally and as part of your enterprise, we recommend the following configuration: + + From c31463c686270581f0de029370773593c1258727 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 14 Dec 2016 13:08:14 -0800 Subject: [PATCH 02/42] Added content --- ...ended-office-365-configurations-for-wip.md | 50 +++++++++++++++++-- 1 file changed, 46 insertions(+), 4 deletions(-) diff --git a/windows/keep-secure/recommended-office-365-configurations-for-wip.md b/windows/keep-secure/recommended-office-365-configurations-for-wip.md index 15765e4001..7b3e62ed95 100644 --- a/windows/keep-secure/recommended-office-365-configurations-for-wip.md +++ b/windows/keep-secure/recommended-office-365-configurations-for-wip.md @@ -1,6 +1,6 @@ --- -title: Recommended Office 365 Exchange Online and Outlook configuration with Windows Information Protection (WIP) (Windows 10) -description: Recommendations about how to configure Office 365 Exchange Online and Outlook while using Windows Information Protection (WIP). +title: Recommended Office 365 Mail and Calendar apps configuration with Windows Information Protection (WIP) (Windows 10) +description: Recommendations about how to configure Office 365 Mail and Calendar apps, including Outlook Web Access (OWA) and the various client apps, with Windows Information Protection (WIP). ms.assetid: 6cca0119-5954-4757-b2bc-e0ea4d2c7032 keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, configure Office 365 with WIP, WIP and Office 365 Mail ms.prod: w10 @@ -10,7 +10,7 @@ ms.pagetype: security localizationpriority: high --- -# Recommended Office 365 Exchange Online and Outlook configuration with Windows Information Protection (WIP) +# Recommended Office 365 Mail and Calendar apps configuration with Windows Information Protection (WIP) **Applies to:** - Windows 10, version 1607 @@ -18,6 +18,48 @@ localizationpriority: high >Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). -Because Office 365 Exchange Online and Outlook can be used both personally and as part of your enterprise, we recommend the following configuration: +Because the Office 365 Mail and Calendar apps, including Outlook Web Access (OWA) and the various client apps, can be used both personally and as part of your organization, we recommend the following configurations: + + + + + + + + + + + + + + + + + + + + + + + + +
OptionOWA behaviorOffice 365 behavior
Disable OWA. Employees can only use Microsoft Outlook 2016 or the Office 365 Mail app.Disabled.Both Outlook 2016 and the Office 365 Mail app behave properly, regardless of how you've configured outlook.office.com in your network settings.
An employee's mailbox is automatically marked as corporate data.
Don't configure outlook.office.com in any of your networking settings.All mailboxes are automatically marked as personal. This means employees attempting to copy work content into OWA receive prompts and that files downloaded from OWA aren't automatically protected as corporate data.
Do any of the following: +
    +
  • Create a domain (such as mail.contoso.com, redirecting to outlook.office.com) that can be used by your employees to access work email.
    • +
  • Add the new domain to the Enterprise Cloud Resources network element in your WIP policy.
    • +
  • Add the following URLs to the Neutral Resources network element in your WIP policy: +
      +
    • outlook.office365.com
      • +
    • outlook.office.com
      • +
    • outlook-sdf.office.com
      • +
    • attachment.outlook.office.net
      • +
    +
    • +
+ 		Inbox content accessed through the new domain is automatically marked as corporate data, while content accessed through personal email is automatically marked as personal.
Add outlook.office.com to the Enterprise Cloud Resources network element in your WIP policy.All mailboxes are automatically marked as work. This means any personal inboxes hosted on Office 365 are also automatically marked as corporate data.
+ + + + From 0d3b4bc505f49bbace9c88c80b5e35a196058628 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 14 Dec 2016 13:21:55 -0800 Subject: [PATCH 03/42] Adding content for new topic --- windows/keep-secure/TOC.md | 1 + .../change-history-for-keep-windows-10-secure.md | 6 ++++++ 2 files changed, 7 insertions(+) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index 0676b4a600..877577e1f7 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -34,6 +34,7 @@ ### [General guidance and best practices for Windows Information Protection (WIP)](guidance-and-best-practices-wip.md) #### [Mandatory tasks and settings required to turn on Windows Information Protection (WIP)](mandatory-settings-for-wip.md) #### [Enlightened apps for use with Windows Information Protection (WIP)](enlightened-microsoft-apps-and-wip.md) +#### [Recommended Office 365 Mail and Calendar apps configuration with Windows Information Protection (WIP)](recommended-office-365-configurations-for-wip.md) #### [Unenlightened and enlightened app behavior while using Windows Information Protection (WIP)](app-behavior-with-wip.md) #### [Testing scenarios for Windows Information Protection (WIP)](testing-scenarios-for-wip.md) #### [Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md) diff --git a/windows/keep-secure/change-history-for-keep-windows-10-secure.md b/windows/keep-secure/change-history-for-keep-windows-10-secure.md index 759d44b4af..10d1e0391a 100644 --- a/windows/keep-secure/change-history-for-keep-windows-10-secure.md +++ b/windows/keep-secure/change-history-for-keep-windows-10-secure.md @@ -12,6 +12,12 @@ author: brianlic-msft # Change history for Keep Windows 10 secure This topic lists new and updated topics in the [Keep Windows 10 secure](index.md) documentation for [Windows 10 and Windows 10 Mobile](../index.md). +## December 2016 +|New or changed topic |Description | +|---------------------|------------| +|[Recommended Office 365 Mail and Calendar apps configuration with Windows Information Protection (WIP)](recommended-office-365-configurations-for-wip.md) |New | + + ## November 2016 | New or changed topic | Description | | --- | --- | From 0af960919aad09541db1288a1033a530d03969fe Mon Sep 17 00:00:00 2001 From: LizRoss Date: Thu, 15 Dec 2016 07:10:52 -0800 Subject: [PATCH 04/42] Pulling topics into higher level for easier discoverability --- windows/keep-secure/TOC.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index 877577e1f7..069962cc43 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -32,12 +32,12 @@ #### [Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager](create-wip-policy-using-sccm.md) #### [Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md) ### [General guidance and best practices for Windows Information Protection (WIP)](guidance-and-best-practices-wip.md) -#### [Mandatory tasks and settings required to turn on Windows Information Protection (WIP)](mandatory-settings-for-wip.md) #### [Enlightened apps for use with Windows Information Protection (WIP)](enlightened-microsoft-apps-and-wip.md) #### [Recommended Office 365 Mail and Calendar apps configuration with Windows Information Protection (WIP)](recommended-office-365-configurations-for-wip.md) #### [Unenlightened and enlightened app behavior while using Windows Information Protection (WIP)](app-behavior-with-wip.md) -#### [Testing scenarios for Windows Information Protection (WIP)](testing-scenarios-for-wip.md) -#### [Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md) +### [Mandatory tasks and settings required to turn on Windows Information Protection (WIP)](mandatory-settings-for-wip.md) +### [Testing scenarios for Windows Information Protection (WIP)](testing-scenarios-for-wip.md) +### [Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md) ## [Use Windows Event Forwarding to help with intrusion detection](use-windows-event-forwarding-to-assist-in-instrusion-detection.md) ## [Override Process Mitigation Options to help enforce app-related security policies](override-mitigation-options-for-app-related-security-policies.md) ## [VPN technical guide](vpn-guide.md) From b9ea659603c2d30e7502eca74e504f7fd979cf1c Mon Sep 17 00:00:00 2001 From: LizRoss Date: Thu, 15 Dec 2016 07:23:07 -0800 Subject: [PATCH 05/42] Adding new, and moving around old, content --- .../guidance-and-best-practices-wip.md | 1 - ...recommended-network-definitions-for-wip.md | 23 +++++++++++++++++++ ...ended-office-365-configurations-for-wip.md | 3 +-- 3 files changed, 24 insertions(+), 3 deletions(-) create mode 100644 windows/keep-secure/recommended-network-definitions-for-wip.md diff --git a/windows/keep-secure/guidance-and-best-practices-wip.md b/windows/keep-secure/guidance-and-best-practices-wip.md index b91386f0c0..93a995e948 100644 --- a/windows/keep-secure/guidance-and-best-practices-wip.md +++ b/windows/keep-secure/guidance-and-best-practices-wip.md @@ -22,7 +22,6 @@ This section includes info about the enlightened Microsoft apps, including how t ## In this section |Topic |Description | |------|------------| -|[Windows Information Protection (WIP) overview](wip-enterprise-overview.md) |High-level overview info about why to use WIP, the enterprise scenarios, and how to turn it off. | |[Mandatory settings for Windows Information Protection (WIP)](mandatory-settings-for-wip.md) |A list of all of the tasks and settings that are required for the operating system to turn on Windows Information Protection (WIP), formerly known as enterprise data protection (EDP), in your enterprise. | |[Enlightened apps for use with Windows Information Protection (WIP)](enlightened-microsoft-apps-and-wip.md) |Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your allowed apps list. | |[Testing scenarios for Windows Information Protection (WIP)](testing-scenarios-for-wip.md) |We've come up with a list of suggested testing scenarios that you can use to test WIP in your company. | diff --git a/windows/keep-secure/recommended-network-definitions-for-wip.md b/windows/keep-secure/recommended-network-definitions-for-wip.md new file mode 100644 index 0000000000..f56c785ace --- /dev/null +++ b/windows/keep-secure/recommended-network-definitions-for-wip.md @@ -0,0 +1,23 @@ +--- +title: Recommended Enterprise Cloud and Neutral network settings with Windows Information Protection (WIP) (Windows 10) +description: Recommendations about additions to make to the Enterprise Cloud and Neutral network settings with Windows Information Protection (WIP). +keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, WIP and Neutral resources, WIP and Enterprise Cloud Resources +ms.prod: w10 +ms.mktglfcycl: explore +ms.sitesec: library +ms.pagetype: security +localizationpriority: high +--- + +# Recommended Enterprise Cloud and Neutral network settings with Windows Information Protection (WIP) + +**Applies to:** + +- Windows 10, version 1607 +- Windows 10 Mobile + +>Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). + +We recommend that you update your network settings for both the Enteprise Cloud and Neutral resources. + +## Recommended Enterprise Cloud Resources \ No newline at end of file diff --git a/windows/keep-secure/recommended-office-365-configurations-for-wip.md b/windows/keep-secure/recommended-office-365-configurations-for-wip.md index 7b3e62ed95..b243ede2f4 100644 --- a/windows/keep-secure/recommended-office-365-configurations-for-wip.md +++ b/windows/keep-secure/recommended-office-365-configurations-for-wip.md @@ -1,8 +1,7 @@ --- title: Recommended Office 365 Mail and Calendar apps configuration with Windows Information Protection (WIP) (Windows 10) description: Recommendations about how to configure Office 365 Mail and Calendar apps, including Outlook Web Access (OWA) and the various client apps, with Windows Information Protection (WIP). -ms.assetid: 6cca0119-5954-4757-b2bc-e0ea4d2c7032 -keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, configure Office 365 with WIP, WIP and Office 365 Mail +keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, WIP and Office 2016 configuration, WIP and Office 365 Mail app ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library From cd49604ff0e8e3da99275c2050a88cd7b80b1d18 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Thu, 15 Dec 2016 07:36:17 -0800 Subject: [PATCH 06/42] Adding new, and moving around old, content --- windows/keep-secure/TOC.md | 3 ++- windows/keep-secure/guidance-and-best-practices-wip.md | 9 +++++---- .../recommended-network-definitions-for-wip.md | 2 +- 3 files changed, 8 insertions(+), 6 deletions(-) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index 069962cc43..244b54bbcd 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -33,8 +33,9 @@ #### [Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md) ### [General guidance and best practices for Windows Information Protection (WIP)](guidance-and-best-practices-wip.md) #### [Enlightened apps for use with Windows Information Protection (WIP)](enlightened-microsoft-apps-and-wip.md) -#### [Recommended Office 365 Mail and Calendar apps configuration with Windows Information Protection (WIP)](recommended-office-365-configurations-for-wip.md) #### [Unenlightened and enlightened app behavior while using Windows Information Protection (WIP)](app-behavior-with-wip.md) +#### [Recommended Office 365 Mail and Calendar apps configuration with Windows Information Protection (WIP)](recommended-office-365-configurations-for-wip.md) +#### [Recommended Enterprise Cloud and Neutral network settings with Windows Information Protection (WIP)](recommended-network-definitions-for-wip.md) ### [Mandatory tasks and settings required to turn on Windows Information Protection (WIP)](mandatory-settings-for-wip.md) ### [Testing scenarios for Windows Information Protection (WIP)](testing-scenarios-for-wip.md) ### [Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md) diff --git a/windows/keep-secure/guidance-and-best-practices-wip.md b/windows/keep-secure/guidance-and-best-practices-wip.md index 93a995e948..22f75b6d06 100644 --- a/windows/keep-secure/guidance-and-best-practices-wip.md +++ b/windows/keep-secure/guidance-and-best-practices-wip.md @@ -22,7 +22,8 @@ This section includes info about the enlightened Microsoft apps, including how t ## In this section |Topic |Description | |------|------------| -|[Mandatory settings for Windows Information Protection (WIP)](mandatory-settings-for-wip.md) |A list of all of the tasks and settings that are required for the operating system to turn on Windows Information Protection (WIP), formerly known as enterprise data protection (EDP), in your enterprise. | -|[Enlightened apps for use with Windows Information Protection (WIP)](enlightened-microsoft-apps-and-wip.md) |Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your allowed apps list. | -|[Testing scenarios for Windows Information Protection (WIP)](testing-scenarios-for-wip.md) |We've come up with a list of suggested testing scenarios that you can use to test WIP in your company. | -|[Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md) |The most common problems you might encounter while using Windows Information Protection (WIP). | \ No newline at end of file +|[Enlightened apps for use with Windows Information Protection (WIP)](enlightened-microsoft-apps-and-wip.md) |Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your allowed apps list. | +|[Unenlightened and enlightened app behavior while using Windows Information Protection (WIP)](app-behavior-with-wip.md) |Learn the difference between enlightened and unenlightened app behavior. | +|[Unenlightened and enlightened app behavior while using Windows Information Protection (WIP)](app-behavior-with-wip.md) |An explanation about enlightened and unenlightened app behavior with Windows Information Protection (WIP). | +|[Recommended Office 365 Mail and Calendar apps configuration with Windows Information Protection (WIP)](recommended-office-365-configurations-for-wip.md) |A list of recommended Windows Information Protection (WIP) configurations for use with Office 2016 and the Office 365 Mail and Calendar apps. | +|[Recommended Enterprise Cloud and Neutral network settings with Windows Information Protection (WIP)](recommended-network-definitions-for-wip.md) |A list of recommended URLs to add to your network settings for both the Enteprise Cloud and Neutral resources. | \ No newline at end of file diff --git a/windows/keep-secure/recommended-network-definitions-for-wip.md b/windows/keep-secure/recommended-network-definitions-for-wip.md index f56c785ace..5637879022 100644 --- a/windows/keep-secure/recommended-network-definitions-for-wip.md +++ b/windows/keep-secure/recommended-network-definitions-for-wip.md @@ -18,6 +18,6 @@ localizationpriority: high >Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). -We recommend that you update your network settings for both the Enteprise Cloud and Neutral resources. +We recommend that you add the following URLs to your network settings for both the Enteprise Cloud and Neutral resources. ## Recommended Enterprise Cloud Resources \ No newline at end of file From 5f15a940e652fee38951a7e4411ca48045a893bf Mon Sep 17 00:00:00 2001 From: LizRoss Date: Thu, 15 Dec 2016 08:17:23 -0800 Subject: [PATCH 07/42] Adding new content --- windows/keep-secure/TOC.md | 2 +- ...ange-history-for-keep-windows-10-secure.md | 1 + ...recommended-network-definitions-for-wip.md | 25 +++++++++++++++---- 3 files changed, 22 insertions(+), 6 deletions(-) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index 244b54bbcd..ddbf1133a1 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -35,7 +35,7 @@ #### [Enlightened apps for use with Windows Information Protection (WIP)](enlightened-microsoft-apps-and-wip.md) #### [Unenlightened and enlightened app behavior while using Windows Information Protection (WIP)](app-behavior-with-wip.md) #### [Recommended Office 365 Mail and Calendar apps configuration with Windows Information Protection (WIP)](recommended-office-365-configurations-for-wip.md) -#### [Recommended Enterprise Cloud and Neutral network settings with Windows Information Protection (WIP)](recommended-network-definitions-for-wip.md) +#### [Recommended Enterprise Cloud Resources and Neutral Resources network settings with Windows Information Protection (WIP)](recommended-network-definitions-for-wip.md) ### [Mandatory tasks and settings required to turn on Windows Information Protection (WIP)](mandatory-settings-for-wip.md) ### [Testing scenarios for Windows Information Protection (WIP)](testing-scenarios-for-wip.md) ### [Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md) diff --git a/windows/keep-secure/change-history-for-keep-windows-10-secure.md b/windows/keep-secure/change-history-for-keep-windows-10-secure.md index 10d1e0391a..dd10a80171 100644 --- a/windows/keep-secure/change-history-for-keep-windows-10-secure.md +++ b/windows/keep-secure/change-history-for-keep-windows-10-secure.md @@ -16,6 +16,7 @@ This topic lists new and updated topics in the [Keep Windows 10 secure](index.md |New or changed topic |Description | |---------------------|------------| |[Recommended Office 365 Mail and Calendar apps configuration with Windows Information Protection (WIP)](recommended-office-365-configurations-for-wip.md) |New | +|[Recommended Enterprise Cloud Resources and Neutral Resources network settings with Windows Information Protection (WIP)](recommended-network-definitions-for-wip.md) |New | ## November 2016 diff --git a/windows/keep-secure/recommended-network-definitions-for-wip.md b/windows/keep-secure/recommended-network-definitions-for-wip.md index 5637879022..43a247515b 100644 --- a/windows/keep-secure/recommended-network-definitions-for-wip.md +++ b/windows/keep-secure/recommended-network-definitions-for-wip.md @@ -1,7 +1,7 @@ --- -title: Recommended Enterprise Cloud and Neutral network settings with Windows Information Protection (WIP) (Windows 10) -description: Recommendations about additions to make to the Enterprise Cloud and Neutral network settings with Windows Information Protection (WIP). -keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, WIP and Neutral resources, WIP and Enterprise Cloud Resources +title: Recommended Enterprise Cloud Resources and Neutral Resources network settings with Windows Information Protection (WIP) (Windows 10) +description: Recommended additions for the Enterprise Cloud Resources and Neutral Resources network settings used with Windows Information Protection (WIP). +keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, WIP and Neutral Resources, WIP and Enterprise Cloud Resources ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library @@ -9,7 +9,7 @@ ms.pagetype: security localizationpriority: high --- -# Recommended Enterprise Cloud and Neutral network settings with Windows Information Protection (WIP) +# Recommended Enterprise Cloud Resources and Neutral Resources network settings with Windows Information Protection (WIP) **Applies to:** @@ -20,4 +20,19 @@ localizationpriority: high We recommend that you add the following URLs to your network settings for both the Enteprise Cloud and Neutral resources. -## Recommended Enterprise Cloud Resources \ No newline at end of file +## Recommended Enterprise Cloud Resources +This table includes the recommended URLs to add to your Enterprise Cloud Resources network setting, based on what you use in your organization. + +|If your organization uses... |Add these entries to your Enterprise Cloud Resources network setting
(Replace "contoso" with your domain name(s) | +|-----------------------------|---------------------------------------------------------------------| +|Office 365 for Business |
  • contoso.sharepoint.com
  • contoso-my.sharepoint.com
  • contoso-files.sharepoint.com
  • tasks.office.com
  • lists.office.com
  • collabdb.com
  • www.collabdb.com
  • protection.office.com
  • meet.lync.com
  • teams.microsoft.com
| +|Yammer |
  • www.yammer.com
  • yammer.com
  • persona.yammer.com
| +|Microsoft Dynamics |contoso.crm.dynamics.com | +|Visual Studio Online |contoso.visualstudio.com | +|Power BI |contoso.powerbi.com | + +## Recommended Neutral Resources +This table includes the recommended URLs to add to your Neutral Resources network setting, based on what you use in your organization. + +|If your organization uses... |Add these entries to your Enterprise Cloud Resources network setting
(Replace "contoso" with your domain name(s) | +|-----------------------------|---------------------------------------------------------------------| \ No newline at end of file From c44ba3a77e43ea1ec27843cbc37c101993ce9944 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Thu, 15 Dec 2016 08:33:03 -0800 Subject: [PATCH 08/42] Adding content --- .../recommended-network-definitions-for-wip.md | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/windows/keep-secure/recommended-network-definitions-for-wip.md b/windows/keep-secure/recommended-network-definitions-for-wip.md index 43a247515b..501704692d 100644 --- a/windows/keep-secure/recommended-network-definitions-for-wip.md +++ b/windows/keep-secure/recommended-network-definitions-for-wip.md @@ -21,7 +21,7 @@ localizationpriority: high We recommend that you add the following URLs to your network settings for both the Enteprise Cloud and Neutral resources. ## Recommended Enterprise Cloud Resources -This table includes the recommended URLs to add to your Enterprise Cloud Resources network setting, based on what you use in your organization. +This table includes the recommended URLs to add to your Enterprise Cloud Resources network setting, based on the apps you use in your organization. |If your organization uses... |Add these entries to your Enterprise Cloud Resources network setting
(Replace "contoso" with your domain name(s) | |-----------------------------|---------------------------------------------------------------------| @@ -32,7 +32,8 @@ This table includes the recommended URLs to add to your Enterprise Cloud Resourc |Power BI |contoso.powerbi.com | ## Recommended Neutral Resources -This table includes the recommended URLs to add to your Neutral Resources network setting, based on what you use in your organization. - -|If your organization uses... |Add these entries to your Enterprise Cloud Resources network setting
(Replace "contoso" with your domain name(s) | -|-----------------------------|---------------------------------------------------------------------| \ No newline at end of file +We recommended adding these URLs if you use the Neutral Resources network setting with Windows Information Protection (WIP). +
    +
  • login.microsoftonline.com
    • +
  • login.windows.net
    • +
\ No newline at end of file From 66ff7ff0e57629dbbc120486655b7822109eceac Mon Sep 17 00:00:00 2001 From: LizRoss Date: Thu, 15 Dec 2016 08:49:55 -0800 Subject: [PATCH 09/42] Adding content --- windows/keep-secure/guidance-and-best-practices-wip.md | 6 +++--- .../keep-secure/recommended-network-definitions-for-wip.md | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/keep-secure/guidance-and-best-practices-wip.md b/windows/keep-secure/guidance-and-best-practices-wip.md index 22f75b6d06..58c2677dd5 100644 --- a/windows/keep-secure/guidance-and-best-practices-wip.md +++ b/windows/keep-secure/guidance-and-best-practices-wip.md @@ -23,7 +23,7 @@ This section includes info about the enlightened Microsoft apps, including how t |Topic |Description | |------|------------| |[Enlightened apps for use with Windows Information Protection (WIP)](enlightened-microsoft-apps-and-wip.md) |Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your allowed apps list. | -|[Unenlightened and enlightened app behavior while using Windows Information Protection (WIP)](app-behavior-with-wip.md) |Learn the difference between enlightened and unenlightened app behavior. | +|[Unenlightened and enlightened app behavior while using Windows Information Protection (WIP)](app-behavior-with-wip.md) |Learn the difference between enlightened and unenlightened app behaviors. | |[Unenlightened and enlightened app behavior while using Windows Information Protection (WIP)](app-behavior-with-wip.md) |An explanation about enlightened and unenlightened app behavior with Windows Information Protection (WIP). | -|[Recommended Office 365 Mail and Calendar apps configuration with Windows Information Protection (WIP)](recommended-office-365-configurations-for-wip.md) |A list of recommended Windows Information Protection (WIP) configurations for use with Office 2016 and the Office 365 Mail and Calendar apps. | -|[Recommended Enterprise Cloud and Neutral network settings with Windows Information Protection (WIP)](recommended-network-definitions-for-wip.md) |A list of recommended URLs to add to your network settings for both the Enteprise Cloud and Neutral resources. | \ No newline at end of file +|[Recommended Office 365 Mail and Calendar apps configuration with Windows Information Protection (WIP)](recommended-office-365-configurations-for-wip.md) |Recommended Windows Information Protection (WIP) configurations for use with Office 2016 and the Office 365 Mail and Calendar apps. | +|[Recommended Enterprise Cloud Resources and Neutral Resources network settings with Windows Information Protection (WIP)](recommended-network-definitions-for-wip.md) |Recommended additions for the Enterprise Cloud Resources and Neutral Resources network settings, when used with Windows Information Protection (WIP). | \ No newline at end of file diff --git a/windows/keep-secure/recommended-network-definitions-for-wip.md b/windows/keep-secure/recommended-network-definitions-for-wip.md index 501704692d..c87c52e3e3 100644 --- a/windows/keep-secure/recommended-network-definitions-for-wip.md +++ b/windows/keep-secure/recommended-network-definitions-for-wip.md @@ -1,6 +1,6 @@ --- title: Recommended Enterprise Cloud Resources and Neutral Resources network settings with Windows Information Protection (WIP) (Windows 10) -description: Recommended additions for the Enterprise Cloud Resources and Neutral Resources network settings used with Windows Information Protection (WIP). +description: Recommended URLs to add to your Enterprise Cloud Resources and Neutral Resources network settings, when used with Windows Information Protection (WIP). keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, WIP and Neutral Resources, WIP and Enterprise Cloud Resources ms.prod: w10 ms.mktglfcycl: explore @@ -18,7 +18,7 @@ localizationpriority: high >Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). -We recommend that you add the following URLs to your network settings for both the Enteprise Cloud and Neutral resources. +We recommend that you add the following URLs to the Enterprise Cloud Resources and Neutral Resources network settings, when used with Windows Information Protection (WIP). ## Recommended Enterprise Cloud Resources This table includes the recommended URLs to add to your Enterprise Cloud Resources network setting, based on the apps you use in your organization. From aa5e8d8841080472077f0cdaab6adfcb06bb927f Mon Sep 17 00:00:00 2001 From: LizRoss Date: Thu, 15 Dec 2016 09:19:27 -0800 Subject: [PATCH 10/42] Re-ordered for easier access --- windows/keep-secure/TOC.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index ddbf1133a1..440bcf0ee1 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -31,14 +31,14 @@ ##### [Create and deploy a VPN policy for Windows Information Protection (WIP) using Microsoft Intune](create-vpn-and-wip-policy-using-intune.md) #### [Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager](create-wip-policy-using-sccm.md) #### [Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md) +### [Mandatory tasks and settings required to turn on Windows Information Protection (WIP)](mandatory-settings-for-wip.md) +### [Testing scenarios for Windows Information Protection (WIP)](testing-scenarios-for-wip.md) +### [Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md) ### [General guidance and best practices for Windows Information Protection (WIP)](guidance-and-best-practices-wip.md) #### [Enlightened apps for use with Windows Information Protection (WIP)](enlightened-microsoft-apps-and-wip.md) #### [Unenlightened and enlightened app behavior while using Windows Information Protection (WIP)](app-behavior-with-wip.md) #### [Recommended Office 365 Mail and Calendar apps configuration with Windows Information Protection (WIP)](recommended-office-365-configurations-for-wip.md) #### [Recommended Enterprise Cloud Resources and Neutral Resources network settings with Windows Information Protection (WIP)](recommended-network-definitions-for-wip.md) -### [Mandatory tasks and settings required to turn on Windows Information Protection (WIP)](mandatory-settings-for-wip.md) -### [Testing scenarios for Windows Information Protection (WIP)](testing-scenarios-for-wip.md) -### [Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md) ## [Use Windows Event Forwarding to help with intrusion detection](use-windows-event-forwarding-to-assist-in-instrusion-detection.md) ## [Override Process Mitigation Options to help enforce app-related security policies](override-mitigation-options-for-app-related-security-policies.md) ## [VPN technical guide](vpn-guide.md) From 9e72a2d1123b448210b1f4c14e1826579052964b Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 15 Dec 2016 13:55:37 -0800 Subject: [PATCH 11/42] stage --- ...-deployment-surface-hub-device-accounts.md | 49 +++++++++---------- 1 file changed, 23 insertions(+), 26 deletions(-) diff --git a/devices/surface-hub/online-deployment-surface-hub-device-accounts.md b/devices/surface-hub/online-deployment-surface-hub-device-accounts.md index 571a848679..cd9d8cb6de 100644 --- a/devices/surface-hub/online-deployment-surface-hub-device-accounts.md +++ b/devices/surface-hub/online-deployment-surface-hub-device-accounts.md @@ -84,7 +84,10 @@ If you have a pure, online (O365) deployment, then you can [use the provided Pow Set-MsolUser -UserPrincipalName 'HUB01@contoso.com' -PasswordNeverExpires $true ``` -7. The device account needs to have a valid Office 365 (O365) license, or Exchange and Skype for Business will not work. If you have the license, you need to assign a usage location to your device account—this determines what license SKUs are available for your account. +7. Surface Hub requires a license for Skype for Business functionality. + - Your Surface Hub account requires a Lync Online (Plan 2) or Lync Online (Plan 3) license, but it does not require an Exchange Online license. + - You'll need to have Lync Online (Plan 2) or higher in your O365 plan. The plan needs to support conferencing capability. + - If you need Enterprise Voice (PSTN telephony) using telephony service providers for the Surface Hub, you need Lync Online (Plan 3). Next, you can use `Get-MsolAccountSku` to retrieve a list of available SKUs for your O365 tenant. @@ -98,15 +101,6 @@ If you have a pure, online (O365) deployment, then you can [use the provided Pow 8. Enable the device account with Skype for Business. - In order to enable Skype for Business, your environment will need to meet the following prerequisites: - - - You'll need to have Lync Online (Plan 2) or higher in your O365 plan. The plan needs to support conferencing capability. - - If you need Enterprise Voice (PSTN telephony) using telephony service providers for the Surface Hub, you need Lync Online (Plan 3). - - Your tenant users must have Exchange mailboxes. - - Your device account needs a Lync Online (Plan 2) or Lync Online (Plan 3) license, but it does not require an Exchange Online license. - - - - Start by creating a remote PowerShell session from a PC. ```PowerShell @@ -115,29 +109,32 @@ If you have a pure, online (O365) deployment, then you can [use the provided Pow Import-PSSession $cssess -AllowClobber ``` - - To enable your Surface Hub account for Skype for Business Server, run this cmdlet: - - ```PowerShell - Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool - "sippoolbl20a04.infra.lync.com" -SipAddressType EmailAddress - ``` - - If you aren't sure what value to use for the `RegistrarPool` parameter in your environment, you can get the value from an existing Skype for Business user using this cmdlet: + - Next, if you aren't sure what value to use for the `RegistrarPool` parameter in your environment, you can get the value from an existing Skype for Business user using this cmdlet (for example, *alice@contoso.com*): ```PowerShell Get-CsOnlineUser -Identity ‘alice@contoso.com’| fl *registrarpool* + OR by setting a variable + $strRegistrarPool = (Get-CsOnlineUser -Identity ‘alice@contoso.com’).RegistrarPool + ``` + + - Enable the Surface Hub account with the following cmdlet: + + ```PowerShell + Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool yourRegistrarPool -SipAddressType EmailAddress + OR using the $strRegistarPool variable from above + Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool $strRegistrarPool -SipAddressType EmailAddress ``` -9. Assign Skype for Business license to your Surface Hub account. +Alternatively, You can assign a license to the Surface Hub through the Office 365 administrators portal: + +1. Login as a tenant administrator, open the O365 Administrative Portal, and click on the Admin app. +1. Click on Users and Groups and then Add users, reset passwords, and more. +1. Select the Surface Hub account, and then click or tap the pen icon, which means edit. +1. Click on the Licenses option. +1. In the Assign licenses section, you need to select an appropriate license that meets the requirements in step 7 depending on your licensing and what you've decided in terms of needing Enterprise Voice. +1. Click Save and you're done. - Once you've completed the preceding steps to enable your Surface Hub account in Skype for Business Online, you need to assign a license to the Surface Hub. Using the O365 administrative portal, assign either a Skype for Business Online (Plan 2) or a Skype for Business Online (Plan 3) to the device. - - Login as a tenant administrator, open the O365 Administrative Portal, and click on the Admin app. - - Click on **Users and Groups** and then **Add users, reset passwords, and more**. - - Select the Surface Hub account, and then click or tap the pen icon, which means edit. - - Click on the **Licenses** option. - - In the **Assign licenses** section, you need to select Skype for Business (Plan 2) or Skype for Business (Plan 3), depending on your licensing and what you've decided in terms of needing Enterprise Voice. You'll have to use a Plan 3 license if you want to use Enterprise Voice on your Surface Hub. - - Click **Save** and you're done. >[!NOTE] >It's also possible to use the Windows Azure Active Directory Module for Windows PowerShell to run the cmdlets needed to assign one of these licenses, but that's not covered here. From 6ea9d4a73f7f7a094831ba8492011111fa4ed00b Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 15 Dec 2016 14:13:55 -0800 Subject: [PATCH 12/42] format issues --- .../online-deployment-surface-hub-device-accounts.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/devices/surface-hub/online-deployment-surface-hub-device-accounts.md b/devices/surface-hub/online-deployment-surface-hub-device-accounts.md index cd9d8cb6de..db37cfd52e 100644 --- a/devices/surface-hub/online-deployment-surface-hub-device-accounts.md +++ b/devices/surface-hub/online-deployment-surface-hub-device-accounts.md @@ -127,12 +127,12 @@ If you have a pure, online (O365) deployment, then you can [use the provided Pow Alternatively, You can assign a license to the Surface Hub through the Office 365 administrators portal: -1. Login as a tenant administrator, open the O365 Administrative Portal, and click on the Admin app. -1. Click on Users and Groups and then Add users, reset passwords, and more. +1. Sign in as a tenant administrator, open the O365 Administrative Portal, and click the Admin app. +1. Click **Users and Groups** and then **Add users, reset passwords, and more**. 1. Select the Surface Hub account, and then click or tap the pen icon, which means edit. -1. Click on the Licenses option. -1. In the Assign licenses section, you need to select an appropriate license that meets the requirements in step 7 depending on your licensing and what you've decided in terms of needing Enterprise Voice. -1. Click Save and you're done. +1. Click the **Licenses** option. +1. In the **Assign licenses** section, select an appropriate license that meets the requirements in step 7 depending on your licensing and what you've decided in terms of needing Enterprise Voice. +1. Click **Save** and you're done. From 0dffa461c03dbd0979d7a2c300f2041740a9a7af Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 15 Dec 2016 14:14:25 -0800 Subject: [PATCH 13/42] format --- .../online-deployment-surface-hub-device-accounts.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/devices/surface-hub/online-deployment-surface-hub-device-accounts.md b/devices/surface-hub/online-deployment-surface-hub-device-accounts.md index db37cfd52e..322eda7c1b 100644 --- a/devices/surface-hub/online-deployment-surface-hub-device-accounts.md +++ b/devices/surface-hub/online-deployment-surface-hub-device-accounts.md @@ -109,7 +109,7 @@ If you have a pure, online (O365) deployment, then you can [use the provided Pow Import-PSSession $cssess -AllowClobber ``` - - Next, if you aren't sure what value to use for the `RegistrarPool` parameter in your environment, you can get the value from an existing Skype for Business user using this cmdlet (for example, *alice@contoso.com*): + - Next, if you aren't sure what value to use for the `RegistrarPool` parameter in your environment, you can get the value from an existing Skype for Business user using this cmdlet (for example, *alice@contoso.com*): ```PowerShell Get-CsOnlineUser -Identity ‘alice@contoso.com’| fl *registrarpool* @@ -117,7 +117,7 @@ If you have a pure, online (O365) deployment, then you can [use the provided Pow $strRegistrarPool = (Get-CsOnlineUser -Identity ‘alice@contoso.com’).RegistrarPool ``` - - Enable the Surface Hub account with the following cmdlet: + - Enable the Surface Hub account with the following cmdlet: ```PowerShell Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool yourRegistrarPool -SipAddressType EmailAddress From 6a17b54dde837ead8703db5e5beed2983a9d179f Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 15 Dec 2016 14:22:25 -0800 Subject: [PATCH 14/42] log --- .../online-deployment-surface-hub-device-accounts.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface-hub/online-deployment-surface-hub-device-accounts.md b/devices/surface-hub/online-deployment-surface-hub-device-accounts.md index 322eda7c1b..e42598a51d 100644 --- a/devices/surface-hub/online-deployment-surface-hub-device-accounts.md +++ b/devices/surface-hub/online-deployment-surface-hub-device-accounts.md @@ -139,7 +139,7 @@ Alternatively, You can assign a license to the Surface Hub through the Office 36 >[!NOTE] >It's also possible to use the Windows Azure Active Directory Module for Windows PowerShell to run the cmdlets needed to assign one of these licenses, but that's not covered here. -For validation, you should be able to use any Skype for Business client (PC, Android, etc) to log in to this account. +For validation, you should be able to use any Skype for Business client (PC, Android, etc) to sign in to this account. From ae07b92b52fbf1bcb0550a7ddcd0ea53be955d05 Mon Sep 17 00:00:00 2001 From: rikot Date: Fri, 6 Jan 2017 13:21:54 -0500 Subject: [PATCH 15/42] Update save-bitlocker-key-surface-hub.md --- devices/surface-hub/save-bitlocker-key-surface-hub.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface-hub/save-bitlocker-key-surface-hub.md b/devices/surface-hub/save-bitlocker-key-surface-hub.md index 461864a1aa..2354de0f40 100644 --- a/devices/surface-hub/save-bitlocker-key-surface-hub.md +++ b/devices/surface-hub/save-bitlocker-key-surface-hub.md @@ -24,7 +24,7 @@ There are several ways to manage your BitLocker key on the Surface Hub. 2. If you’ve joined the Surface Hub to Azure Active Directory (Azure AD), the BitLocker key will be stored under the account that was used to join the device. -3. If you’re using a local admin account to manage the device, you can save the BitLocker key by going to the **Settings** app and navigating to **Update & security** > **Recovery**. Insert a USB drive and select the option to save the BitLocker key. The key will be saved to a text file on the USB drive. +3. If you’re using an admin account to manage the device, you can save the BitLocker key by going to the **Settings** app and navigating to **Update & security** > **Recovery**. Insert a USB drive and select the option to save the BitLocker key. The key will be saved to a text file on the USB drive. ## Related topics From 2185bb4e38ae7faade2fd180a277c45dac632d54 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Fri, 6 Jan 2017 15:02:37 -0800 Subject: [PATCH 16/42] Removed innacurate para This para said the Interactive logon: Display user information when session is locked setting would prevent displaying logon name but that's not true in Win 10. --- .../interactive-logon-do-not-display-last-user-name.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/windows/keep-secure/interactive-logon-do-not-display-last-user-name.md b/windows/keep-secure/interactive-logon-do-not-display-last-user-name.md index 0177def043..5af92d1bcf 100644 --- a/windows/keep-secure/interactive-logon-do-not-display-last-user-name.md +++ b/windows/keep-secure/interactive-logon-do-not-display-last-user-name.md @@ -34,8 +34,6 @@ If this policy is disabled, the full name of the last user to log on is displaye Your implementation of this policy depends on your security requirements for displayed logon information. If you have devices that store sensitive data, with monitors displayed in unsecured locations, or if you have devices with sensitive data that are remotely accessed, revealing logged on user’s full names or domain account names might contradict your overall security policy. -Depending on your security policy, you might also want to enable the [Interactive logon: Display user information when the session is locked](interactive-logon-display-user-information-when-the-session-is-locked.md) policy, which will prevent the Windows operating system from displaying the logon name when the session is locked or started. - ### Location Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options From 7140585fb09945976ae1fca92994e74a4400911c Mon Sep 17 00:00:00 2001 From: LizRoss Date: Mon, 9 Jan 2017 10:53:45 -0800 Subject: [PATCH 17/42] Renaming file --- ...ended-office-365-configurations-for-wip.md | 4 +- windows/keep-secure/using-owa-with-wip.md | 64 +++++++++++++++++++ 2 files changed, 66 insertions(+), 2 deletions(-) create mode 100644 windows/keep-secure/using-owa-with-wip.md diff --git a/windows/keep-secure/recommended-office-365-configurations-for-wip.md b/windows/keep-secure/recommended-office-365-configurations-for-wip.md index b243ede2f4..193528b36e 100644 --- a/windows/keep-secure/recommended-office-365-configurations-for-wip.md +++ b/windows/keep-secure/recommended-office-365-configurations-for-wip.md @@ -1,5 +1,5 @@ --- -title: Recommended Office 365 Mail and Calendar apps configuration with Windows Information Protection (WIP) (Windows 10) +title: Using Outlook Web Access with Windows Information Protection (WIP) (Windows 10) description: Recommendations about how to configure Office 365 Mail and Calendar apps, including Outlook Web Access (OWA) and the various client apps, with Windows Information Protection (WIP). keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, WIP and Office 2016 configuration, WIP and Office 365 Mail app ms.prod: w10 @@ -9,7 +9,7 @@ ms.pagetype: security localizationpriority: high --- -# Recommended Office 365 Mail and Calendar apps configuration with Windows Information Protection (WIP) +# Using Outlook Web Access with Windows Information Protection (WIP) **Applies to:** - Windows 10, version 1607 diff --git a/windows/keep-secure/using-owa-with-wip.md b/windows/keep-secure/using-owa-with-wip.md new file mode 100644 index 0000000000..b243ede2f4 --- /dev/null +++ b/windows/keep-secure/using-owa-with-wip.md @@ -0,0 +1,64 @@ +--- +title: Recommended Office 365 Mail and Calendar apps configuration with Windows Information Protection (WIP) (Windows 10) +description: Recommendations about how to configure Office 365 Mail and Calendar apps, including Outlook Web Access (OWA) and the various client apps, with Windows Information Protection (WIP). +keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, WIP and Office 2016 configuration, WIP and Office 365 Mail app +ms.prod: w10 +ms.mktglfcycl: explore +ms.sitesec: library +ms.pagetype: security +localizationpriority: high +--- + +# Recommended Office 365 Mail and Calendar apps configuration with Windows Information Protection (WIP) +**Applies to:** + +- Windows 10, version 1607 +- Windows 10 Mobile + +>Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). + +Because the Office 365 Mail and Calendar apps, including Outlook Web Access (OWA) and the various client apps, can be used both personally and as part of your organization, we recommend the following configurations: + + + + + + + + + + + + + + + + + + + + + + + + +
OptionOWA behaviorOffice 365 behavior
Disable OWA. Employees can only use Microsoft Outlook 2016 or the Office 365 Mail app.Disabled.Both Outlook 2016 and the Office 365 Mail app behave properly, regardless of how you've configured outlook.office.com in your network settings.
An employee's mailbox is automatically marked as corporate data.
Don't configure outlook.office.com in any of your networking settings.All mailboxes are automatically marked as personal. This means employees attempting to copy work content into OWA receive prompts and that files downloaded from OWA aren't automatically protected as corporate data.
Do any of the following: +
    +
  • Create a domain (such as mail.contoso.com, redirecting to outlook.office.com) that can be used by your employees to access work email.
    • +
  • Add the new domain to the Enterprise Cloud Resources network element in your WIP policy.
    • +
  • Add the following URLs to the Neutral Resources network element in your WIP policy: +
      +
    • outlook.office365.com
      • +
    • outlook.office.com
      • +
    • outlook-sdf.office.com
      • +
    • attachment.outlook.office.net
      • +
    +
    • +
+ 		Inbox content accessed through the new domain is automatically marked as corporate data, while content accessed through personal email is automatically marked as personal.
Add outlook.office.com to the Enterprise Cloud Resources network element in your WIP policy.All mailboxes are automatically marked as work. This means any personal inboxes hosted on Office 365 are also automatically marked as corporate data.
+ + + + + + From d11f74b061b3eb61f4f4fa880585b8f31eb707f8 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Mon, 9 Jan 2017 11:05:46 -0800 Subject: [PATCH 18/42] Updated text --- windows/keep-secure/TOC.md | 2 +- ...ange-history-for-keep-windows-10-secure.md | 2 +- ...ended-office-365-configurations-for-wip.md | 64 ------------------- windows/keep-secure/using-owa-with-wip.md | 57 ++++------------- 4 files changed, 16 insertions(+), 109 deletions(-) delete mode 100644 windows/keep-secure/recommended-office-365-configurations-for-wip.md diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index 3118984f33..6f4a4635e9 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -37,8 +37,8 @@ ### [General guidance and best practices for Windows Information Protection (WIP)](guidance-and-best-practices-wip.md) #### [Enlightened apps for use with Windows Information Protection (WIP)](enlightened-microsoft-apps-and-wip.md) #### [Unenlightened and enlightened app behavior while using Windows Information Protection (WIP)](app-behavior-with-wip.md) -#### [Recommended Office 365 Mail and Calendar apps configuration with Windows Information Protection (WIP)](recommended-office-365-configurations-for-wip.md) #### [Recommended Enterprise Cloud Resources and Neutral Resources network settings with Windows Information Protection (WIP)](recommended-network-definitions-for-wip.md) +#### [Using Outlook Web Access with Windows Information Protection (WIP)](using-owa-with-wip.md) ## [Use Windows Event Forwarding to help with intrusion detection](use-windows-event-forwarding-to-assist-in-instrusion-detection.md) ## [Override Process Mitigation Options to help enforce app-related security policies](override-mitigation-options-for-app-related-security-policies.md) ## [VPN technical guide](vpn-guide.md) diff --git a/windows/keep-secure/change-history-for-keep-windows-10-secure.md b/windows/keep-secure/change-history-for-keep-windows-10-secure.md index 705b515233..900762eca3 100644 --- a/windows/keep-secure/change-history-for-keep-windows-10-secure.md +++ b/windows/keep-secure/change-history-for-keep-windows-10-secure.md @@ -15,8 +15,8 @@ This topic lists new and updated topics in the [Keep Windows 10 secure](index.md ## January 2017 |New or changed topic |Description | |---------------------|------------| -|[Recommended Office 365 Mail and Calendar apps configuration with Windows Information Protection (WIP)](recommended-office-365-configurations-for-wip.md) |New | |[Recommended Enterprise Cloud Resources and Neutral Resources network settings with Windows Information Protection (WIP)](recommended-network-definitions-for-wip.md) |New | +|[Using Outlook Web Access with Windows Information Protection (WIP)](using-owa-with-wip.md) |New | ## December 2016 |New or changed topic |Description | diff --git a/windows/keep-secure/recommended-office-365-configurations-for-wip.md b/windows/keep-secure/recommended-office-365-configurations-for-wip.md deleted file mode 100644 index 193528b36e..0000000000 --- a/windows/keep-secure/recommended-office-365-configurations-for-wip.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: Using Outlook Web Access with Windows Information Protection (WIP) (Windows 10) -description: Recommendations about how to configure Office 365 Mail and Calendar apps, including Outlook Web Access (OWA) and the various client apps, with Windows Information Protection (WIP). -keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, WIP and Office 2016 configuration, WIP and Office 365 Mail app -ms.prod: w10 -ms.mktglfcycl: explore -ms.sitesec: library -ms.pagetype: security -localizationpriority: high ---- - -# Using Outlook Web Access with Windows Information Protection (WIP) -**Applies to:** - -- Windows 10, version 1607 -- Windows 10 Mobile - ->Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). - -Because the Office 365 Mail and Calendar apps, including Outlook Web Access (OWA) and the various client apps, can be used both personally and as part of your organization, we recommend the following configurations: - - - - - - - - - - - - - - - - - - - - - - - - -
OptionOWA behaviorOffice 365 behavior
Disable OWA. Employees can only use Microsoft Outlook 2016 or the Office 365 Mail app.Disabled.Both Outlook 2016 and the Office 365 Mail app behave properly, regardless of how you've configured outlook.office.com in your network settings.
An employee's mailbox is automatically marked as corporate data.
Don't configure outlook.office.com in any of your networking settings.All mailboxes are automatically marked as personal. This means employees attempting to copy work content into OWA receive prompts and that files downloaded from OWA aren't automatically protected as corporate data.
Do any of the following: -
    -
  • Create a domain (such as mail.contoso.com, redirecting to outlook.office.com) that can be used by your employees to access work email.
    • -
  • Add the new domain to the Enterprise Cloud Resources network element in your WIP policy.
    • -
  • Add the following URLs to the Neutral Resources network element in your WIP policy: -
      -
    • outlook.office365.com
      • -
    • outlook.office.com
      • -
    • outlook-sdf.office.com
      • -
    • attachment.outlook.office.net
      • -
    -
    • -
- 		Inbox content accessed through the new domain is automatically marked as corporate data, while content accessed through personal email is automatically marked as personal.
Add outlook.office.com to the Enterprise Cloud Resources network element in your WIP policy.All mailboxes are automatically marked as work. This means any personal inboxes hosted on Office 365 are also automatically marked as corporate data.
- - - - - - diff --git a/windows/keep-secure/using-owa-with-wip.md b/windows/keep-secure/using-owa-with-wip.md index b243ede2f4..7610b5120a 100644 --- a/windows/keep-secure/using-owa-with-wip.md +++ b/windows/keep-secure/using-owa-with-wip.md @@ -1,7 +1,7 @@ --- -title: Recommended Office 365 Mail and Calendar apps configuration with Windows Information Protection (WIP) (Windows 10) -description: Recommendations about how to configure Office 365 Mail and Calendar apps, including Outlook Web Access (OWA) and the various client apps, with Windows Information Protection (WIP). -keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, WIP and Office 2016 configuration, WIP and Office 365 Mail app +title: Using Outlook Web Access with Windows Information Protection (WIP) (Windows 10) +description: Options for using Outlook Web Access (OWA) with Windows Information Protection (WIP). +keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, WIP and OWA configuration ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library @@ -9,7 +9,7 @@ ms.pagetype: security localizationpriority: high --- -# Recommended Office 365 Mail and Calendar apps configuration with Windows Information Protection (WIP) +# Using Outlook Web Access with Windows Information Protection (WIP) **Applies to:** - Windows 10, version 1607 @@ -17,46 +17,17 @@ localizationpriority: high >Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). -Because the Office 365 Mail and Calendar apps, including Outlook Web Access (OWA) and the various client apps, can be used both personally and as part of your organization, we recommend the following configurations: - - - - - - - - - - - - - - - - - - - - - - - - -
OptionOWA behaviorOffice 365 behavior
Disable OWA. Employees can only use Microsoft Outlook 2016 or the Office 365 Mail app.Disabled.Both Outlook 2016 and the Office 365 Mail app behave properly, regardless of how you've configured outlook.office.com in your network settings.
An employee's mailbox is automatically marked as corporate data.
Don't configure outlook.office.com in any of your networking settings.All mailboxes are automatically marked as personal. This means employees attempting to copy work content into OWA receive prompts and that files downloaded from OWA aren't automatically protected as corporate data.
Do any of the following: -
    -
  • Create a domain (such as mail.contoso.com, redirecting to outlook.office.com) that can be used by your employees to access work email.
    • -
  • Add the new domain to the Enterprise Cloud Resources network element in your WIP policy.
    • -
  • Add the following URLs to the Neutral Resources network element in your WIP policy: -
      -
    • outlook.office365.com
      • -
    • outlook.office.com
      • -
    • outlook-sdf.office.com
      • -
    • attachment.outlook.office.net
      • -
    -
    • -
- 		Inbox content accessed through the new domain is automatically marked as corporate data, while content accessed through personal email is automatically marked as personal.
Add outlook.office.com to the Enterprise Cloud Resources network element in your WIP policy.All mailboxes are automatically marked as work. This means any personal inboxes hosted on Office 365 are also automatically marked as corporate data.
+Because Outlook Web Access (OWA) can be used both personally and as part of your organization, you have the following options to configure it with Windows Information Protection (WIP): +|Option |OWA behavior | +|-------|-------------| +|Disable OWA. Employees can only use Microsoft Outlook 2016 or the Office 365 Mail app. | Disabled. | +|Don't configure outlook.office.com in any of your networking settings. |All mailboxes are automatically marked as personal. This means employees attempting to copy work content into OWA receive prompts and that files downloaded from OWA aren't automatically protected as corporate data. | +|Do all of the following:
  • Create a domain (such as mail.contoso.com, redirecting to outlook.office.com) that can be used by your employees to access work email.
  • Add the new domain to the Enterprise Cloud Resources network element in your WIP policy.
  • Add the following URLs to the Neutral Resources network element in your WIP policy:
    • outlook.office365.com
    • outlook.office.com
    • outlook-sdf.office.com
    • attachment.outlook.office.net
|Inbox content accessed through the new domain is automatically marked as corporate data, while content accessed through personal email is automatically marked as personal. | +|Add outlook.office.com to the Enterprise Cloud Resources network element in your WIP policy. |All mailboxes are automatically marked as corporate. This means any personal inboxes hosted on Office 365 are also automatically marked as corporate data. | + +>[!NOTE] +>These limitations don’t apply to Outlook 2016 or to the Office365 Mail and Calendar apps. These apps will work properly, marking an employee’s mailbox as corporate data, regardless of how you’ve configured outlook.office.com in your network settings. From 8586de369519cf63085fdd95f31a072a29d82479 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Mon, 9 Jan 2017 12:15:50 -0800 Subject: [PATCH 19/42] Updated topic title --- windows/keep-secure/guidance-and-best-practices-wip.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/guidance-and-best-practices-wip.md b/windows/keep-secure/guidance-and-best-practices-wip.md index 79877bd59e..d1babdcf0b 100644 --- a/windows/keep-secure/guidance-and-best-practices-wip.md +++ b/windows/keep-secure/guidance-and-best-practices-wip.md @@ -24,8 +24,8 @@ This section includes info about the enlightened Microsoft apps, including how t |------|------------| |[Enlightened apps for use with Windows Information Protection (WIP)](enlightened-microsoft-apps-and-wip.md) |Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your allowed apps list. | |[Unenlightened and enlightened app behavior while using Windows Information Protection (WIP)](app-behavior-with-wip.md) |Learn the difference between enlightened and unenlightened app behaviors. | -|[Recommended Office 365 Mail and Calendar apps configuration with Windows Information Protection (WIP)](recommended-office-365-configurations-for-wip.md) |Recommended Windows Information Protection (WIP) configurations for use with Office 2016 and the Office 365 Mail and Calendar apps. | |[Recommended Enterprise Cloud Resources and Neutral Resources network settings with Windows Information Protection (WIP)](recommended-network-definitions-for-wip.md) |Recommended additions for the Enterprise Cloud Resources and Neutral Resources network settings, when used with Windows Information Protection (WIP). | +|[Using Outlook Web Access with Windows Information Protection (WIP)](using-owa-with-wip.md) |Options for using Outlook Web Access (OWA) with Windows Information Protection (WIP). | >[!NOTE] >Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). From c4f24bc964ddeb48cbc84ba5a91dad7cc4f57eab Mon Sep 17 00:00:00 2001 From: LizRoss Date: Mon, 9 Jan 2017 13:13:19 -0800 Subject: [PATCH 20/42] Removed text --- windows/keep-secure/guidance-and-best-practices-wip.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/keep-secure/guidance-and-best-practices-wip.md b/windows/keep-secure/guidance-and-best-practices-wip.md index d1babdcf0b..ff64be6d0f 100644 --- a/windows/keep-secure/guidance-and-best-practices-wip.md +++ b/windows/keep-secure/guidance-and-best-practices-wip.md @@ -29,4 +29,3 @@ This section includes info about the enlightened Microsoft apps, including how t >[!NOTE] >Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). ->>>>>>> refs/remotes/origin/master From 42cd46ba82e90730ef92a43f511e4e19dba50ea5 Mon Sep 17 00:00:00 2001 From: Greig Sheridan Date: Tue, 10 Jan 2017 08:36:03 +1100 Subject: [PATCH 21/42] Corrected Energy Star typo: changed "50" to "S0" --- devices/surface-hub/use-room-control-system-with-surface-hub.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface-hub/use-room-control-system-with-surface-hub.md b/devices/surface-hub/use-room-control-system-with-surface-hub.md index 71051b3d27..06b5f7dd0a 100644 --- a/devices/surface-hub/use-room-control-system-with-surface-hub.md +++ b/devices/surface-hub/use-room-control-system-with-surface-hub.md @@ -184,7 +184,7 @@ In Replacement PC mode, the power states are only Ready and Off and only change

5

-

50

+

S0

Ready

From bbb8d609c4f6905d4be7531af2c297b14b105f61 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 10 Jan 2017 12:58:25 -0800 Subject: [PATCH 22/42] isaiah feedback --- ...ine-deployment-surface-hub-device-accounts.md | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/devices/surface-hub/online-deployment-surface-hub-device-accounts.md b/devices/surface-hub/online-deployment-surface-hub-device-accounts.md index e42598a51d..d823adf130 100644 --- a/devices/surface-hub/online-deployment-surface-hub-device-accounts.md +++ b/devices/surface-hub/online-deployment-surface-hub-device-accounts.md @@ -54,13 +54,10 @@ If you have a pure, online (O365) deployment, then you can [use the provided Pow $easPolicy = New-MobileDeviceMailboxPolicy -Name “SurfaceHubs” -PasswordEnabled $false ``` - Once you have a compatible policy, then you will need to apply the policy to the device account. However, policies can only be applied to user accounts and not resource mailboxes. You need to convert the mailbox into a user type, apply the policy, and then convert it back into a mailbox—you may need to re-enable it and set the password again too. + Once you have a compatible policy, then you will need to apply the policy to the device account. ```PowerShell - Set-Mailbox 'HUB01@contoso.com' -Type Regular Set-CASMailbox 'HUB01@contoso.com' -ActiveSyncMailboxPolicy $easPolicy.Id - Set-Mailbox 'HUB01@contoso.com' -Type Room - Set-Mailbox 'HUB01@contoso.com' -RoomMailboxPassword (ConvertTo-SecureString -String -AsPlainText -Force) -EnableRoomMailboxAccount $true ``` 4. Various Exchange properties must be set on the device account to improve the meeting experience. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section. @@ -113,7 +110,9 @@ If you have a pure, online (O365) deployment, then you can [use the provided Pow ```PowerShell Get-CsOnlineUser -Identity ‘alice@contoso.com’| fl *registrarpool* + ``` OR by setting a variable + ```PowerShell $strRegistrarPool = (Get-CsOnlineUser -Identity ‘alice@contoso.com’).RegistrarPool ``` @@ -128,11 +127,10 @@ If you have a pure, online (O365) deployment, then you can [use the provided Pow Alternatively, You can assign a license to the Surface Hub through the Office 365 administrators portal: 1. Sign in as a tenant administrator, open the O365 Administrative Portal, and click the Admin app. -1. Click **Users and Groups** and then **Add users, reset passwords, and more**. -1. Select the Surface Hub account, and then click or tap the pen icon, which means edit. -1. Click the **Licenses** option. -1. In the **Assign licenses** section, select an appropriate license that meets the requirements in step 7 depending on your licensing and what you've decided in terms of needing Enterprise Voice. -1. Click **Save** and you're done. +1. Click **Users** > **Active users**. +1. Select the Surface Hub account. Under **Product licenses** (or **Assigned Licenses** if you’re using the old admin center), click **Edit**. +1. Select an appropriate license that meets the requirements in Step 7. +1. Click **Save**. From ab1fe0d1e617c875acc260816df60b88fb705d7f Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 10 Jan 2017 13:04:32 -0800 Subject: [PATCH 23/42] added to change history --- devices/surface-hub/change-history-surface-hub.md | 1 + 1 file changed, 1 insertion(+) diff --git a/devices/surface-hub/change-history-surface-hub.md b/devices/surface-hub/change-history-surface-hub.md index f85267c41d..81f40741b7 100644 --- a/devices/surface-hub/change-history-surface-hub.md +++ b/devices/surface-hub/change-history-surface-hub.md @@ -19,6 +19,7 @@ This topic lists new and updated topics in the [Surface Hub Admin Guide]( surfac | New or changed topic | Description | | --- | --- | | [Connect other devices and display with Surface Hub](connect-and-display-with-surface-hub.md) | Added graphics cards verified to work with 84" Surface Hubs and added information about the lengths of cables. | +| [Online deployment](online-deployment-surface-hub-device-accounts.md) | Updated procedures for adding a device account for your Microsoft Surface Hub when you have a pure, online deployment. | ## December 2016 From fb6eb0cd890a3bf2e30ee7ec0451c4c0dbf84fe1 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 10 Jan 2017 14:01:32 -0800 Subject: [PATCH 24/42] change telemetry to sensor data --- ...ript-windows-defender-advanced-threat-protection.md | 2 +- ...ints-windows-defender-advanced-threat-protection.md | 2 +- ...rnet-windows-defender-advanced-threat-protection.md | 2 +- ...ines-windows-defender-advanced-threat-protection.md | 10 +++++----- ...ents-windows-defender-advanced-threat-protection.md | 2 +- ...ding-windows-defender-advanced-threat-protection.md | 4 ++-- .../windows-defender-advanced-threat-protection.md | 4 ++-- 7 files changed, 13 insertions(+), 13 deletions(-) diff --git a/windows/keep-secure/configure-endpoints-script-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-script-windows-defender-advanced-threat-protection.md index a2643013c6..50903ddc26 100644 --- a/windows/keep-secure/configure-endpoints-script-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-script-windows-defender-advanced-threat-protection.md @@ -45,7 +45,7 @@ You can also manually onboard individual endpoints to Windows Defender ATP. You 5. Press the **Enter** key or click **OK**. -For for information on how you can manually validate that the endpoint is compliant and correctly reports telemetry see, [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md). +For for information on how you can manually validate that the endpoint is compliant and correctly reports sensor data see, [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md). ## Configure sample collection settings For each endpoint, you can set a configuration value to state whether samples can be collected from the endpoint when a request is made through the Windows Defender ATP portal to submit a file for deep analysis. diff --git a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md index 18864595b3..cca969958e 100644 --- a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md @@ -21,7 +21,7 @@ localizationpriority: high - Windows 10 Pro Education - Windows Defender Advanced Threat Protection (Windows Defender ATP) -Endpoints in your organization must be configured so that the Windows Defender ATP service can get telemetry from them. There are various methods and deployment tools that you can use to configure the endpoints in your organization. +Endpoints in your organization must be configured so that the Windows Defender ATP service can get sensor data from them. There are various methods and deployment tools that you can use to configure the endpoints in your organization. Windows Defender ATP supports the following deployment tools and methods: diff --git a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md index c24886d168..38a3f1edc2 100644 --- a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md @@ -22,7 +22,7 @@ localizationpriority: high - Windows 10 Pro Education - Windows Defender Advanced Threat Protection (Windows Defender ATP) -The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report telemetry and communicate with the Windows Defender ATP service. +The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report sensor data and communicate with the Windows Defender ATP service. The embedded Windows Defender ATP sensor runs in system context using the LocalSystem account. The sensor uses Microsoft Windows HTTP Services (WinHTTP) to enable communication with the Windows Defender ATP cloud service. diff --git a/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md index eec0ada5a4..bc3e8df73d 100644 --- a/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md @@ -21,12 +21,12 @@ localizationpriority: high - Windows 10 Pro Education - Windows Defender Advanced Threat Protection (Windows Defender ATP) -The **Machines view** shows a list of the machines in your network, the corresponding number of active alerts for each machine categorized by alert severity levels, and the number of active malware detections. This view allows you to identify machines with the highest risk at a glance, and keep track of all the machines that are reporting telemetry in your network. +The **Machines view** shows a list of the machines in your network, the corresponding number of active alerts for each machine categorized by alert severity levels, and the number of active malware detections. This view allows you to identify machines with the highest risk at a glance, and keep track of all the machines that are reporting sensor data in your network. Use the Machines view in these two main scenarios: - **During onboarding** - - During the onboarding process, the Machines view gradually gets populated with endpoints as they begin to report telemetry. Use this view to track your onboarded endpoints as they appear. Use the available features to sort and filer to see which endpoints have most recently reported telemetry, or download the complete endpoint list as a CSV file for offline analysis. + - During the onboarding process, the Machines view gradually gets populated with endpoints as they begin to report sensor data. Use this view to track your onboarded endpoints as they appear. Use the available features to sort and filer to see which endpoints have most recently reported sensor data, or download the complete endpoint list as a CSV file for offline analysis. - **Day-to-day work** - The **Machines view** enables you to identify machines that are most at risk in a glance. High-risk machines are those with the greatest number and highest-severity alerts. By sorting the machines by risk, you'll be able to identify the most vulnerable machines and take action on them. @@ -34,7 +34,7 @@ The Machines view contains the following columns: - **Machine name** - the name or GUID of the machine - **Domain** - the domain the machine belongs to -- **Last seen** - when the machine last reported telemetry +- **Last seen** - when the machine last reported sensor data - **Internal IP** - the local internal Internet Protocol (IP) address of the machine - **Active Alerts** - the number of alerts reported by the machine by severity - **Active malware detections** - the number of active malware detections reported by the machine @@ -59,7 +59,7 @@ You can filter the view by the following time periods: - 6 months > [!NOTE] -> When you select a time period, the list will only display machines that reported within the selected time period. For example, selecting 1 day will only display a list of machines that reported telemetry within the last 24-hour period. +> When you select a time period, the list will only display machines that reported within the selected time period. For example, selecting 1 day will only display a list of machines that reported sensor data within the last 24-hour period. The threat category filter lets you filter the view by the following categories: @@ -94,7 +94,7 @@ When you investigate a specific machine, you'll see: - **Alerts related to this machine** - **Machine timeline** -The machine details, IP, and reporting sections display some attributes of the machine such as its name, domain, OS, IP address, and how long it's been reporting telemetry to the Windows Defender ATP service. +The machine details, IP, and reporting sections display some attributes of the machine such as its name, domain, OS, IP address, and how long it's been reporting sensor data to the Windows Defender ATP service. The **Alerts related to this machine** section provides a list of alerts that are associated with the machine. This list is a simplified version of the [Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md), and shows the date that the alert was detected, a short description of the alert, the alert's severity, the alert's threat category, and the alert's status in the queue. diff --git a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md index a3358422cb..55a3242e78 100644 --- a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md @@ -61,7 +61,7 @@ Before you configure endpoints, the telemetry and diagnostics service must be en ### Telemetry and diagnostics settings You must ensure that the telemetry and diagnostics service is enabled on all the endpoints in your organization. -By default, this service is enabled, but it's good practice to check to ensure that you'll get telemetry from them. +By default, this service is enabled, but it's good practice to check to ensure that you'll get sensor data from them. **Use the command line to check the Windows 10 telemetry and diagnostics service startup type**: diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index 1cb5843937..e95197be01 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -1,7 +1,7 @@ --- title: Troubleshoot Windows Defender ATP onboarding issues description: Troubleshoot issues that might arise during the onboarding of endpoints or to the Windows Defender ATP service. -keywords: troubleshoot onboarding, onboarding issues, event viewer, data collection and preview builds, telemetry and diagnostics +keywords: troubleshoot onboarding, onboarding issues, event viewer, data collection and preview builds, sensor data and diagnostics search.product: eADQiWindows 10XVcnh ms.prod: w10 ms.mktglfcycl: deploy @@ -214,7 +214,7 @@ First, you should check that the service is set to start automatically when Wind ### Ensure the endpoint has an Internet connection -The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report telemetry and communicate with the Windows Defender ATP service. +The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report sensor data and communicate with the Windows Defender ATP service. WinHTTP is independent of the Internet browsing proxy settings and other user context applications and must be able to detect the proxy servers that are available in your particular environment. diff --git a/windows/keep-secure/windows-defender-advanced-threat-protection.md b/windows/keep-secure/windows-defender-advanced-threat-protection.md index 169cf8daa0..3dc835c6a2 100644 --- a/windows/keep-secure/windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/windows-defender-advanced-threat-protection.md @@ -32,7 +32,7 @@ Windows Defender ATP uses the following combination of technology built into Win - **Endpoint behavioral sensors**: Embedded in Windows 10, these sensors collect and process behavioral signals from the operating system (for example, process, registry, file, and network communications) - and sends this telemetry to your private, isolated, cloud instance of Windows Defender ATP. + and sends this sensor data to your private, isolated, cloud instance of Windows Defender ATP. - **Cloud security analytics**: Leveraging big-data, machine-learning, and @@ -47,7 +47,7 @@ Windows Defender ATP uses the following combination of technology built into Win and augmented by threat intelligence provided by partners, threat intelligence enables Windows Defender ATP to identify attacker tools, techniques, and procedures, and generate alerts when these - are observed in collected telemetry. + are observed in collected sensor data. The following diagram shows these Windows Defender ATP service components: From 99998a10ee6c484022a8e56184da4ce5bfd95d8f Mon Sep 17 00:00:00 2001 From: Justinha Date: Tue, 10 Jan 2017 16:24:33 -0800 Subject: [PATCH 25/42] New SSO topic --- windows/keep-secure/TOC.md | 1 + ...n-on-sso-over-vpn-and-wi-fi-connections.md | 76 +++++++++++++++++++ 2 files changed, 77 insertions(+) create mode 100644 windows/keep-secure/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index 99abea5c99..ee6d27ee47 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -872,4 +872,5 @@ ### [Windows 10 Mobile security guide](windows-10-mobile-security-guide.md) ### [Windows 10 security overview](windows-10-security-guide.md) ### [Windows 10 credential theft mitigation guide abstract](windows-credential-theft-mitigation-guide-abstract.md) +### [How to use single sign-on (SSO) over VPN and Wi-Fi connections](how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md) ## [Change history for Keep Windows 10 secure](change-history-for-keep-windows-10-secure.md) diff --git a/windows/keep-secure/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md b/windows/keep-secure/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md new file mode 100644 index 0000000000..a65fe6f219 --- /dev/null +++ b/windows/keep-secure/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md @@ -0,0 +1,76 @@ +--- +title: How to use single sign on (SSO) over VPN and Wi-Fi connections (Windows 10) +description: Describes the best practices, location, values, and security considerations for the Accounts Guest account status security policy setting. +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +author: brianlic-msft +--- + +# How to use single sign on (SSO) over VPN and Wi-Fi connections + +This topic explains requirements to enable Single Sign-On (SSO) to on-premises domain resources over WiFi or VPN connections. The scenario is: + +- You connect to a network using Wi-Fi or VPN. +- You want to use the credentials that you use for the WiFi or VPN authentication to also authenticate requests to access a domain resource you are connecting to, without being prompted for your domain credentials separately. + +For example, you want to connect to a corporate network and access an internal website that requires Windows integrated authentication. + +At a high level, the way this works is that the credentials that are used for the connection authentication are put in Credential Manager as the default credentials for the logon session. +Credential Manager is a place where credentials in the OS are can be stored for specific domain resources based on the targetname of the resource. +For VPN, the VPN stack saves its credential as the session default. +For WiFi, EAP does it. + +The credentials are put in Credential Manager as a "*Session" credential. +A "*Session" credential implies that it is valid for the current user session. +The credentials are also cleaned up when the WiFi or VPN connection is disconnected. + +When the user tries to access a domain resource, using Edge for example, Edge has the right Enterprise Authentication capability so WinInit.exe can release the credentials that it gets from the Credential Manager to the SSP that is requesting it. +For more information about the Enterprise Authentication capability, see [App capability declarations](https://msdn.microsoft.com/windows/uwp/packaging/app-capability-declarations). + +WinInit.exe will look at the device application, such as a Universal Windows Platform (UWP) application, to see if it has the right capability. +If the app is not UWP, it does not matter. +But if it is a UWP app, it will look at the device capability for Enterprise Authentication. +If it does have that capability and if the resource that you are trying to access is in the Intranet zone in the Internet Options (ZoneMap), then the credential will be released. + +## Intranet zone + +For the Intranet zone, by default it only allows single-label names, such as Http://finance. +If the resource that needs to be accessed has multiple domain labels, then the workaround is to use the [Registry CSP](https://msdn.microsoft.com/library/windows/hardware/dn904964.aspx). + +### Setting the ZoneMap + +The ZoneMap is controlled using a registry that can be set through MDM. +By default, single-label names such as http://finance are already in the intranet zone. +For multi-label names, such as http://finance.net, the ZoneMap needs to be updated. + +## MDM Policy + +OMA URI example: + +./Vendor/MSFT/Registry/HKU/S-1-5-21-2702878673-795188819-444038987-2781/Software/Microsoft/Windows/CurrentVersion/Internet%20Settings/ZoneMap/Domains/``/* as an Integer Value of 1 for each of the domains that you want to SSO into from your device. This adds the specified domains to the Intranet Zone of the Edge browser. + +## Credential requirements + +For VPN, the following types of credentials will be added to credential manager after authentication: + +- Username and password +- Certificate-based authentication: + - TPM KSP Certificate + - Software KSP Certificates + - Smart Card Certificate + - Passport for Work Certificate + +The username should also include a domain that can be reached over the connection (VPN or WiFi). + +## User certificate templates + +If the credentials are certificate-based, then the elements in the following table need to be configured for the certificate templates to ensure they can also be used for Kerberos client authentication. + +| TEmplate element | Configuration | +|------------------|---------------| +| SubjectName | The user’s distinguished name (DN) where the domain components of the distinguished name reflects the internal DNS namespace when the SubjectAlternativeName does not have the fully qualified UPN required to find the domain controller.
This requirement is particularly relevant in multi-forest environments as it ensures a domain controller can be located. | +| SubjectAlternativeName | The user’s fully qualified UPN where a domain name component of the user’s UPN matches the organizations internal domain’s DNS namespace.
This requirement is particularly relevant in multi-forest environments as it ensures a domain controller can be located when the SubjectName does not have the DN required to find the domain controller. | +| Key Storage Provider (KSP) | If the device is joined to Azure AD, a discrete SSO certificate is used. This certificate must be issued using the PassportForWork CSP. | +| EnhancedKeyUsage | One or more of the following EKUs is required:
- Client Authentication (for the VPN)
- EAP Filtering OID (for PassportForWork)
- SmartCardLogon (for Azure AD joined devices)
If the domain controllers require smart card EKU either:
- SmartCardLogon
- id-pkinit-KPClientAuth (1.3.6.1.5.2.3.4)
Otherwise:
- TLS/SSL Client Authentication (1.3.6.1.5.5.7.3.2) | From 8e8e10d3e4ef7acaacfabb78229fa135336fd099 Mon Sep 17 00:00:00 2001 From: Justinha Date: Tue, 10 Jan 2017 16:28:59 -0800 Subject: [PATCH 26/42] fixed formatting --- ...o-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md b/windows/keep-secure/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md index a65fe6f219..37f2385dd6 100644 --- a/windows/keep-secure/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md +++ b/windows/keep-secure/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md @@ -22,8 +22,8 @@ Credential Manager is a place where credentials in the OS are can be stored for For VPN, the VPN stack saves its credential as the session default. For WiFi, EAP does it. -The credentials are put in Credential Manager as a "*Session" credential. -A "*Session" credential implies that it is valid for the current user session. +The credentials are put in Credential Manager as a "`*Session`" credential. +A "`*Session`" credential implies that it is valid for the current user session. The credentials are also cleaned up when the WiFi or VPN connection is disconnected. When the user tries to access a domain resource, using Edge for example, Edge has the right Enterprise Authentication capability so WinInit.exe can release the credentials that it gets from the Credential Manager to the SSP that is requesting it. From c37bcd00dae66178f885158a762ff93938889fd9 Mon Sep 17 00:00:00 2001 From: Justinha Date: Tue, 10 Jan 2017 17:09:11 -0800 Subject: [PATCH 27/42] added link --- .../windows-credential-theft-mitigation-guide-abstract.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/windows-credential-theft-mitigation-guide-abstract.md b/windows/keep-secure/windows-credential-theft-mitigation-guide-abstract.md index 0386127ed4..44a10d1bbe 100644 --- a/windows/keep-secure/windows-credential-theft-mitigation-guide-abstract.md +++ b/windows/keep-secure/windows-credential-theft-mitigation-guide-abstract.md @@ -14,7 +14,7 @@ author: justinha **Applies to** - Windows 10 -This topic provides a summary of the Windows 10 credential theft mitigation guide, which can be downloaded from the Microsoft Download Center. +This topic provides a summary of the Windows 10 credential theft mitigation guide, which can be downloaded from the [Microsoft Download Center](http://download.microsoft.com/download/C/1/4/C14579CA-E564-4743-8B51-61C0882662AC/Windows 10 credential theft mitigation guide.docx). This guide explains how credential theft attacks occur and the strategies and countermeasures you can implement to mitigate them, following these security stages: - Identify high-value assets From 6af8392cd15adcbb847cc3a97742cc4e8abc3be3 Mon Sep 17 00:00:00 2001 From: Justinha Date: Tue, 10 Jan 2017 17:19:27 -0800 Subject: [PATCH 28/42] fixed author --- ...o-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md b/windows/keep-secure/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md index 37f2385dd6..827fe72de7 100644 --- a/windows/keep-secure/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md +++ b/windows/keep-secure/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md @@ -1,11 +1,11 @@ --- title: How to use single sign on (SSO) over VPN and Wi-Fi connections (Windows 10) -description: Describes the best practices, location, values, and security considerations for the Accounts Guest account status security policy setting. +description: Explains requirements to enable Single Sign-On (SSO) to on-premises domain resources over WiFi or VPN connections. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -author: brianlic-msft +author: justinha --- # How to use single sign on (SSO) over VPN and Wi-Fi connections From a354df4713e55e85ddc9f8011bde0528c67ad98a Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 11 Jan 2017 08:18:25 -0800 Subject: [PATCH 29/42] Fixed branding --- windows/keep-secure/using-owa-with-wip.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/using-owa-with-wip.md b/windows/keep-secure/using-owa-with-wip.md index 7610b5120a..f4046b30a6 100644 --- a/windows/keep-secure/using-owa-with-wip.md +++ b/windows/keep-secure/using-owa-with-wip.md @@ -27,7 +27,7 @@ Because Outlook Web Access (OWA) can be used both personally and as part of your |Add outlook.office.com to the Enterprise Cloud Resources network element in your WIP policy. |All mailboxes are automatically marked as corporate. This means any personal inboxes hosted on Office 365 are also automatically marked as corporate data. | >[!NOTE] ->These limitations don’t apply to Outlook 2016 or to the Office365 Mail and Calendar apps. These apps will work properly, marking an employee’s mailbox as corporate data, regardless of how you’ve configured outlook.office.com in your network settings. +>These limitations don’t apply to Outlook 2016 or to the Office 365 Mail and Calendar apps. These apps will work properly, marking an employee’s mailbox as corporate data, regardless of how you’ve configured outlook.office.com in your network settings. From 1fcd7b73a840d14c28886996fdf985e7a809e748 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 11 Jan 2017 08:53:10 -0800 Subject: [PATCH 30/42] Updated to change name from Windows SmartScreen to Windows Defender SmartScreen --- .../edge/enterprise-guidance-using-microsoft-edge-and-ie11.md | 2 +- browsers/edge/security-enhancements-microsoft-edge.md | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/browsers/edge/enterprise-guidance-using-microsoft-edge-and-ie11.md b/browsers/edge/enterprise-guidance-using-microsoft-edge-and-ie11.md index 4cabfa693f..f7f13b7873 100644 --- a/browsers/edge/enterprise-guidance-using-microsoft-edge-and-ie11.md +++ b/browsers/edge/enterprise-guidance-using-microsoft-edge-and-ie11.md @@ -44,7 +44,7 @@ IE11 offers enterprises additional security, manageability, performance, backwar - **Backward compatibility.** IE11 supports 9 document modes that include high-fidelity emulations for older versions of IE. - **Modern web standards.** IE11 supports modern web technologies like HTML5, CSS3, and WebGL, which help to ensure today's modern websites and apps work just as well as your old, legacy websites and apps. -- **More secure.** IE11 was designed with security in mind and is more secure than older versions. Using security features like SmartScreen and Enhanced Protected Mode can help IE11 reduce your risk. +- **More secure.** IE11 was designed with security in mind and is more secure than older versions. Using security features like Windows Defender SmartScreen and Enhanced Protected Mode can help IE11 reduce your risk. - **Faster.** IE11 is significantly faster than previous versions of Internet Explorer, taking advantage of network optimization and hardware-accelerated text, graphics, and JavaScript rendering. - **Easier migration to Windows 10.** IE11 is the only version of IE that runs on Windows 7, Windows 8.1, and Windows 10. Upgrading to IE11 on Windows 7 can also help your organization support the next generation of software, services, and devices. - **Administration.** IE11 can use the Internet Explorer Administration Kit (IEAK) 11 or MSIs for deployment, and includes more than 1,600 Group Policies and preferences for granular control. diff --git a/browsers/edge/security-enhancements-microsoft-edge.md b/browsers/edge/security-enhancements-microsoft-edge.md index 17ac7d1722..21db027bdc 100644 --- a/browsers/edge/security-enhancements-microsoft-edge.md +++ b/browsers/edge/security-enhancements-microsoft-edge.md @@ -36,8 +36,8 @@ To really address this problem, we need to stop people from entering plain-text Microsoft Edge is the first browser to natively support Windows Hello as a more personal, seamless, and secure way to authenticate on the web, powered by an early implementation of the [Web Authentication (formerly FIDO 2.0 Web API) specification](http://w3c.github.io/webauthn/). -#### Microsoft SmartScreen -Microsoft SmartScreen, used in Windows 10 and both Internet Explorer 11 and Microsoft Edge, helps to defend against phishing by performing reputation checks on visited sites and blocking any sites that are thought to be phishing sites. SmartScreen also helps to defend people against being tricked into installing malicious [socially-engineered software downloads](http://operationstech.about.com/od/glossary/g/Socially-Engineered-Malware.htm and against [drive-by attacks](https://blogs.windows.com/msedgedev/2015/12/16/smartscreen-drive-by-improvements/). Drive-by attacks are malicious web-based attacks that compromise your system by targeting security vulnerabilities in commonly used software, and may be hosted on trusted sites. +#### Windows Defender SmartScreen +Windows Defender SmartScreen, used in Windows 10 and both Internet Explorer 11 and Microsoft Edge, helps to defend against phishing by performing reputation checks on visited sites and blocking any sites that are thought to be phishing sites. Windows Defender SmartScreen also helps to defend people against being tricked into installing malicious [socially-engineered software downloads](http://operationstech.about.com/od/glossary/g/Socially-Engineered-Malware.htm and against [drive-by attacks](https://blogs.windows.com/msedgedev/2015/12/16/smartscreen-drive-by-improvements/). Drive-by attacks are malicious web-based attacks that compromise your system by targeting security vulnerabilities in commonly used software, and may be hosted on trusted sites. #### Certificate Reputation system While people trust sites that have encrypted web traffic, that trust can be undermined by malicious sites using improperly obtained or fake certificates to impersonate legitimate sites. To help address this problem, we introduced the [Certificate Reputation system](http://blogs.msdn.com/b/ie/archive/2014/03/10/certificate-reputation-a-novel-approach-for-protecting-users-from-fraudulent-certificates.aspx) last year. This year, we’ve extended the system to let web developers use the [Bing Webmaster Tools](http://www.bing.com/toolbox/webmaster) to report directly to Microsoft to let us know about fake certificates. From 4b444d1e4c73a716c0824ae721c171320f81eb66 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 11 Jan 2017 14:13:35 -0800 Subject: [PATCH 31/42] Updated policy descriptions for Windows Defender SmartScreen --- browsers/edge/available-policies.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/browsers/edge/available-policies.md b/browsers/edge/available-policies.md index 680e73b52a..1628bff940 100644 --- a/browsers/edge/available-policies.md +++ b/browsers/edge/available-policies.md @@ -40,11 +40,11 @@ Microsoft Edge works with these Group Policy settings (`Computer Configuration\A |Configure Password Manager |Windows 10 or later |This policy setting lets you decide whether employees can save their passwords locally, using Password Manager. By default, Password Manager is turned on.

If you enable this setting, employees can use Password Manager to save their passwords locally.

If you disable this setting, employees can’t use Password Manager to save their passwords locally.

If you don’t configure this setting, employees can choose whether to use Password Manager to save their passwords locally. |**Not configured:** Employees can choose whether to use Password Manager.

**Enabled (default):** Employees can use Password Manager to save passwords locally.

**Disabled:** Employees can't use Password Manager to save passwords locally. | |Configure Pop-up Blocker |Windows 10 or later |This policy setting lets you decide whether to turn on Pop-up Blocker. By default, Pop-up Blocker is turned on.

If you enable this setting, Pop-up Blocker is turned on, stopping pop-up windows from appearing.

If you disable this setting, Pop-up Blocker is turned off, letting pop-ups windows appear.

If you don’t configure this setting, employees can choose whether to use Pop-up Blocker. |**Enabled or not configured (default):** Turns on Pop-up Blocker, stopping pop-up windows.

**Disabled:** Turns off Pop-up Blocker, allowing pop-up windows. | |Configure search suggestions in Address bar |Windows 10 or later |This policy setting lets you decide whether search suggestions appear in the Address bar of Microsoft Edge. By default, employees can choose whether search suggestions appear in the Address bar of Microsoft Edge.

If you enable this setting, employees can see search suggestions in the Address bar of Microsoft Edge.

If you disable this setting, employees can't see search suggestions in the Address bar of Microsoft Edge.

If you don’t configure this setting, employees can choose whether search suggestions appear in the Address bar of Microsoft Edge. |**Not configured (default):** Employees can choose whether search suggestions appear in the Address bar of Microsoft Edge.

**Enabled:** Employees can see search suggestions in the Address bar of Microsoft Edge.

**Disabled:** Employees can’t see search suggestions in the Address bar of Microsoft Edge. | -|Configure SmartScreen Filter |Windows 10 or later |This policy setting lets you configure whether to turn on SmartScreen Filter. SmartScreen Filter provides warning messages to help protect your employees from potential phishing scams and malicious software. By default, SmartScreen Filter is turned on.

If you enable this setting, SmartScreen Filter is turned on and employees can’t turn it off.

If you disable this setting, SmartScreen Filter is turned off and employees can’t turn it on.

If you don’t configure this setting, employees can choose whether to use SmartScreen Filter. |**Not configured (default):** Employees can choose whether to use SmartScreen Filter.

**Enabled:** Turns on SmartScreen Filter, providing warning messages to your employees about potential phishing scams and malicious software.

**Disabled:** Turns off SmartScreen Filter. | +|Configure SmartScreen Filter |Windows 10 or later |This policy setting lets you configure whether to turn on Windows Defender SmartScreen. Windows Defender SmartScreen provides warning messages to help protect your employees from potential phishing scams and malicious software. By default, Windows Defender SmartScreen is turned on.

If you enable this setting, Windows Defender SmartScreen is turned on and employees can’t turn it off.

If you disable this setting, Windows Defender SmartScreen is turned off and employees can’t turn it on.

If you don’t configure this setting, employees can choose whether to use Windows Defender SmartScreen. |**Not configured (default):** Employees can choose whether to use Windows Defender SmartScreen.

**Enabled:** Turns on Windows Defender SmartScreen, providing warning messages to your employees about potential phishing scams and malicious software.

**Disabled:** Turns off Windows Defender SmartScreen. | |Configure the Enterprise Mode Site List |Windows 10 or later| This policy setting lets you configure whether to use Enterprise Mode and the Enterprise Mode Site List to address common compatibility problems with legacy apps.

If you enable this setting, Microsoft Edge looks for the Enterprise Mode Site List XML file. This file includes the sites and domains that need to be viewed using Internet Explorer 11 and Enterprise Mode.

If you disable or don’t configure this setting, Microsoft Edge won’t use the Enterprise Mode Site List XML file. In this case, employees might experience compatibility problems while using legacy apps.

**Note**
If there’s an .xml file in the cache container, IE waits 65 seconds and then checks the local cache for a newer version of the file from the server, based on standard caching rules. If the server file has a different version number than the version in the cache container, the server file is used and stored in the cache container.

If you’re already using a site list, enterprise mode continues to work during the 65 second wait; it just uses your existing site list instead of your new one.|**Enabled:** Lets you use the Enterprise Mode Site List to address common compatibility problems with legacy apps, if it’s configured.

If you use this option, you must also add the location to your site list in the `{URI}` box. When configured, any site on the list will always open in Internet Explorer 11.

**Disabled or not configured (default):** You won't be able to use the Enterprise Mode Site List.| |Prevent access to the about:flags page |Windows 10, Version 1607 or later|This policy setting lets you decide whether employees can access the about:flags page, which is used to change developer settings and to enable experimental features.

If you enable this policy setting, employees can’t access the about:flags page.

If you disable or don’t configure this setting, employees can access the about:flags page. |**Enabled:** Stops employees from using the about:flags page.

**Disabled or not configured (default):** Lets employees use the about:flags page. | -|Prevent bypassing SmartScreen prompts for files |Windows 10, Version 1511 or later |This policy setting lets you decide whether employees can override the SmartScreen Filter warnings about downloading unverified files.

If you enable this setting, employees can’t ignore SmartScreen Filter warnings and they’re blocked from downloading the unverified files.

If you disable or don’t configure this setting, employees can ignore SmartScreen Filter warnings and continue the download process. |**Enabled:** Stops employees from ignoring the SmartScreen Filter warnings about unverified files.

**Disabled or not configured (default):** Lets employees ignore the SmartScreen Filter warnings about unverified files and lets them continue the download process. | -|Prevent bypassing SmartScreen prompts for sites |Windows 10, Version 1511 or later |This policy setting lets you decide whether employees can override the SmartScreen Filter warnings about potentially malicious websites.

If you enable this setting, employees can’t ignore SmartScreen Filter warnings and they’re blocked from continuing to the site.

If you disable or don’t configure this setting, employees can ignore SmartScreen Filter warnings and continue to the site. |**Enabled:** Stops employees from ignoring the SmartScreen Filter warnings about potentially malicious sites.

**Disabled or not configured (default):** Lets employees ignore the SmartScreen Filter warnings about potentially malicious sites and continue to the site. | +|Prevent bypassing SmartScreen prompts for files |Windows 10, Version 1511 or later |This policy setting lets you decide whether employees can override the Windows Defender SmartScreen warnings about downloading unverified files.

If you enable this setting, employees can’t ignore Windows Defender SmartScreen warnings and they’re blocked from downloading the unverified files.

If you disable or don’t configure this setting, employees can ignore Windows Defender SmartScreen warnings and continue the download process. |**Enabled:** Stops employees from ignoring the Windows Defender SmartScreen warnings about unverified files.

**Disabled or not configured (default):** Lets employees ignore the Windows Defender SmartScreen warnings about unverified files and lets them continue the download process. | +|Prevent bypassing SmartScreen prompts for sites |Windows 10, Version 1511 or later |This policy setting lets you decide whether employees can override the Windows Defender SmartScreen warnings about potentially malicious websites.

If you enable this setting, employees can’t ignore Windows Defender SmartScreen warnings and they’re blocked from continuing to the site.

If you disable or don’t configure this setting, employees can ignore Windows Defender SmartScreen warnings and continue to the site. |**Enabled:** Stops employees from ignoring the Windows Defender SmartScreen warnings about potentially malicious sites.

**Disabled or not configured (default):** Lets employees ignore the Windows Defender SmartScreen warnings about potentially malicious sites and continue to the site. | |Prevent using Localhost IP address for WebRTC |Windows 10, Version 1511 or later |This policy setting lets you decide whether an employee’s Localhost IP address shows while making calls using the WebRTC protocol. By default, this setting is turned off.

If you enable this setting, Localhost IP addresses are hidden while making calls using the WebRTC protocol.

If you disable or don’t configure this setting, Localhost IP addresses are shown while making calls using the WebRTC protocol. |**Enabled:** Hides the Localhost IP address during calls using the WebRTC protocol.

**Disabled or not configured (default):** Shows the Localhost IP address during phone calls using the WebRTC protocol. | |Send all intranet sites to Internet Explorer 11 |Windows 10 or later |This policy setting lets you decide whether your intranet sites should all open using Internet Explorer 11. This setting should only be used if there are known compatibility problems with Microsoft Edge.

If you enable this setting, all intranet sites are automatically opened using Internet Explorer 11.

If you disable or don’t configure this setting, all websites, including intranet sites, are automatically opened using Microsoft Edge. |**Enabled:** Automatically opens all intranet sites using Internet Explorer 11.

**Disabled or not configured (default):** Automatically opens all websites, including intranet sites, using Microsoft Edge. | |Show message when opening sites in Internet Explorer |Windows 10, Version 1607 and later |This policy setting lets you decide whether employees see an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11.

If you enable this setting, employees see an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11.

If you disable or don’t configure this setting, the default app behavior occurs and no additional page appears. |**Enabled:** Shows an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11.

**Disabled or not configured (default):** Doesn’t show an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11. | @@ -75,14 +75,14 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U |AllowPasswordManager |Windows 10 or later |Both |

  • **URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowPasswordManager
  • **Data type.** Integer
  • **Allowed values:**
    • **0 (default).** Employees can't use Password Manager to save passwords locally.
    • **1.** Employees can use Password Manager to save passwords locally.
| |AllowPopups |Windows 10 or later |Desktop |
  • **URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowPopups
  • **Data type.** Integer
  • **Allowed values:**
    • **0 (default).** Turns off Pop-up Blocker, allowing pop-up windows.
    • **1.** Turns on Pop-up Blocker, stopping pop-up windows.
| |AllowSearchSuggestions
inAddressBar |Windows 10 or later |Both |
  • **URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowSearchSuggestionsinAddressBar
  • **Data type.** Integer
  • **Allowed values:**
    • **0 (default).** Employees can’t see search suggestions in the Address bar of Microsoft Edge.
    • **1.** Employees can see search suggestions in the Address bar of Microsoft Edge.
| -|AllowSmartScreen |Windows 10 or later |Both |
  • **URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowSmartScreen
  • **Data type.** Integer
  • **Allowed values:**
    • **0 (default).** Turns off SmartScreen Filter.
    • **1.** Turns on SmartScreen Filter, providing warning messages to your employees about potential phishing scams and malicious software.
| +|AllowSmartScreen |Windows 10 or later |Both |
  • **URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowSmartScreen
  • **Data type.** Integer
  • **Allowed values:**
    • **0 (default).** Turns off Windows Defender SmartScreen.
    • **1.** Turns on Windows Defender SmartScreen, providing warning messages to your employees about potential phishing scams and malicious software.
| |EnterpriseModeSiteList |Windows 10 or later |Desktop |
  • **URI full path.** ./Vendor/MSFT/Policy/Config/Browser/EnterpriseModeSiteList
  • **Data type.** String
  • **Allowed values:**
    • Not configured.
    • **1 (default).** Use the Enterprise Mode Site List, if configured.
    • **2.** Specify the location to the site list.

    **Note**
    If there’s an .xml file in the cache container, IE waits 65 seconds and then checks the local cache for a newer version of the file from the server, based on standard caching rules. If the server file has a different version number than the version in the cache container, the server file is used and stored in the cache container.

    If you’re already using a site list, enterprise mode continues to work during the 65 second wait; it just uses your existing site list instead of your new one.

| |Favorites |Windows 10, Version 1511 or later |Both |