diff --git a/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md b/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md index 63373c2a34..59f3f7c19e 100644 --- a/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md +++ b/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md @@ -30,9 +30,11 @@ Turn on Microsoft Defender Application Guard in Enterprise Mode. Value type is integer. Supported operations are Add, Get, Replace, and Delete. -The following list shows the supported values: -- 0 - Stops Application Guard in Enterprise Mode. Trying to access non-enterprise domains on the host will not automatically get transferred into the insolated environment. -- 1 - Enables Application Guard in Enterprise Mode. Trying to access non-enterprise websites on the host will automatically get transferred into the container. +The following list shows the supported values: +- 0 - Disable Microsoft Defender Application Guard +- 1 - Enable Microsoft Defender Application Guard for Microsoft Edge ONLY +- 2 - Enable Microsoft Defender Application Guard for isolated Windows environments ONLY +- 3 - Enable Microsoft Defender Application Guard for Microsoft Edge AND isolated Windows environments **Settings/ClipboardFileType** Determines the type of content that can be copied from the host to Application Guard environment and vice versa. @@ -297,4 +299,4 @@ ADMX Info: - GP name: *AuditApplicationGuard* - GP path: *Windows Components/Microsoft Defender Application Guard* - GP ADMX file name: *AppHVSI.admx* - \ No newline at end of file + diff --git a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md index c1f81c4974..73946540c5 100644 --- a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md +++ b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md @@ -129,7 +129,8 @@ If you don't know the Store app publisher or product name, you can find them by If you need to add Windows 10 mobile apps that aren't distributed through the Store for Business, you must use the **Windows Device Portal** feature. ->**Note**
Your PC and phone must be on the same wireless network. +> [!NOTE] +> Your PC and phone must be on the same wireless network. 1. On the Windows Phone, go to **Settings**, choose **Update & security**, and then choose **For developers**. @@ -194,19 +195,19 @@ To add another Desktop app, click the ellipsis **…**. After you’ve entered t If you’re unsure about what to include for the publisher, you can run this PowerShell command: -```ps1 +```powershell Get-AppLockerFileInformation -Path "" ``` Where `""` goes to the location of the app on the device. For example: -```ps1 +```powershell Get-AppLockerFileInformation -Path "C:\Program Files\Windows NT\Accessories\wordpad.exe" ``` In this example, you'd get the following info: -``` +```console Path Publisher ---- --------- %PROGRAMFILES%\WINDOWS NT\ACCESSORIES\WORDPAD.EXE O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US @@ -279,22 +280,22 @@ For more info about AppLocker, see the [AppLocker](https://technet.microsoft.com This is the XML file that AppLocker creates for Microsoft Dynamics 365. ```xml - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + ``` 12. After you’ve created your XML file, you need to import it by using Microsoft Intune. @@ -335,6 +336,7 @@ The executable rule helps to create an AppLocker rule to sign any unsigned apps. 12. After you’ve created your XML file, you need to import it by using Microsoft Intune. + **To import a list of protected apps using Microsoft Intune** 1. In **Protected apps**, click **Import apps**. @@ -428,7 +430,7 @@ Separate multiple resources with the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example: -```code +```console URL <,proxy>|URL <,proxy> ``` @@ -441,7 +443,7 @@ In this case, Windows blocks the connection by default. To stop Windows from automatically blocking these connections, you can add the `/*AppCompat*/` string to the setting. For example: -```code +```console URL <,proxy>|URL <,proxy>/*AppCompat*/ ``` @@ -449,14 +451,14 @@ When you use this string, we recommend that you also turn on [Azure Active Direc Value format with proxy: -```code +```console contoso.sharepoint.com,contoso.internalproxy1.com|contoso.visualstudio.com,contoso.internalproxy2.com ``` Value format without proxy: -```code -contoso.sharepoint.com|contoso.visualstudio.com +```console +contoso.sharepoint.com,|contoso.visualstudio.com,|contoso.onedrive.com ``` ### Protected domains @@ -465,7 +467,7 @@ Specify the domains used for identities in your environment. All traffic to the fully-qualified domains appearing in this list will be protected. Separate multiple domains with the "|" delimiter. -```code +```console exchange.contoso.com|contoso.com|region.contoso.com ``` @@ -475,7 +477,7 @@ Specify the DNS suffixes used in your environment. All traffic to the fully-qualified domains appearing in this list will be protected. Separate multiple resources with the "," delimiter. -```code +```console corp.contoso.com,region.contoso.com ``` @@ -488,7 +490,7 @@ This list shouldn’t include any servers listed in your Internal proxy servers Internal proxy servers must be used only for WIP-protected (enterprise) traffic. Separate multiple resources with the ";" delimiter. -```code +```console proxy.contoso.com:80;proxy2.contoso.com:443 ``` @@ -500,7 +502,7 @@ This list shouldn’t include any servers listed in your Proxy servers list. Proxy servers must be used only for non-WIP-protected (non-enterprise) traffic. Separate multiple resources with the ";" delimiter. -```code +```console contoso.internalproxy1.com;contoso.internalproxy2.com ``` @@ -539,7 +541,7 @@ Specify your authentication redirection endpoints for your company. These locations are considered enterprise or personal, based on the context of the connection before the redirection. Separate multiple resources with the "," delimiter. -```code +```console sts.contoso.com,sts.contoso2.com ``` @@ -597,8 +599,8 @@ After you've decided where your protected apps can access enterprise data on you - **Off, or not configured.** Stops WIP from encrypting Azure Rights Management files that are copied to a removable drive. ->[!NOTE] ->Regardless of this setting, all files in OneDrive for Business will be encrypted, including moved Known Folders. + > [!NOTE] + > Regardless of this setting, all files in OneDrive for Business will be encrypted, including moved Known Folders. **Allow Windows Search Indexer to search encrypted files.** Determines whether to allow the Windows Search Indexer to index items that are encrypted, such as WIP protected files. diff --git a/windows/security/threat-protection/microsoft-defender-atp/run-detection-test.md b/windows/security/threat-protection/microsoft-defender-atp/run-detection-test.md index 0d98b91181..d87232b04b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/run-detection-test.md +++ b/windows/security/threat-protection/microsoft-defender-atp/run-detection-test.md @@ -50,3 +50,4 @@ The Command Prompt window will close automatically. If successful, the detection ## Related topics - [Onboard Windows 10 devices](configure-endpoints.md) - [Onboard servers](configure-server-endpoints.md) +- [Troubleshoot Microsoft Defender Advanced Threat Protection onboarding issues](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding)