diff --git a/windows/client-management/manage-click-to-do.md b/windows/client-management/manage-click-to-do.md index a972b9a325..0195fe8a3c 100644 --- a/windows/client-management/manage-click-to-do.md +++ b/windows/client-management/manage-click-to-do.md @@ -20,9 +20,11 @@ appliesto: Click to Do (preview) helps users to get things done faster by identifying text and images that are currently on their screen so they can perform actions on them. This article provides information about Click to Do and how to manage it in a commercial environment. > [!NOTE] +> - Click to Do is behind [temporary enterprise feature control](/windows/whats-new/temporary-enterprise-feature-control) and will be enabled when the next annual feature update is installed. To enable Click to Do, use the **Enable features introduced via servicing that are off by default** policy setting. For more information, see [Enable features introduced via servicing that are off by default](/windows/deployment/update/waas-configure-wufb#enable-features-introduced-via-servicing-that-are-off-by-default). > - In-market commercial devices are defined as devices with an Enterprise (ENT) or Education (EDU) SKU or any premium SKU device that is managed by an IT administrator (whether via Microsoft Endpoint Manager or other endpoint management solution), has a volume license key, or is joined to a domain. Commercial devices during Out of Box Experience (OOBE) are defined as those with ENT or EDU SKU or any premium SKU device that has a volume license key or is Microsoft Entra joined. > - Click to Do is optimized for select languages English, Chinese (simplified), French, German, Japanese, and Spanish. Content-based and storage limitations apply. For more information, see [https://aka.ms/copilotpluspcs](https://aka.ms/copilotpluspcs). + ## What is Click to Do? Click to Do (preview) analyzes what's on the screen and then allows users to choose the text or image they want to take action on. Users can open Click to Do by using **Windows key** + **Q** or with **Windows key** + **mouse click**. Other entry points for Click to Do include right swipe on touch enabled PCs, Snipping Tool, search results, and the Start menu. @@ -64,7 +66,8 @@ The policy setting below allows you to determine whether Click to Do is availabl - When the policy is disabled or not configured, users will have Click to Do available on their device. > [!Important] -> This policy doesn't affect Click to Do in Recall. For more information, see [Manage Recall](manage-recall.md). +> - This policy doesn't affect Click to Do in Recall. For more information, see [Manage Recall](manage-recall.md). +> - If a user prefers to disable Click to Do on their device, they can turn it **Off** using the **Click to Do** setting under **Settings** > **Privacy & security** > **Click to Do**. ## Click to Do privacy considerations diff --git a/windows/client-management/mdm/eap-configuration.md b/windows/client-management/mdm/eap-configuration.md index cb42cb7572..f5e211ef20 100644 --- a/windows/client-management/mdm/eap-configuration.md +++ b/windows/client-management/mdm/eap-configuration.md @@ -1,12 +1,12 @@ --- title: EAP configuration -description: Learn how to create an Extensible Authentication Protocol (EAP) configuration XML for a VPN profile, including details about EAP certificate filtering in Windows 10. +description: Learn how to create an Extensible Authentication Protocol (EAP) configuration XML for a VPN profile, including details about EAP certificate filtering in Windows. ms.date: 06/26/2017 --- # EAP configuration -This article provides a step-by-step guide for creating an Extensible Authentication Protocol (EAP) configuration XML for a VPN profile, including information about EAP certificate filtering in Windows 10. +This article provides a step-by-step guide for creating an Extensible Authentication Protocol (EAP) configuration XML for a VPN profile, including information about EAP certificate filtering in Windows. While the screenshots are specifically for VPN, the EAP portions are applicable to Wi-Fi and Wired EAP profiles as well. For more information, see [Configure EAP profiles and settings in Windows](/windows-server/networking/technologies/extensible-authentication-protocol/configure-eap-profiles). ## Create an EAP configuration XML for a VPN profile @@ -292,6 +292,8 @@ Alternatively, you can use the following procedure to create an EAP configuratio > [!NOTE] > You can also set all the other applicable EAP Properties through this UI as well. A guide for what these properties mean can be found in the [Extensible Authentication Protocol (EAP) for network access](/windows-server/networking/technologies/extensible-authentication-protocol/network-access) article. -## Related topics +## Related articles -[Configuration service provider reference](index.yml) +* [Configuration service provider reference](index.yml) +* [Extensible Authentication Protocol (EAP) for network access](/windows-server/networking/technologies/extensible-authentication-protocol/network-access) +* [Configure EAP profiles and settings in Windows](/windows-server/networking/technologies/extensible-authentication-protocol/configure-eap-profiles) \ No newline at end of file diff --git a/windows/client-management/mdm/wifi-csp.md b/windows/client-management/mdm/wifi-csp.md index 5a09b0e1ee..784e8088ba 100644 --- a/windows/client-management/mdm/wifi-csp.md +++ b/windows/client-management/mdm/wifi-csp.md @@ -1,7 +1,7 @@ --- title: WiFi CSP description: Learn more about the WiFi CSP. -ms.date: 03/12/2025 +ms.date: 05/13/2025 ms.topic: generated-reference --- @@ -16,12 +16,11 @@ The WiFi configuration service provider provides the functionality to add or del Programming considerations: -- If the authentication method needs a certificate, for example, EAP-TLS requires client certificates, you must configure it through the CertificateStore configuration service provider. The WiFi configuration service provider doesn't provide that functionality; instead, the Wi-Fi profile can specify characteristics of the certificate to be used for choosing the right certificate for that network. The server must successfully enroll the certificate first before deploying the Wi-Fi network configuration. For example, for an EAP-TLS profile, the server must successfully configure and enroll the required client certificate before deploying the Wi-Fi profile. Self-signed certificate works for EAP-TLS/PEAP-MSCHAPv2, but it isn't supported in EAP-TLS. +- If the authentication method needs a certificate (for example, client certificates for EAP-TLS), you must configure it through the [CertificateStore](certificatestore-csp.md) configuration service provider. The WiFi configuration service provider doesn't provide that functionality; instead, the Wi-Fi profile can specify characteristics of the certificate to be used for choosing the right certificate for that network. The server must successfully enroll the certificate first before deploying the Wi-Fi network configuration. For example, for an EAP-TLS profile, the server must successfully configure and enroll the required client certificate before deploying the Wi-Fi profile. Self-signed certificate works for EAP-TLS/PEAP-MSCHAPv2, but it isn't supported in EAP-TLS. - For WEP, WPA, and WPA2-based networks, include the passkey in the network configuration in plaintext. The passkey is encrypted automatically when it's stored on the device. -- The SSID of the Wi-Fi network part of the LocURI node must be a valid URI based on RFC 2396. This condition requires that all non-ASCII characters must be escaped using a %-character. Unicode characters without the necessary escaping aren't supported. -- The `name_goes_here\` must match `name_goes_here`. +- The `SSID` part of the LocURI node must be a valid URI based on RFC 2396. This condition requires that all nonexcluded ASCII characters must be escaped using a %-character, including replacing the space character (' ') with '%20'. Characters (including Unicode) without the necessary escaping aren't supported. - For the WiFi CSP, you can't use the Replace command unless the node already exists. -- Using ProxyPacUrl or ProxyWPAD in Windows 10 client editions (Home, Pro, Enterprise, and Education) will result in failure. +- Using `Proxy`, `ProxyPacUrl` or `ProxyWPAD` in Windows client editions (Home, Pro, Enterprise, and Education) may fail or have no effect. Use [NetworkProxy](networkproxy-csp.md) CSP instead. @@ -108,9 +107,13 @@ The Profile name of the Wi-Fi network. This is added when WlanXml node is added -Specifies the name of the Wi-Fi network (32 bytes maximum) to create, configure, query, or delete. The name is case sensitive and can be represented in ASCII. +Specifies the Profile name of the Wi-Fi network (32 bytes maximum) to create, configure, query, or delete. The name is case sensitive and can be represented in ASCII. In the URI, it must be %-escaped, but the non-%-escaped value is used inside the system. + +> [!NOTE] +> This field is the Profile Name that appears as a "Friendly Name" to the user and contains the Wi-Fi settings information. The non-%-escaped value must correspond to `` in ` `. + +The Profile name can be the same or different from the SSID of the actual network being broadcast (which is under ` `). For example, the broadcast SSID might be "CC_Corp_7" but the Profile name might be "ContosoWiFi". -SSID is the name of network you're connecting to, while Profile name is the name of the Profile that contains the WiFi settings information. If the Profile name isn't set right in the MDM SyncML, as per the information in the WiFi settings XML, it could lead to some unexpected errors. For example, `./Vendor/MSFT/WiFi/Profile//WlanXml`. @@ -125,6 +128,32 @@ SSID is the name of network you're connecting to, while Profile name is the name + +In the following example, the 'ContosoWiFi' Profile is added, targeting the 'CC_Corp_7' SSID. The rest of the profile is omitted for brevity - for complete examples, see [Add a network](#add-a-network). + +```xml + + 300 + + 301 + + + ./Vendor/MSFT/WiFi/Profile/ContosoWiFi/WlanXml + + + chr + + ContosoWiFiCC_Corp_7{...}]]> + + + +``` + +> [!IMPORTANT] +> If the Profile name isn't set correctly in the MDM SyncML, as per the information in the Wi-Fi settings XML (``), it could lead to some unexpected errors at runtime. In other words, if the profile is `Contoso Wi-Fi{...}`, the MDM SyncML must be `./Vendor/MSFT/WiFi/Profile/Contoso%20Wi-Fi/WlanXml`. +> +> In this example, if we instead had `./Vendor/MSFT/WiFi/Profile/CC_Corp_7/WlanXml`, the profile would be considered to be User provisioned, not MDM provisioned, which may cause users to connect to the wrong network. + @@ -200,6 +229,9 @@ Optional node. The format is url:port. Configuration of the network proxy (if an +> [!NOTE] +> Don't use. Using this configuration in Windows client editions may fail or have no effect. Use [NetworkProxy](networkproxy-csp.md) CSP instead. + @@ -240,7 +272,8 @@ Optional node. URL to the PAC file location. > [!NOTE] -> Don't use. Using this configuration in Windows 10 client editions will result in failure. +> Don't use. Using this configuration in Windows client editions may fail or have no effect. Use [NetworkProxy](networkproxy-csp.md) CSP instead. + @@ -281,7 +314,8 @@ Optional node. The presence of the field enables WPAD for proxy lookup. > [!NOTE] -> Don't use. Using this configuration in Windows 10 client editions will result in failure. +> Don't use. Using this configuration in Windows client editions may fail or have no effect. Use [NetworkProxy](networkproxy-csp.md) CSP instead. + @@ -382,12 +416,13 @@ Link to schema: -The profile XML must be escaped, as shown in the examples below. +The profile XML must be escaped, as shown in the following examples. If it exists in the blob, the **keyType** and **protected** elements must come before **keyMaterial**, as shown in the example in [WPA2-Personal Profile Sample](/windows/win32/nativewifi/wpa2-personal-profile-sample). > [!NOTE] -> If you need to specify other advanced conditions, such as specifying criteria for certificates that can be used by the Wi-Fi profile, you can do so by specifying this through the EapHostConfig portion of the WlanXML. For more information, see [EAP configuration](./eap-configuration.md). +> If you need to specify other advanced conditions, such as specifying criteria for certificates that can be used by the Wi-Fi profile, you can do so by specifying this through the [EapHostConfig](/windows/win32/eaphost/eaphostconfigschema-eaphostconfig-element) portion of the WlanXml ([WLANProfile](/windows/win32/nativewifi/wlan-profileschema-elements) > [MSM](/windows/win32/nativewifi/wlan-profileschema-msm-wlanprofile-element) > [security](/windows/win32/nativewifi/wlan-profileschema-security-msm-element) > [OneX](/windows/win32/nativewifi/onexschema-onex-element) > EAPConfig). For more information, see [EAP configuration](./eap-configuration.md) and [Extensible Authentication Protocol (EAP) for network access](/windows-server/networking/technologies/extensible-authentication-protocol/network-access). For an example, see [Wireless profile samples](/windows/win32/nativewifi/wireless-profile-samples). + @@ -401,6 +436,7 @@ If it exists in the blob, the **keyType** and **protected** elements must come b +See [Add a network](#add-a-network) for examples. @@ -466,9 +502,7 @@ The Profile name of the Wi-Fi network. This is added when WlanXml node is added -Specifies the name of the Wi-Fi network (32 bytes maximum) to create, configure, query, or delete. The name is case sensitive and can be represented in ASCII. - -SSID is the name of network you're connecting to, while Profile name is the name of the Profile that contains the WiFi settings information. If the Profile name isn't set right in the MDM SyncML, as per the information in the WiFi settings XML, it could lead to some unexpected errors. For example, `./Vendor/MSFT/WiFi/Profile//WlanXml`. +For more information, see [Device/Profile/{SSID}](#deviceprofilessid). @@ -558,6 +592,9 @@ Optional node. The format is url:port. Configuration of the network proxy (if an +> [!NOTE] +> Don't use. Using this configuration in Windows client editions may fail or have no effect. Use [NetworkProxy](networkproxy-csp.md) CSP instead. + @@ -598,7 +635,8 @@ Optional node. URL to the PAC file location. > [!NOTE] -> Don't use. Using this configuration in Windows 10 client editions will result in failure. +> Don't use. Using this configuration in Windows client editions may fail or have no effect. Use [NetworkProxy](networkproxy-csp.md) CSP instead. + @@ -639,7 +677,8 @@ Optional node. The presence of the field enables WPAD for proxy lookup. > [!NOTE] -> Don't use. Using this configuration in Windows 10 client editions will result in failure. +> Don't use. Using this configuration in Windows client editions may fail or have no effect. Use [NetworkProxy](networkproxy-csp.md) CSP instead. + @@ -740,12 +779,8 @@ Link to schema: -The profile XML must be escaped, as shown in the examples below. -If it exists in the blob, the **keyType** and **protected** elements must come before **keyMaterial**, as shown in the example in [WPA2-Personal Profile Sample](/windows/win32/nativewifi/wpa2-personal-profile-sample). - -> [!NOTE] -> If you need to specify other advanced conditions, such as specifying criteria for certificates that can be used by the Wi-Fi profile, you can do so by specifying this through the EapHostConfig portion of the WlanXML. For more information, see [EAP configuration](./eap-configuration.md). +For more information, see [Device/Profile/{SSID}/WlanXml](#deviceprofilessidwlanxml). @@ -771,7 +806,7 @@ These XML examples show how to perform various tasks using OMA DM. ### Add a network -The following example shows how to add PEAP-MSCHAPv2 network with SSID 'MyNetwork'. +The following example shows how to add a WPA2-Enterprise network with SSID and profile name `MyNetwork` that authenticates with PEAP-MSCHAPv2. This example is based on the sample profile at [WPA2-Enterprise with PEAP-MSCHAPv2 profile sample](/windows/win32/nativewifi/wpa2-enterprise-with-peap-mschapv2-profile-sample). ```xml @@ -787,7 +822,7 @@ The following example shows how to add PEAP-MSCHAPv2 network with SSID 'MyNetwor chr - MyNetwork412D4D534654574C414EMyNetworkfalseESSmanualWPA2AEStrueuser2500025truetruefalse26falsefalsefalsefalsefalse + MyNetwork4d794e6574776f726bMyNetworkfalseESSmanualWPA2AEStrueuser2500025truetruefalse26falsefalsefalsefalsefalse]]> @@ -796,6 +831,49 @@ The following example shows how to add PEAP-MSCHAPv2 network with SSID 'MyNetwor ``` +The following example shows how to add a WPA3-Enterprise network with profile name `My Network` and SSID `MySSID` that authenticates with EAP-TLS. This example is based on the sample profile at [WPA2-Enterprise with TLS profile sample](/windows/win32/nativewifi/wpa2-enterprise-with-tls-profile-sample). + +> [!IMPORTANT] +> Notice how the space is %-escaped in the `LocURI` and unescaped in the `WLANProfile` > `name`. + +```xml + + 300 + + 301 + + + ./Vendor/MSFT/WiFi/Profile/My%20Network/WlanXml + + + chr + + My NetworkMySSIDESSautoWPA3ENTAEStrueenabled720128disabledmachine1300013truetrue00 11 22 33 44 55 66 77 88 99 aa bb cc dd ee ff 00 11 22 33falsetruefalsefalse00112233445566778899aabbccddeeff00112233Client Authentication1.3.6.1.5.5.7.3.2Client Authentication]]> + + + +``` + +The following example shows how to add a WPA3-Personal (transition mode) network with profile name and SSID `MyNetwork` that includes the passphrase `TestPassword1!`. This example is based on the sample profile at [WPA3-Personal with transition mode profile sample](/windows/win32/nativewifi/wpa3-personal-transition-profile-sample). + +```xml + + 300 + + 301 + + + ./Vendor/MSFT/WiFi/Profile/MyNetwork/WlanXml + + + chr + + MyNetworkMyNetworkESSautoWPA3SAEAESfalsetruepassPhrasefalseTestPassword1!]]> + + + +``` + ### Query network profiles The following example shows how to query Wi-Fi profiles installed on an MDM server. @@ -828,7 +906,7 @@ The following example shows the response. ### Remove a network -The following example shows how to remove a network with SSID 'MyNetwork' and no proxy. Removing all network authentication types is done in this same manner. +The following example shows how to remove a network with SSID `MyNetwork` and no proxy. Removing all network authentication types is done in this same manner. ```xml @@ -843,32 +921,13 @@ The following example shows how to remove a network with SSID 'MyNetwork' and no ``` - -### Add a network and certification authority for a server certificate - -The following example shows how to add PEAP-MSCHAPv2 network with SSID 'MyNetwork' and root CA validation for server certificate. - -```xml - - 300 - - 301 - - - ./Vendor/MSFT/WiFi/Profile/MyNetwork/WlanXml - - - chr - - MyNetworkMyNetworkfalseESSmanualWPA2AEStrueuser2500025true InsertCertThumbPrintHere truefalse26falsefalsefalsetruefalse - - - -``` ## Related articles -[Configuration service provider reference](configuration-service-provider-reference.md) +- [Wireless profile samples](/windows/win32/nativewifi/wireless-profile-samples) +- [Configuration service provider reference](configuration-service-provider-reference.md) +- [Extensible Authentication Protocol (EAP) for network access](/windows-server/networking/technologies/extensible-authentication-protocol/network-access) +- [Configure EAP profiles and settings in Windows](/windows-server/networking/technologies/extensible-authentication-protocol/configure-eap-profiles) diff --git a/windows/client-management/mdm/wirednetwork-csp.md b/windows/client-management/mdm/wirednetwork-csp.md index 25003242b3..1b8f00d555 100644 --- a/windows/client-management/mdm/wirednetwork-csp.md +++ b/windows/client-management/mdm/wirednetwork-csp.md @@ -1,7 +1,7 @@ --- title: WiredNetwork CSP description: Learn more about the WiredNetwork CSP. -ms.date: 03/12/2025 +ms.date: 05/14/2025 ms.topic: generated-reference --- @@ -88,6 +88,11 @@ XML describing the wired network configuration and follows the LAN_profile schem +The profile XML must be escaped, as shown in the following examples. + +> [!NOTE] +> If you need to specify other advanced conditions, such as specifying criteria for certificates that can be used by the LAN profile, you can do so by specifying this through the [EapHostConfig](/windows/win32/eaphost/eaphostconfigschema-eaphostconfig-element) portion of the LanXML ([LANProfile](/windows/win32/nativewifi/lan-profileschema-schema) > [MSM](/windows/win32/nativewifi/lan-profileschema-msm-lanprofile-element) > [security](/windows/win32/nativewifi/lan-profileschema-security-msm-element) > [OneX](/windows/win32/nativewifi/onexschema-onex-element) > EAPConfig). For more information, see [EAP configuration](./eap-configuration.md) and [Extensible Authentication Protocol (EAP) for network access](/windows-server/networking/technologies/extensible-authentication-protocol/network-access). For an example, see [Wired Profile Samples](/windows/win32/nativewifi/wired-profile-samples). + @@ -101,6 +106,7 @@ XML describing the wired network configuration and follows the LAN_profile schem +See [Examples](#examples). @@ -167,6 +173,7 @@ XML describing the wired network configuration and follows the LAN_profile schem +For more information, see [Device/LanXML](#devicelanxml). @@ -188,7 +195,7 @@ XML describing the wired network configuration and follows the LAN_profile schem ## Examples -The following example shows how to add a wired network profile: +The following example shows how to add a wired network profile that authenticates with PEAP-MSCHAPv2. This example is based on the sample profile at [PEAP Profile Sample](/windows/win32/nativewifi/peap-profile-sample) ```xml @@ -202,7 +209,7 @@ The following example shows how to add a wired network profile: chr - falsetrue2500025falsetruefalse26falsefalsefalsetruefalsetrue + falsetrue2500025falsetruefalse26falsefalsefalsetruefalsetrue]]> @@ -214,4 +221,7 @@ The following example shows how to add a wired network profile: ## Related articles -[Configuration service provider reference](configuration-service-provider-reference.md) +- [Wired profile samples](/windows/win32/nativewifi/wired-profile-samples) +- [Configuration service provider reference](configuration-service-provider-reference.md) +- [Extensible Authentication Protocol (EAP) for network access](/windows-server/networking/technologies/extensible-authentication-protocol/network-access) +- [Configure EAP profiles and settings in Windows](/windows-server/networking/technologies/extensible-authentication-protocol/configure-eap-profiles) diff --git a/windows/configuration/assigned-access/configuration-file.md b/windows/configuration/assigned-access/configuration-file.md index ae9ebb8fad..ad07fc474e 100644 --- a/windows/configuration/assigned-access/configuration-file.md +++ b/windows/configuration/assigned-access/configuration-file.md @@ -127,7 +127,7 @@ Example of two profiles, a desktop app and a UWP app: ### AllAppList -Based on the purpose of the kiosk device, define the list of applications that are allowed to run. This list can contain both UWP apps and desktop apps. When the mult-app kiosk configuration is applied to a device, AppLocker rules are generated to allow the apps that are listed in the configuration. +Based on the purpose of the kiosk device, define the list of applications that are allowed to run. This list can contain both UWP apps and desktop apps. When the multi-app kiosk configuration is applied to a device, AppLocker rules are generated to allow the apps that are listed in the configuration. > [!NOTE] > If an app has a dependency on another app, both must be included in the allowed apps list. @@ -157,11 +157,19 @@ Example: ``` -> [!IMPORTANT] -> If you pins elements to the Start menu with Microsoft Edge secondary tiles, include the following apps in the allowed apps list: -> -> - `` -> - `` +#### Microsoft Edge secondary tiles considerations + +Microsoft Edge secondary tiles are pinned website shortcuts that appear on the Start menu. These pins provide quick access to specific websites directly from the Start menu, functioning similarly to app shortcuts. + +If you pin elements to the Start menu with Microsoft Edge secondary tiles, include the following apps in the allowed apps list: + +```xml + + + +``` + +For more information about Start menu customizations and pinning secondary tiles, see [Customize the Start layout](../start/layout.md). ::: zone pivot="windows-10" diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md index 9ba990de30..d2e845de5d 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md @@ -6,10 +6,12 @@ ms.subservice: itpro-privacy ms.localizationpriority: high author: DHB-MSFT ms.author: danbrown -manager: laurawi +manager: dansimp ms.date: 10/01/2024 ms.topic: reference -ms.collection: privacy-windows +ms.collection: +- privacy-windows +- must-keep --- diff --git a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md index 6239e43f99..e367317ea5 100644 --- a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md +++ b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md @@ -6,10 +6,12 @@ ms.subservice: itpro-privacy ms.localizationpriority: high author: DHB-MSFT ms.author: danbrown -manager: laurawi +manager: dansimp ms.date: 03/11/2016 -ms.collection: highpri ms.topic: how-to +ms.collection: +- privacy-windows +- must-keep --- # Configure Windows diagnostic data in your organization diff --git a/windows/privacy/diagnostic-data-viewer-overview.md b/windows/privacy/diagnostic-data-viewer-overview.md index 63e25e508f..a794a57c74 100644 --- a/windows/privacy/diagnostic-data-viewer-overview.md +++ b/windows/privacy/diagnostic-data-viewer-overview.md @@ -6,10 +6,12 @@ ms.subservice: itpro-privacy ms.localizationpriority: high author: DHB-MSFT ms.author: danbrown -manager: laurawi +manager: dansimp ms.date: 01/09/2018 -ms.collection: highpri ms.topic: how-to +ms.collection: +- privacy-windows +- must-keep --- # Diagnostic Data Viewer Overview diff --git a/windows/privacy/diagnostic-data-viewer-powershell.md b/windows/privacy/diagnostic-data-viewer-powershell.md index 3aa78b5848..54ed628d22 100644 --- a/windows/privacy/diagnostic-data-viewer-powershell.md +++ b/windows/privacy/diagnostic-data-viewer-powershell.md @@ -6,9 +6,12 @@ ms.subservice: itpro-privacy ms.localizationpriority: high author: DHB-MSFT ms.author: danbrown -manager: laurawi +manager: dansimp ms.date: 12/13/2018 ms.topic: how-to +ms.collection: +- privacy-windows +- must-keep --- # Diagnostic Data Viewer for PowerShell Overview diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md index d59b42605f..b6edb1591e 100644 --- a/windows/privacy/essential-services-and-connected-experiences.md +++ b/windows/privacy/essential-services-and-connected-experiences.md @@ -6,9 +6,12 @@ ms.subservice: itpro-privacy ms.localizationpriority: high author: DHB-MSFT ms.author: danbrown -manager: laurawi +manager: dansimp ms.date: 06/13/2024 ms.topic: reference +ms.collection: +- privacy-windows +- must-keep --- # Essential services and connected experiences for Windows diff --git a/windows/privacy/index.yml b/windows/privacy/index.yml index e17ca37e0c..cb17f69ddc 100644 --- a/windows/privacy/index.yml +++ b/windows/privacy/index.yml @@ -13,9 +13,10 @@ metadata: ms.collection: - essentials-privacy - privacy-windows + - must-keep author: DHB-MSFT ms.author: danbrown - manager: laurawi + manager: dansimp ms.date: 04/30/2025 ms.localizationpriority: high diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md index 47797f36e0..663a1fb614 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md @@ -6,9 +6,12 @@ ms.subservice: itpro-privacy ms.localizationpriority: high author: DHB-MSFT ms.author: danbrown -manager: laurawi +manager: dansimp ms.date: 05/15/2019 ms.topic: reference +ms.collection: +- privacy-windows +- must-keep --- # Manage connections from Windows 10 and Windows 11 operating system components to Microsoft services using Microsoft Intune MDM Server diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 9e89ce6f88..e349cbd218 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -6,9 +6,12 @@ ms.subservice: itpro-privacy ms.localizationpriority: high author: DHB-MSFT ms.author: danbrown -manager: laurawi +manager: dansimp ms.date: 06/27/2024 ms.topic: reference +ms.collection: +- privacy-windows +- must-keep --- # Manage connections from Windows 10 and Windows 11 operating system components to Microsoft services diff --git a/windows/privacy/manage-windows-11-endpoints.md b/windows/privacy/manage-windows-11-endpoints.md index 4bf198648c..6ed92f1764 100644 --- a/windows/privacy/manage-windows-11-endpoints.md +++ b/windows/privacy/manage-windows-11-endpoints.md @@ -6,9 +6,12 @@ ms.subservice: itpro-privacy ms.localizationpriority: high author: DHB-MSFT ms.author: danbrown -manager: laurawi +manager: dansimp ms.date: 10/06/2023 ms.topic: reference +ms.collection: +- privacy-windows +- must-keep --- # Manage connection endpoints for Windows 11 Enterprise diff --git a/windows/privacy/manage-windows-1809-endpoints.md b/windows/privacy/manage-windows-1809-endpoints.md index ab2077895d..4baed27cd9 100644 --- a/windows/privacy/manage-windows-1809-endpoints.md +++ b/windows/privacy/manage-windows-1809-endpoints.md @@ -6,9 +6,12 @@ ms.subservice: itpro-privacy ms.localizationpriority: high author: DHB-MSFT ms.author: danbrown -manager: laurawi +manager: dansimp ms.date: 01/18/2018 ms.topic: reference +ms.collection: +- privacy-windows +- must-keep --- # Manage connection endpoints for Windows 10 Enterprise, version 1809 diff --git a/windows/privacy/manage-windows-21h2-endpoints.md b/windows/privacy/manage-windows-21h2-endpoints.md index d9b12eeca8..d1c796a2e9 100644 --- a/windows/privacy/manage-windows-21h2-endpoints.md +++ b/windows/privacy/manage-windows-21h2-endpoints.md @@ -6,9 +6,12 @@ ms.subservice: itpro-privacy ms.localizationpriority: high author: DHB-MSFT ms.author: danbrown -manager: laurawi +manager: dansimp ms.date: 01/18/2018 ms.topic: reference +ms.collection: +- privacy-windows +- must-keep --- # Manage connection endpoints for Windows 10 Enterprise, version 21H2 diff --git a/windows/privacy/optional-diagnostic-data.md b/windows/privacy/optional-diagnostic-data.md index 9c3b3247ea..0c6dc6be07 100644 --- a/windows/privacy/optional-diagnostic-data.md +++ b/windows/privacy/optional-diagnostic-data.md @@ -6,10 +6,12 @@ ms.subservice: itpro-privacy ms.localizationpriority: high author: DHB-MSFT ms.author: danbrown -manager: laurawi +manager: dansimp ms.date: 03/31/2017 -ms.collection: highpri ms.topic: reference +ms.collection: +- privacy-windows +- must-keep --- # Optional diagnostic data for Windows 11 and Windows 10 diff --git a/windows/privacy/required-diagnostic-events-fields-windows-11-22H2.md b/windows/privacy/required-diagnostic-events-fields-windows-11-22H2.md index 4d704e6dd5..800f6a44bf 100644 --- a/windows/privacy/required-diagnostic-events-fields-windows-11-22H2.md +++ b/windows/privacy/required-diagnostic-events-fields-windows-11-22H2.md @@ -7,10 +7,12 @@ ms.subservice: itpro-privacy ms.localizationpriority: high author: DHB-MSFT ms.author: danbrown -manager: laurawi +manager: dansimp ms.date: 10/01/2024 ms.topic: reference -ms.collection: privacy-windows +ms.collection: +- privacy-windows +- must-keep --- # Required diagnostic events and fields for Windows 11, versions 23H2 and 22H2 diff --git a/windows/privacy/required-diagnostic-events-fields-windows-11-24H2.md b/windows/privacy/required-diagnostic-events-fields-windows-11-24H2.md index a18ec35c86..e17b4cc411 100644 --- a/windows/privacy/required-diagnostic-events-fields-windows-11-24H2.md +++ b/windows/privacy/required-diagnostic-events-fields-windows-11-24H2.md @@ -7,10 +7,12 @@ ms.subservice: itpro-privacy ms.localizationpriority: high author: DHB-MSFT ms.author: danbrown -manager: laurawi +manager: dansimp ms.date: 10/01/2024 ms.topic: reference -ms.collection: privacy-windows +ms.collection: +- privacy-windows +- must-keep --- # Required diagnostic events and fields for Windows 11, version 24H2 diff --git a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md index 4af11c5787..fc05807bdb 100644 --- a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md +++ b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md @@ -6,9 +6,11 @@ ms.subservice: itpro-privacy ms.localizationpriority: high author: DHB-MSFT ms.author: danbrown -manager: laurawi +manager: dansimp ms.date: 10/01/2024 -ms.collection: privacy-windows +ms.collection: +- privacy-windows +- must-keep ms.topic: reference --- diff --git a/windows/privacy/windows-11-endpoints-non-enterprise-editions.md b/windows/privacy/windows-11-endpoints-non-enterprise-editions.md index 2ced47d282..a4dbd390e2 100644 --- a/windows/privacy/windows-11-endpoints-non-enterprise-editions.md +++ b/windows/privacy/windows-11-endpoints-non-enterprise-editions.md @@ -6,9 +6,12 @@ ms.subservice: itpro-privacy ms.localizationpriority: high author: DHB-MSFT ms.author: danbrown -manager: laurawi +manager: dansimp ms.date: 10/06/2023 ms.topic: reference +ms.collection: +- privacy-windows +- must-keep --- # Windows 11 connection endpoints for non-Enterprise editions diff --git a/windows/privacy/windows-privacy-compliance-guide.md b/windows/privacy/windows-privacy-compliance-guide.md index 2cb7a70074..155caa56e4 100644 --- a/windows/privacy/windows-privacy-compliance-guide.md +++ b/windows/privacy/windows-privacy-compliance-guide.md @@ -6,10 +6,13 @@ ms.subservice: itpro-privacy ms.localizationpriority: high author: DHB-MSFT ms.author: danbrown -manager: laurawi +manager: dansimp ms.date: 05/20/2019 ms.topic: article -ms.collection: essentials-compliance +ms.collection: +- essentials-compliance +- privacy-windows +- must-keep --- # Windows Privacy Compliance:
A Guide for IT and Compliance Professionals diff --git a/windows/security/identity-protection/passkeys/index.md b/windows/security/identity-protection/passkeys/index.md index aef59bf2b1..150f18ac34 100644 --- a/windows/security/identity-protection/passkeys/index.md +++ b/windows/security/identity-protection/passkeys/index.md @@ -41,9 +41,12 @@ Passkeys have several advantages over passwords, including their ease of use and By default, Windows offers to save the passkey locally on the **Windows device**, in which case the passkey is protected by Windows Hello (biometrics and PIN). You can also choose to save the passkey in one of the following locations: -- **iPhone, iPad or Android device**: the passkey is saved on a phone or tablet, protected by the device's biometrics, if offered by the device. This option requires you to scan a QR code with your phone or tablet, which must be in proximity of the Windows device -- **Linked device**: the passkey is saved on a phone or tablet, protected by the device's biometrics, if offered by the device. This option requires the linked device to be in proximity of the Windows device, and it's only supported for Android devices -- **Security key**: the passkey is saved to a FIDO2 security key, protected by the key's unlock mechanism (for example, biometrics or PIN) +- **iPhone, iPad or Android device**: the passkey is saved on a phone or tablet, protected by the device's biometrics, if offered by the device. This option requires you to scan a QR code with your phone or tablet, which must be in proximity of the Windows device. +- **Linked device**: the passkey is saved on a phone or tablet, protected by the device's biometrics, if offered by the device. This option requires the linked device to be in proximity of the Windows device, and it's only supported for Android devices. +- **Security key**: the passkey is saved to a FIDO2 security key, protected by the key's unlock mechanism (for example, biometrics or PIN). + +>[!NOTE] +>Currently, Microsoft Entra ID passkeys can't be stored on Windows devices. To learn more, see [Passkey authentication matrix with Microsoft Entra ID](/entra/identity/authentication/concept-fido2-compatibility). Pick one of the following options to learn how to save a passkey, based on where you want to store it. @@ -388,9 +391,9 @@ To provide feedback for passkeys, open [**Feedback Hub**][FHUB] and use the cate [CSP-1]: /windows/client-management/mdm/policy-csp-bluetooth#allowadvertising [CSP-2]: /windows/client-management/mdm/policy-csp-bluetooth#allowdiscoverablemode -[CSP-3]: /windows/client-management/mdm/policy-csp-bluetooth#allowprepairing +[CSP-3]: /windows/client-management/mdm/policy-csp-bluetooth#allowpreparing [CSP-4]: /windows/client-management/mdm/policy-csp-bluetooth#allowpromptedproximalconnections [CSP-5]: /windows/client-management/mdm/policy-csp-bluetooth#servicesallowedlist [CSP-6]: /windows/client-management/mdm/policy-csp-deviceinstallation#preventinstallationofmatchingdeviceids [CSP-7]: /windows/client-management/mdm/policy-csp-deviceinstallation -[CSP-8]: /windows/client-management/mdm/policy-csp-bluetooth \ No newline at end of file +[CSP-8]: /windows/client-management/mdm/policy-csp-bluetooth diff --git a/windows/security/operating-system-security/network-security/vpn/vpn-authentication.md b/windows/security/operating-system-security/network-security/vpn/vpn-authentication.md index 26a2c22a06..df5f510507 100644 --- a/windows/security/operating-system-security/network-security/vpn/vpn-authentication.md +++ b/windows/security/operating-system-security/network-security/vpn/vpn-authentication.md @@ -71,7 +71,7 @@ For a UWP VPN plug-in, the app vendor controls the authentication method to be u ## Configure authentication -See [EAP configuration](/windows/client-management/mdm/eap-configuration) for EAP XML configuration. +See [EAP configuration](/windows/client-management/mdm/eap-configuration) and [Extensible Authentication Protocol (EAP) for network access](/windows-server/networking/technologies/extensible-authentication-protocol/network-access) for EAP XML configuration. >[!NOTE] >To configure Windows Hello for Business authentication, follow the steps in [EAP configuration](/windows/client-management/mdm/eap-configuration) to create a smart card certificate. [Learn more about Windows Hello for Business.](../../../identity-protection/hello-for-business/index.md). @@ -79,4 +79,3 @@ See [EAP configuration](/windows/client-management/mdm/eap-configuration) for EA The following image shows the field for EAP XML in a Microsoft Intune VPN profile. The EAP XML field only appears when you select a built-in connection type (automatic, IKEv2, L2TP, PPTP). :::image type="content" source="images/vpn-eap-xml.png" alt-text="Screenshot showing EAP XML configuration in Intune profile."::: -