))
+ ```
+ If you are using hybrid MDM management with System Center Configuration Manager or using Intune, ensure that you use Base64 as the Data type when using Custom OMA-URI functionality to apply the Code Integrity policy.
-**EnrollmentStatusTracking/Setup/Apps/PolicyProviders**
-Required. This node is supported in both user context and device context.
-Specifies the app policy providers for this CSP. These are the policy providers the ESP should wait on before showing the tracking message with the status to the user.
+- Deploy the policy:
+ - To deploy a new base policy using the CSP, perform an ADD on **./Vendor/MSFT/ApplicationControl/Policies/_PolicyGUID_/Policy** using the Base64-encoded policy node as {Data}. Refer to the the Format section in the Example 1 snippet).
-Scope is permanent. Supported operation is Get.
+ - To deploy base policy and supplemental policies:
+ - Perform an ADD as described above first with the GUID and policy data for the base policy
+ - Repeat for each base or supplemental policy in turn (with its own GUID and data)
-**EnrollmentStatusTracking/Setup/Apps/PolicyProviders**/***ProviderName***
-Optional. This node is supported in both user context and device context.
-Represents an app policy provider for the ESP. Existence of this node indicates to the ESP that it should not show the tracking status message until the TrackingPoliciesCreated node has been set to true.
+ The following example shows the deployment of two base policies and a supplemental policy (which already specifies the base policy it supplements and does not need that reflected in the ADD).
-Scope is dynamic. Supported operations are Get, Add, Delete, and Replace.
+ **Example 1: Add first base policy**
+ ```
+
+ 1
+ -
+
+ ./Vendor/MSFT/ApplicationControl/Policies/{Base1GUID}/Policy
+
+
+ b64
+
+ {Base1Data}
+
+
+ ```
+ **Example 2: Add second base policy**
+ ```
+
+ 1
+ -
+
+ ./Vendor/MSFT/ApplicationControl/Policies/{Base2GUID}/Policy
+
+
+ b64
+
+ {Base2Data}
+
+
+ ```
+ **Example 3: Add supplemental policy**
+ ```
+
+ 1
+ -
+
+ ./Vendor/MSFT/ApplicationControl/Policies/{Supplemental1GUID}/Policy
+
+
+ b64
+
+ {Supplemental1Data}
+
+
+ ```
+- Perform a GET operation using a deployed policy’s GUID to interrogate/inspect the policy itself or information about it.
+ - ./Vendor/MSFT/ApplicationControl/Policies/_PolicyGUID_/Policy (raw p7b)
+ - ./Vendor/MSFT/ApplicationControl/Policies/_PolicyGUID_/PolicyInfo/Version (policy version)
+ - ./Vendor/MSFT/ApplicationControl/Policies/_PolicyGUID_/PolicyInfo/IsEffective (is the policy in effect)
+ - ./Vendor/MSFT/ApplicationControl/Policies/_PolicyGUID_/PolicyInfo/IsDeployed (is the policy on the system)
+ - ./Vendor/MSFT/ApplicationControl/Policies/_PolicyGUID_/PolicyInfo/IsAuthorized (is the policy authorized on the system)
+ - ./Vendor/MSFT/ApplicationControl/Policies/_PolicyGUID_/PolicyInfo/Status (was the deployment successful)
+ - ./Vendor/MSFT/ApplicationControl/Policies/_PolicyGUID_/PolicyInfo/FriendlyName (the friendly name per the policy)
-**EnrollmentStatusTracking/Setup/Apps/PolicyProviders/*ProviderName*/TrackingPoliciesCreated**
-Required. This node is supported in both user context and device context.
-Indicates if the provider has created the required policies for the ESP to use for tracking app installation progress. The policy provider itself is expected to set the value of this node, not the MDM server.
+ **Sample Get command**
+ ```
+
+ 1
+ -
+
+ ./Vendor/MSFT/ApplicationControl/Policies/{PolicyGUID}/Policy
+
+
+
+ ```
+- Delete the policy.
+ To delete an unsigned policy, perform a DELETE on **./Vendor/MSFT/ApplicationControl/Policies/_PolicyGUID_/Policy**.
-Scope is dynamic. Supported operations are Get, Add, Delete, and Replace.
-
-Value type is boolean. The expected values are as follows:
-- true — Indicates that the provider has created the required policies.
-- false — Indicates that the provider has not created the required policies. This is the default.
-
-**EnrollmentStatusTracking/Setup/Apps/Tracking**
-Required. This node is supported in both user context and device context.
-Root node for the app installations being tracked by the ESP.
-
-Scope is permanent. Supported operation is Get.
-
-**EnrollmentStatusTracking/Setup/Apps/Tracking/_ProviderName_**
-Optional. This node is supported in both user context and device context.
-Indicates the provider name responsible for installing the apps and providing status back to ESP.
-
-Scope is dynamic. Supported operations are Get, Add, Delete, and Replace.
-
-**EnrollmentStatusTracking/Setup/Apps/Tracking/*ProviderName*/_AppName_**
-Optional. This node is supported in both user context and device context.
-Represents a unique name for the app whose progress should be tracked by the ESP. The policy provider can define any arbitrary app name as ESP does not use the app name directly.
-
-Scope is dynamic. Supported operations are Get, Add, Delete, and Replace.
-
-**EnrollmentStatusTracking/Setup/Apps/Tracking/*ProviderName*/*AppName*/InstallationState**
-Optional. This node is supported in both user context and device context.
-Represents the installation state for the app. The policy providers (not the MDM server) must update this node for the ESP to track the installation progress and update the status message.
-
-Scope is dynamic. Supported operations are Get, Add, Delete, and Replace.
-
-Value type is integer. Expected values are as follows:
-- 1 — NotInstalled
-- 2 — InProgress
-- 3 — Completed
-- 4 — Error
-
-**EnrollmentStatusTracking/Setup/Apps/Tracking/*ProviderName*/*AppName*/RebootRequired**
-Optional. This node is supported in both user context and device context.
-Indicates if the app installation requires ESP to issue a reboot. The policy providers installing the app (not the MDM server) must set this node. If the policy providers do not set this node, the ESP will not reboot the device for the app installation.
-
-Scope is dynamic. Supported operations are Get, Add, Delete, and Replace.
-
-Value type is integer. Expected values are as follows:
-- 1 — NotRequired
-- 2 — SoftReboot
-- 3 — HardReboot
-
-**EnrollmentStatusTracking/Setup/HasProvisioningCompleted**
-Required. This node is supported in both user context and device context.
-ESP sets this node when it completes. Providers can query this node to determine if the ESP is showing, which allows them to determine if they still need to provide status updates for the ESP through this CSP.
-
-Scope is permanent. Supported operation is Get.
-
-Value type is boolean. Expected values are as follows:
-- true — Indicates that ESP has completed. This is the default.
-- false — Indicates that ESP is displayed, and provisioning is still going.
\ No newline at end of file
+ > [!Note]
+ > Only signed things should be able to update signed policies. Hence, performing a DELETE on **./Vendor/MSFT/ApplicationControl/Policies/_PolicyGUID_/Policy** is not sufficient to delete a signed policy.
+
+ To delete a signed policy, first replace it with a signed update allowing unsigned policy, then deploy another update with unsigned policy, then perform delete.
+
+ **Delete a policy**
+ ```
+
+ 1
+ -
+
+ ./Vendor/MSFT/ApplicationControl/Policies/{PolicyGUID}/Policy
+
+
+
+ ```
\ No newline at end of file
diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md
index 3ca4486f3b..754e6e0023 100644
--- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md
+++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md
@@ -140,6 +140,10 @@ For details about Microsoft mobile device management protocols for Windows 10 s
EnrollmentStatusTracking CSP |
Added new CSP in Windows 10, version 1903.
|
+
+| ApplicationStatus CSP |
+Added new CSP in Windows 10, version 1903.
+ |
@@ -1885,6 +1889,7 @@ How do I turn if off? | The service can be stopped from the "Services" console o
|New or updated topic | Description|
|--- | ---|
+|[ApplicationControl CSP](applicationcontrol-csp.md)|Added new CSP in Windows 10, version 1903.|
|Create a custom configuration service provider|Deleted the following documents from the CSP reference because extensibility via CSPs is not currently supported:
Create a custom configuration service provider
Design a custom configuration service provider
IConfigServiceProvider2
IConfigServiceProvider2::ConfigManagerNotification
IConfigServiceProvider2::GetNode
ICSPNode
ICSPNode::Add
ICSPNode::Clear
ICSPNode::Copy
ICSPNode::DeleteChild
ICSPNode::DeleteProperty
ICSPNode::Execute
ICSPNode::GetChildNodeNames
ICSPNode::GetProperty
ICSPNode::GetPropertyIdentifiers
ICSPNode::GetValue
ICSPNode::Move
ICSPNode::SetProperty
ICSPNode::SetValue
ICSPNodeTransactioning
ICSPValidate
Samples for writing a custom configuration service provider|