From 7a559087d2fed87ef019e9b2bf1ec227d9cbc6d7 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Thu, 4 May 2023 16:20:23 -0700 Subject: [PATCH 01/14] commcontrol-7790977 --- .../deployment/update/waas-configure-wufb.md | 4 +- windows/whats-new/TOC.yml | 2 + .../windows-11-temporary-feature-control.md | 46 +++++++++++++++++++ 3 files changed, 50 insertions(+), 2 deletions(-) create mode 100644 windows/whats-new/windows-11-temporary-feature-control.md diff --git a/windows/deployment/update/waas-configure-wufb.md b/windows/deployment/update/waas-configure-wufb.md index 2b2f4074ec..bbf80891bf 100644 --- a/windows/deployment/update/waas-configure-wufb.md +++ b/windows/deployment/update/waas-configure-wufb.md @@ -213,9 +213,9 @@ Starting with Windows 10, version 1607, you can selectively opt out of receiving ## Enable features introduced via servicing that are off by default -New features and enhancements are introduced through the monthly cumulative update to provide continuous innovation for Windows 11. To give organizations time to plan and prepare, some of these new features are temporarily turned off by default. Features that are turned off by default are listed in the KB article for the monthly cumulative update. Typically, a feature is selected to be off by default because it either impacts the user experience or IT administrators significantly. +New features and enhancements are introduced through the monthly cumulative update to provide continuous innovation for Windows 11. To give organizations time to plan and prepare, some of these new features are temporarily turned off by default. Features that are turned off by default are listed in the KB article for the monthly cumulative update. Typically, a feature is selected to be off by default because it either impacts the user experience or IT administrators significantly. -The features that are turned off by default from servicing updates will be enabled in the next annual feature update. Organizations can choose to deploy feature updates at their own pace, to delay these features until they're ready for them. +The features that are turned off by default from servicing updates will be enabled in the next annual feature update. Organizations can choose to deploy feature updates at their own pace, to delay these features until they're ready for them. This policy is also known as **temporary feature control**. **Policy settings to enable features introduced via servicing that are off by default** diff --git a/windows/whats-new/TOC.yml b/windows/whats-new/TOC.yml index 0e145097a8..6f313338d0 100644 --- a/windows/whats-new/TOC.yml +++ b/windows/whats-new/TOC.yml @@ -11,6 +11,8 @@ href: windows-11-plan.md - name: Prepare for Windows 11 href: windows-11-prepare.md + - name: Windows 11 temporary feature control + href: windows-11-temporary-feature-control.md - name: What's new in Windows 11, version 22H2 href: whats-new-windows-11-version-22h2.md - name: Windows 10 diff --git a/windows/whats-new/windows-11-temporary-feature-control.md b/windows/whats-new/windows-11-temporary-feature-control.md new file mode 100644 index 0000000000..ef530333df --- /dev/null +++ b/windows/whats-new/windows-11-temporary-feature-control.md @@ -0,0 +1,46 @@ +--- +title: Temporary feature control in Windows 11 +description: Learn about the Windows 11 features behind temporary feature control. +ms.prod: windows-client +ms.technology: itpro-fundamentals +ms.author: mstewart +author: mestew +manager: aaroncz +ms.localizationpriority: medium +ms.topic: reference +ms.date: 05/15/2023 +ms.collection: + - highpri + - tier2 +--- + +# Temporary feature control in Windows 11 + +New features and enhancements are introduced through the monthly cumulative update to provide continuous innovation for Windows 11. To give organizations time to plan and prepare, some of these new features are temporarily turned off by default. Features that are turned off by default are listed in the KB article for the monthly cumulative update. Typically, a feature is selected to be off by default because it either impacts the user experience or IT administrators significantly. + +Features behind temporary control are automatically disabled for devices that have their Windows updates managed by policy. + +## Windows 11 features behind temporary control + +The following features are behind temporary control in Windows 11: + +| Feature | KB article where the feature was introduced | Feature update that enables the feature | +|---|---|---| +| Touch-optimized taskbar for 2-in-1 devices | [February 28, 2023 - KB5022913](https://support.microsoft.com/topic/february-28-2023-kb5022913-os-build-22621-1344-preview-3e38c0d9-924d-4f3f-b0b6-3bd49b2657b9) | 2023 annual feature update | + +## Enable features behind temporary control + +Features that are behind temporary control will be enabled when one of the following conditions is met: + +- The device installs the feature update that enables the new features by default +- The device receives a policy that enables features behind temporary control + - When the policy is enabled, all features on the device behind temporary control are turned on when the device next reboots. + +## Policy settings for temporary feature control + +You can use a policy to enable features introduced via servicing that are off by default. When this policy is enabled, all features that were disabled behind this control are turned on when the device next reboots. The following polices apply to Windows 11, version 22H2 with [KB5022845](https://support.microsoft.com/en-us/topic/february-14-2023-kb5022845-os-build-22621-1265-90a807f4-d2e8-486e-8a43-d09e66319f38) and later: + +- **Group Policy:** Computer Configuration\Administrative Templates\Windows Components\Windows Update\Manage end user experience\\**Enable features introduced via servicing that are off by default** + +- **CSP**: ./Device/Vendor/MSFT/Policy/Config/Update/[AllowTemporaryEnterpriseFeatureControl](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowtemporaryenterprisefeaturecontrol) + - In the Intune [settings catalog](/intune/configuration/settings-catalog), this setting is named **Allow Temporary Enterprise Feature Control** under the **Windows Update for Business** category. From 97d6b21bcb8260862b48b7ae68855b0a11cfeb9c Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Fri, 5 May 2023 10:44:59 -0700 Subject: [PATCH 02/14] 7790977: --- windows/whats-new/windows-11-temporary-feature-control.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/whats-new/windows-11-temporary-feature-control.md b/windows/whats-new/windows-11-temporary-feature-control.md index ef530333df..3f5a167550 100644 --- a/windows/whats-new/windows-11-temporary-feature-control.md +++ b/windows/whats-new/windows-11-temporary-feature-control.md @@ -24,7 +24,7 @@ Features behind temporary control are automatically disabled for devices that ha The following features are behind temporary control in Windows 11: -| Feature | KB article where the feature was introduced | Feature update that enables the feature | +| Feature | KB article where the feature was introduced | Feature update that ends temporary control | |---|---|---| | Touch-optimized taskbar for 2-in-1 devices | [February 28, 2023 - KB5022913](https://support.microsoft.com/topic/february-28-2023-kb5022913-os-build-22621-1344-preview-3e38c0d9-924d-4f3f-b0b6-3bd49b2657b9) | 2023 annual feature update | @@ -32,7 +32,7 @@ The following features are behind temporary control in Windows 11: Features that are behind temporary control will be enabled when one of the following conditions is met: -- The device installs the feature update that enables the new features by default +- The device installs the annual feature update that enables the new features by default - The device receives a policy that enables features behind temporary control - When the policy is enabled, all features on the device behind temporary control are turned on when the device next reboots. From f4e6fd64d2398b126c97740745f982d21639c62e Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Fri, 5 May 2023 10:59:33 -0700 Subject: [PATCH 03/14] 7790977: --- windows/deployment/update/waas-configure-wufb.md | 2 +- windows/whats-new/windows-11-temporary-feature-control.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/update/waas-configure-wufb.md b/windows/deployment/update/waas-configure-wufb.md index bbf80891bf..4f6b7dd408 100644 --- a/windows/deployment/update/waas-configure-wufb.md +++ b/windows/deployment/update/waas-configure-wufb.md @@ -215,7 +215,7 @@ Starting with Windows 10, version 1607, you can selectively opt out of receiving New features and enhancements are introduced through the monthly cumulative update to provide continuous innovation for Windows 11. To give organizations time to plan and prepare, some of these new features are temporarily turned off by default. Features that are turned off by default are listed in the KB article for the monthly cumulative update. Typically, a feature is selected to be off by default because it either impacts the user experience or IT administrators significantly. -The features that are turned off by default from servicing updates will be enabled in the next annual feature update. Organizations can choose to deploy feature updates at their own pace, to delay these features until they're ready for them. This policy is also known as **temporary feature control**. +The features that are turned off by default from servicing updates will be enabled in the next annual feature update. Organizations can choose to deploy feature updates at their own pace, to delay these features until they're ready for them. This policy is also known as **temporary feature control**. For a list of features that are turned off by default, see [Windows 11 features behind temporary control](/windows/whats-new/windows-11-temporary-feature-control). **Policy settings to enable features introduced via servicing that are off by default** diff --git a/windows/whats-new/windows-11-temporary-feature-control.md b/windows/whats-new/windows-11-temporary-feature-control.md index 3f5a167550..acf9f12910 100644 --- a/windows/whats-new/windows-11-temporary-feature-control.md +++ b/windows/whats-new/windows-11-temporary-feature-control.md @@ -15,7 +15,7 @@ ms.collection: --- # Temporary feature control in Windows 11 - + New features and enhancements are introduced through the monthly cumulative update to provide continuous innovation for Windows 11. To give organizations time to plan and prepare, some of these new features are temporarily turned off by default. Features that are turned off by default are listed in the KB article for the monthly cumulative update. Typically, a feature is selected to be off by default because it either impacts the user experience or IT administrators significantly. Features behind temporary control are automatically disabled for devices that have their Windows updates managed by policy. From b3af336d65aaecbee023d2ed2cf639d3b7c357cb Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 16 May 2023 10:33:59 -0700 Subject: [PATCH 04/14] tweaks --- .../deployment/update/waas-configure-wufb.md | 8 +++--- windows/whats-new/TOC.yml | 4 +-- ...ontrol.md => temporary-feature-control.md} | 26 +++++++++---------- 3 files changed, 19 insertions(+), 19 deletions(-) rename windows/whats-new/{windows-11-temporary-feature-control.md => temporary-feature-control.md} (62%) diff --git a/windows/deployment/update/waas-configure-wufb.md b/windows/deployment/update/waas-configure-wufb.md index 4f6b7dd408..102f3bdbb5 100644 --- a/windows/deployment/update/waas-configure-wufb.md +++ b/windows/deployment/update/waas-configure-wufb.md @@ -8,7 +8,7 @@ ms.localizationpriority: medium ms.author: mstewart ms.topic: article ms.technology: itpro-updates -ms.date: 02/28/2023 +ms.date: 05/18/2023 --- # Configure Windows Update for Business @@ -210,14 +210,14 @@ Starting with Windows 10, version 1607, you can selectively opt out of receiving | GPO for Windows 10, version 1607 or later:
Computer Configuration > Administrative Templates > Windows Components > Windows Update > **Do not include drivers with Windows Updates** | \Policies\Microsoft\Windows\WindowsUpdate\ExcludeWUDriversInQualityUpdate | | MDM for Windows 10, version 1607 and later:
../Vendor/MSFT/Policy/Config/Update/
**ExcludeWUDriversInQualityUpdate** | \Microsoft\PolicyManager\default\Update\ExcludeWUDriversInQualityUpdate | -## Enable features introduced via servicing that are off by default +## Enable features that are behind temporary enterprise feature control New features and enhancements are introduced through the monthly cumulative update to provide continuous innovation for Windows 11. To give organizations time to plan and prepare, some of these new features are temporarily turned off by default. Features that are turned off by default are listed in the KB article for the monthly cumulative update. Typically, a feature is selected to be off by default because it either impacts the user experience or IT administrators significantly. -The features that are turned off by default from servicing updates will be enabled in the next annual feature update. Organizations can choose to deploy feature updates at their own pace, to delay these features until they're ready for them. This policy is also known as **temporary feature control**. For a list of features that are turned off by default, see [Windows 11 features behind temporary control](/windows/whats-new/windows-11-temporary-feature-control). +The features that are behind temporary enterprise feature control will be enabled in the next annual feature update. Organizations can choose to deploy feature updates at their own pace, to delay these features until they're ready for them. For a list of features that are turned off by default, see [Windows 11 features behind temporary enterprise control](/windows/whats-new/windows-11-temporary-feature-control). -**Policy settings to enable features introduced via servicing that are off by default** +**Policy settings to enable features that are behind temporary enterprise control** | Policy | Sets registry key under HKLM\Software | | --- | --- | diff --git a/windows/whats-new/TOC.yml b/windows/whats-new/TOC.yml index 7de54c5362..fcc673643f 100644 --- a/windows/whats-new/TOC.yml +++ b/windows/whats-new/TOC.yml @@ -11,8 +11,8 @@ href: windows-11-plan.md - name: Prepare for Windows 11 href: windows-11-prepare.md - - name: Windows 11 temporary feature control - href: windows-11-temporary-feature-control.md + - name: Windows 11 temporary enterprise feature control + href: temporary-feature-control.md - name: What's new in Windows 11, version 22H2 href: whats-new-windows-11-version-22h2.md - name: Windows 10 diff --git a/windows/whats-new/windows-11-temporary-feature-control.md b/windows/whats-new/temporary-feature-control.md similarity index 62% rename from windows/whats-new/windows-11-temporary-feature-control.md rename to windows/whats-new/temporary-feature-control.md index acf9f12910..1c65bc379c 100644 --- a/windows/whats-new/windows-11-temporary-feature-control.md +++ b/windows/whats-new/temporary-feature-control.md @@ -1,6 +1,6 @@ --- -title: Temporary feature control in Windows 11 -description: Learn about the Windows 11 features behind temporary feature control. +title: Temporary enterprise feature control in Windows 11 +description: Learn about the Windows 11 features behind temporary enterprise feature control. ms.prod: windows-client ms.technology: itpro-fundamentals ms.author: mstewart @@ -8,37 +8,37 @@ author: mestew manager: aaroncz ms.localizationpriority: medium ms.topic: reference -ms.date: 05/15/2023 +ms.date: 05/18/2023 ms.collection: - highpri - tier2 --- -# Temporary feature control in Windows 11 +# Temporary enterprise feature control in Windows 11 New features and enhancements are introduced through the monthly cumulative update to provide continuous innovation for Windows 11. To give organizations time to plan and prepare, some of these new features are temporarily turned off by default. Features that are turned off by default are listed in the KB article for the monthly cumulative update. Typically, a feature is selected to be off by default because it either impacts the user experience or IT administrators significantly. -Features behind temporary control are automatically disabled for devices that have their Windows updates managed by policy. +Features behind temporary enterprise control are automatically disabled for devices that have their Windows updates managed by policies. -## Windows 11 features behind temporary control +## Windows 11 features behind temporary enterprise feature control -The following features are behind temporary control in Windows 11: +The following features are behind temporary enterprise control in Windows 11: | Feature | KB article where the feature was introduced | Feature update that ends temporary control | |---|---|---| | Touch-optimized taskbar for 2-in-1 devices | [February 28, 2023 - KB5022913](https://support.microsoft.com/topic/february-28-2023-kb5022913-os-build-22621-1344-preview-3e38c0d9-924d-4f3f-b0b6-3bd49b2657b9) | 2023 annual feature update | -## Enable features behind temporary control +## Enable features behind temporary enterprise feature control -Features that are behind temporary control will be enabled when one of the following conditions is met: +Features that are behind temporary enterprise control will be enabled when one of the following conditions is met: - The device installs the annual feature update that enables the new features by default -- The device receives a policy that enables features behind temporary control - - When the policy is enabled, all features on the device behind temporary control are turned on when the device next reboots. +- The device receives a policy that enables features behind temporary enterprise control + - When the policy is enabled, all features on the device behind temporary control are turned on when the device next restarts. -## Policy settings for temporary feature control +## Policy settings for temporary enterprise feature control -You can use a policy to enable features introduced via servicing that are off by default. When this policy is enabled, all features that were disabled behind this control are turned on when the device next reboots. The following polices apply to Windows 11, version 22H2 with [KB5022845](https://support.microsoft.com/en-us/topic/february-14-2023-kb5022845-os-build-22621-1265-90a807f4-d2e8-486e-8a43-d09e66319f38) and later: +You can use a policy to enable features that are behind temporary enterprise feature control. When this policy is enabled, all features that were disabled behind temporary enterprise feature control are turned on when the device next reboots. The following polices apply to Windows 11, version 22H2 with [KB5022845](https://support.microsoft.com/en-us/topic/february-14-2023-kb5022845-os-build-22621-1265-90a807f4-d2e8-486e-8a43-d09e66319f38) and later: - **Group Policy:** Computer Configuration\Administrative Templates\Windows Components\Windows Update\Manage end user experience\\**Enable features introduced via servicing that are off by default** From 4ba54d2fe2575a7ee1515d5571295e89f2cf8e09 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 16 May 2023 10:42:40 -0700 Subject: [PATCH 05/14] rename file, update links --- windows/deployment/update/release-cycle.md | 2 +- windows/deployment/update/waas-configure-wufb.md | 2 +- windows/whats-new/TOC.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/deployment/update/release-cycle.md b/windows/deployment/update/release-cycle.md index aa65a1cf19..dce73e6421 100644 --- a/windows/deployment/update/release-cycle.md +++ b/windows/deployment/update/release-cycle.md @@ -96,7 +96,7 @@ Some of the new features may be disruptive to organizations. By default, these s - WSUS - Devices that have updates managed by Configuration Manager use WSUS -Features that are turned off by default are listed in the KB article for the monthly cumulative update. If you want to enable these features, there's a client policy that allows admins to **Enable features introduced via servicing that are off by default**. For more information about this policy, see [Enable features introduced via servicing that are off by default](waas-configure-wufb.md#enable-features-introduced-via-servicing-that-are-off-by-default). +Features that are turned off by default are listed in the KB article for the monthly cumulative update. If you want to enable these features, there's a client policy that allows admins to enable features that are behind temporary enterprise control. For more information about this policy, see [Enable features that are behind temporary enterprise feature control](waas-configure-wufb.md#enable-features-that-are-behind-temporary-enterprise-feature-control). ## Annual feature updates diff --git a/windows/deployment/update/waas-configure-wufb.md b/windows/deployment/update/waas-configure-wufb.md index 102f3bdbb5..0ad0143e53 100644 --- a/windows/deployment/update/waas-configure-wufb.md +++ b/windows/deployment/update/waas-configure-wufb.md @@ -215,7 +215,7 @@ Starting with Windows 10, version 1607, you can selectively opt out of receiving New features and enhancements are introduced through the monthly cumulative update to provide continuous innovation for Windows 11. To give organizations time to plan and prepare, some of these new features are temporarily turned off by default. Features that are turned off by default are listed in the KB article for the monthly cumulative update. Typically, a feature is selected to be off by default because it either impacts the user experience or IT administrators significantly. -The features that are behind temporary enterprise feature control will be enabled in the next annual feature update. Organizations can choose to deploy feature updates at their own pace, to delay these features until they're ready for them. For a list of features that are turned off by default, see [Windows 11 features behind temporary enterprise control](/windows/whats-new/windows-11-temporary-feature-control). +The features that are behind temporary enterprise feature control will be enabled in the next annual feature update. Organizations can choose to deploy feature updates at their own pace, to delay these features until they're ready for them. For a list of features that are turned off by default, see [Windows 11 features behind temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control). **Policy settings to enable features that are behind temporary enterprise control** diff --git a/windows/whats-new/TOC.yml b/windows/whats-new/TOC.yml index fcc673643f..2e144448b8 100644 --- a/windows/whats-new/TOC.yml +++ b/windows/whats-new/TOC.yml @@ -12,7 +12,7 @@ - name: Prepare for Windows 11 href: windows-11-prepare.md - name: Windows 11 temporary enterprise feature control - href: temporary-feature-control.md + href: temporary-enterprise-feature-control.md - name: What's new in Windows 11, version 22H2 href: whats-new-windows-11-version-22h2.md - name: Windows 10 From ea4d853179d6abf90b7a553aba2c2def87cd1e0d Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 16 May 2023 10:43:20 -0700 Subject: [PATCH 06/14] rename file, update links --- windows/deployment/update/waas-configure-wufb.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/waas-configure-wufb.md b/windows/deployment/update/waas-configure-wufb.md index 0ad0143e53..be037faa7e 100644 --- a/windows/deployment/update/waas-configure-wufb.md +++ b/windows/deployment/update/waas-configure-wufb.md @@ -210,7 +210,7 @@ Starting with Windows 10, version 1607, you can selectively opt out of receiving | GPO for Windows 10, version 1607 or later:
Computer Configuration > Administrative Templates > Windows Components > Windows Update > **Do not include drivers with Windows Updates** | \Policies\Microsoft\Windows\WindowsUpdate\ExcludeWUDriversInQualityUpdate | | MDM for Windows 10, version 1607 and later:
../Vendor/MSFT/Policy/Config/Update/
**ExcludeWUDriversInQualityUpdate** | \Microsoft\PolicyManager\default\Update\ExcludeWUDriversInQualityUpdate | -## Enable features that are behind temporary enterprise feature control +## Enable features that are behind temporary enterprise feature control New features and enhancements are introduced through the monthly cumulative update to provide continuous innovation for Windows 11. To give organizations time to plan and prepare, some of these new features are temporarily turned off by default. Features that are turned off by default are listed in the KB article for the monthly cumulative update. Typically, a feature is selected to be off by default because it either impacts the user experience or IT administrators significantly. From 31613742deaaab43e903adb7be68c42515887235 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 16 May 2023 11:04:41 -0700 Subject: [PATCH 07/14] rename file, update links --- ...feature-control.md => temporary-enterprise-feature-control.md} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename windows/whats-new/{temporary-feature-control.md => temporary-enterprise-feature-control.md} (100%) diff --git a/windows/whats-new/temporary-feature-control.md b/windows/whats-new/temporary-enterprise-feature-control.md similarity index 100% rename from windows/whats-new/temporary-feature-control.md rename to windows/whats-new/temporary-enterprise-feature-control.md From d16a75fce73727a3b216b7dccc81f1cd294c0910 Mon Sep 17 00:00:00 2001 From: Alan Meeus <18293043+AMeeus@users.noreply.github.com> Date: Thu, 18 May 2023 15:26:20 -0700 Subject: [PATCH 08/14] Learn Editor: Update configure-md-app-guard.md --- .../configure-md-app-guard.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard.md index d3a235d738..1cefab4daa 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard.md @@ -29,6 +29,8 @@ Application Guard uses both network isolation and application-specific settings. [!INCLUDE [microsoft-defender-application-guard-mdag-for-edge-enterprise-mode-and-enterprise-management](../../../../includes/licensing/microsoft-defender-application-guard-mdag-for-edge-enterprise-mode-and-enterprise-management.md)] +For more information about Microsoft Defender Application Guard (MDAG) for Edge in stand-alone mode, see [Microsoft Defender Application Guard overview](/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview) + ## Network isolation settings These settings, located at `Computer Configuration\Administrative Templates\Network\Network Isolation`, help you define and manage your organization's network boundaries. Application Guard uses this information to automatically transfer any requests to access the non-corporate resources into the Application Guard container. @@ -38,7 +40,6 @@ These settings, located at `Computer Configuration\Administrative Templates\Netw > [!NOTE] > You must configure either the Enterprise resource domains hosted in the cloud or Private network ranges for apps settings on your employee devices to successfully turn on Application Guard using enterprise mode. Proxy servers must be a neutral resource listed in the **Domains categorized as both work and personal** policy. - |Policy name|Supported versions|Description| |-----------|------------------|-----------| |Private network ranges for apps | At least Windows Server 2012, Windows 8, or Windows RT| A comma-separated list of IP address ranges that are in your corporate network. Included endpoints or endpoints that are included within a specified IP address range, are rendered using Microsoft Edge and won't be accessible from the Application Guard environment.| @@ -68,9 +69,9 @@ These settings, located at `Computer Configuration\Administrative Templates\Wind |Allow camera and microphone access in Microsoft Defender Application Guard|Windows 10 Enterprise, 1809 or higher

Windows 11 Enterprise|Determines whether to allow camera and microphone access inside Microsoft Defender Application Guard.|**Enabled.** This is effective only in managed mode. Applications inside Microsoft Defender Application Guard are able to access the camera and microphone on the user's device. **Important:** Enabling this policy with a potentially compromised container could bypass camera and microphone permissions and access the camera and microphone without the user's knowledge.

**Disabled or not configured.** Applications inside Microsoft Defender Application Guard are unable to access the camera and microphone on the user's device.| |Allow Microsoft Defender Application Guard to use Root Certificate Authorities from a user's device|Windows 10 Enterprise or Pro, 1809 or higher

Windows 11 Enterprise or Pro|Determines whether Root Certificates are shared with Microsoft Defender Application Guard.|**Enabled.** Certificates matching the specified thumbprint are transferred into the container. Use a comma to separate multiple certificates.

**Disabled or not configured.** Certificates aren't shared with Microsoft Defender Application Guard.| |Allow auditing events in Microsoft Defender Application Guard|Windows 10 Enterprise, 1809 or higher

Windows 11 Enterprise|This policy setting allows you to decide whether auditing events can be collected from Microsoft Defender Application Guard.|**Enabled.** This is effective only in managed mode. Application Guard inherits auditing policies from your device and logs system events from the Application Guard container to your host.

**Disabled or not configured.** Event logs aren't collected from your Application Guard container.| - ## Application Guard support dialog settings These settings are located at `Administrative Templates\Windows Components\Windows Security\Enterprise Customization`. If an error is encountered, you're presented with a dialog box. By default, this dialog box only contains the error information and a button for you to report it to Microsoft via the feedback hub. However, it's possible to provide additional information in the dialog box. [Use Group Policy to enable and customize contact information](/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information#use-group-policy-to-enable-and-customize-contact-information). + From 61537186d5cbf788cdf6c9777b7f9dd4c3acdd84 Mon Sep 17 00:00:00 2001 From: Alan Meeus <18293043+AMeeus@users.noreply.github.com> Date: Thu, 18 May 2023 15:30:33 -0700 Subject: [PATCH 10/14] Learn Editor: Update md-app-guard-overview.md --- .../md-app-guard-overview.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md index a19042df8f..77bc317f54 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md @@ -50,6 +50,8 @@ Application Guard has been created to target several types of devices: [!INCLUDE [microsoft-defender-application-guard-mdag-for-edge-standalone-mode](../../../../includes/licensing/microsoft-defender-application-guard-mdag-for-edge-standalone-mode.md)] +For more information about Microsoft Defender Application Guard (MDAG) for Edge enterprise mode, [Configure Microsoft Defender Application Guard policy settings.](/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard) + ## Related articles |Article |Description | @@ -62,3 +64,4 @@ Application Guard has been created to target several types of devices: | [Microsoft Defender Application Guard for Microsoft Office](/microsoft-365/security/office-365-security/install-app-guard) | Describes Application Guard for Microsoft Office, including minimum hardware requirements, configuration, and a troubleshooting guide | |[Frequently asked questions - Microsoft Defender Application Guard](faq-md-app-guard.yml)|Provides answers to frequently asked questions about Application Guard features, integration with the Windows operating system, and general configuration.| |[Use a network boundary to add trusted sites on Windows devices in Microsoft Intune](/mem/intune/configuration/network-boundary-windows)|Network boundary, a feature that helps you protect your environment from sites that aren't trusted by your organization.| + From b3cd260a357589cafae40345994cd2e7a2eb9a5e Mon Sep 17 00:00:00 2001 From: Angela Fleischmann Date: Thu, 18 May 2023 16:46:42 -0600 Subject: [PATCH 12/14] Update windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard.md Line 32: Add a period to the sentence. --- .../configure-md-app-guard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard.md index 1cefab4daa..60f1ffc799 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard.md @@ -29,7 +29,7 @@ Application Guard uses both network isolation and application-specific settings. [!INCLUDE [microsoft-defender-application-guard-mdag-for-edge-enterprise-mode-and-enterprise-management](../../../../includes/licensing/microsoft-defender-application-guard-mdag-for-edge-enterprise-mode-and-enterprise-management.md)] -For more information about Microsoft Defender Application Guard (MDAG) for Edge in stand-alone mode, see [Microsoft Defender Application Guard overview](/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview) +For more information about Microsoft Defender Application Guard (MDAG) for Edge in stand-alone mode, see [Microsoft Defender Application Guard overview](/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview). ## Network isolation settings From 1ba05071cf865925391d9598a8c5154ee937d66e Mon Sep 17 00:00:00 2001 From: Angela Fleischmann Date: Thu, 18 May 2023 16:48:51 -0600 Subject: [PATCH 13/14] Update configure-md-app-guard.md Line 43: Add blank line. --- .../configure-md-app-guard.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard.md index 60f1ffc799..1bc39c461d 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard.md @@ -40,6 +40,7 @@ These settings, located at `Computer Configuration\Administrative Templates\Netw > [!NOTE] > You must configure either the Enterprise resource domains hosted in the cloud or Private network ranges for apps settings on your employee devices to successfully turn on Application Guard using enterprise mode. Proxy servers must be a neutral resource listed in the **Domains categorized as both work and personal** policy. + |Policy name|Supported versions|Description| |-----------|------------------|-----------| |Private network ranges for apps | At least Windows Server 2012, Windows 8, or Windows RT| A comma-separated list of IP address ranges that are in your corporate network. Included endpoints or endpoints that are included within a specified IP address range, are rendered using Microsoft Edge and won't be accessible from the Application Guard environment.| From 53fbedbd7fe4590c078a3640c313663b2cceab31 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Fri, 19 May 2023 08:17:33 -0700 Subject: [PATCH 14/14] update metadata: --- windows/deployment/update/release-cycle.md | 2 +- windows/deployment/update/waas-configure-wufb.md | 2 +- windows/whats-new/temporary-enterprise-feature-control.md | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/deployment/update/release-cycle.md b/windows/deployment/update/release-cycle.md index dce73e6421..6061c9efab 100644 --- a/windows/deployment/update/release-cycle.md +++ b/windows/deployment/update/release-cycle.md @@ -8,7 +8,7 @@ ms.author: mstewart manager: aaroncz ms.topic: article ms.technology: itpro-updates -ms.date: 03/23/2023 +ms.date: 05/19/2023 --- # Update release cycle for Windows clients diff --git a/windows/deployment/update/waas-configure-wufb.md b/windows/deployment/update/waas-configure-wufb.md index be037faa7e..c6c7a89a58 100644 --- a/windows/deployment/update/waas-configure-wufb.md +++ b/windows/deployment/update/waas-configure-wufb.md @@ -8,7 +8,7 @@ ms.localizationpriority: medium ms.author: mstewart ms.topic: article ms.technology: itpro-updates -ms.date: 05/18/2023 +ms.date: 05/19/2023 --- # Configure Windows Update for Business diff --git a/windows/whats-new/temporary-enterprise-feature-control.md b/windows/whats-new/temporary-enterprise-feature-control.md index 1c65bc379c..0cc6570f6d 100644 --- a/windows/whats-new/temporary-enterprise-feature-control.md +++ b/windows/whats-new/temporary-enterprise-feature-control.md @@ -8,7 +8,7 @@ author: mestew manager: aaroncz ms.localizationpriority: medium ms.topic: reference -ms.date: 05/18/2023 +ms.date: 05/19/2023 ms.collection: - highpri - tier2