From 76d08a51ca167afe834be2e46f6cc97af34439ef Mon Sep 17 00:00:00 2001
From: noamhadash <101192108+noamhadash@users.noreply.github.com>
Date: Sun, 12 Feb 2023 10:03:47 +0200
Subject: [PATCH] Update windowsadvancedthreatprotection-csp.md

introducing a new settings in the "Configuration" branch of WDATP branch which will be populated by the Intune agent. updated all elements in the doc per the planned update
---
 .../mdm/windowsadvancedthreatprotection-csp.md   | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md b/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md
index 917d96da7b..c2440b73fd 100644
--- a/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md
+++ b/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md
@@ -40,6 +40,7 @@ WindowsAdvancedThreatProtection
 ----Configuration
 --------SampleSharing
 --------TelemetryReportingFrequency
+--------AadDdeviceId
 ----Offboarding
 ----DeviceTagging
 --------Group
@@ -113,6 +114,11 @@ The following list shows the supported values:
 
 Supported operations are Get and Replace.
 
+<a href="" id="configuration-AadDeviceId"></a>**Configuration/AadDeviceId**
+Returns or sets the Intune's reported known AadDeviceId for the machine
+
+Supported operations are Get and Replace.
+
 <a href="" id="offboarding"></a>**Offboarding**
 Sets the Windows Defender Advanced Threat Protection Offboarding blob and initiates offboarding to Windows Defender Advanced Threat Protection.
 
@@ -217,6 +223,16 @@ Supported operations are Get and Replace.
         </Target>
       </Item>
     </Get>
+    <Get>
+      <CmdID>7</CmdID>
+      <Item>
+        <Target>
+          <LocURI>
+            ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Configuration/AadDeviceId
+          </LocURI>
+        </Target>
+      </Item>
+    </Get>
     <Get>
       <CmdID>11</CmdID>
       <Item>