mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-15 02:13:43 +00:00
Merge branch 'master' into MDBranch20H1BluetoothPolicy
This commit is contained in:
ManikaDhiman
@ -132,7 +132,7 @@ Optional. The character string that allows the user experience to include a cust
|
||||
Supported operations are Get, Replace, and Delete.
|
||||
|
||||
<a href="" id="provider-providerid-requiremessagesigning"></a>**Provider/*ProviderID*/RequireMessageSigning**
|
||||
Boolean type. Primarly used for SSL bridging mode where firewalls and proxies are deployed and where device client identity is required. When enabled, every SyncML message from the device will carry an additional HTTP header named MDM-Signature. This header contains BASE64-encoded Cryptographic Message Syntax using a Detached Signature of the complete SyncML message SHA-2 (inclusive of the SyncHdr and SyncBody). Signing is performed using the private key of the management session certificate that was enrolled as part of the enrollment process. The device public key and PKCS9 UTC signing time stamp are included as part of the authenticated attributes in the signature.
|
||||
Boolean type. Primarily used for SSL bridging mode where firewalls and proxies are deployed and where device client identity is required. When enabled, every SyncML message from the device will carry an additional HTTP header named MDM-Signature. This header contains BASE64-encoded Cryptographic Message Syntax using a Detached Signature of the complete SyncML message SHA-2 (inclusive of the SyncHdr and SyncBody). Signing is performed using the private key of the management session certificate that was enrolled as part of the enrollment process. The device public key and PKCS9 UTC signing time stamp are included as part of the authenticated attributes in the signature.
|
||||
|
||||
Default value is false, where the device management client does not include authentication information in the management session HTTP header. Optionally set to true, where the client authentication information is provided in the management session HTTP header.
|
||||
|
||||
@ -255,12 +255,12 @@ Optional. Added in Windows 10, version 1703. Specify the Discovery server URL o
|
||||
Supported operations are Add, Delete, Get, and Replace. Value type is string.
|
||||
|
||||
<a href="" id="provider-providerid-numberofdaysafterlostcontacttounenroll"></a>**Provider/*ProviderID*/NumberOfDaysAfterLostContactToUnenroll**
|
||||
Optional. Number of days after last sucessful sync to unenroll.
|
||||
Optional. Number of days after last successful sync to unenroll.
|
||||
|
||||
Supported operations are Add, Delete, Get, and Replace. Value type is integer.
|
||||
|
||||
<a href="" id="provider-providerid-aadsenddevicetoken"></a>**Provider/*ProviderID*/AADSendDeviceToken**
|
||||
Device. Added in Windows 10 version 1803. For AZure AD backed enrollments, this will cause the client to send a Device Token if the User Token can not be obtained.
|
||||
Device. Added in Windows 10 version 1803. For Azure AD backed enrollments, this will cause the client to send a Device Token if the User Token can not be obtained.
|
||||
|
||||
Supported operations are Add, Delete, Get, and Replace. Value type is bool.
|
||||
|
||||
@ -552,7 +552,7 @@ Optional. Boolean value that allows the IT admin to require the device to start
|
||||
Supported operations are Add, Get, and Replace.
|
||||
|
||||
<a href="" id="provider-providerid-push"></a>**Provider/*ProviderID*/Push**
|
||||
Optional. Not configurable during WAP Provisioining XML. If removed, DM sessions triggered by Push will no longer be supported.
|
||||
Optional. Not configurable during WAP Provisioning XML. If removed, DM sessions triggered by Push will no longer be supported.
|
||||
|
||||
Supported operations are Add and Delete.
|
||||
|
||||
|
||||
@ -49,10 +49,14 @@ The following steps demonstrate required settings using the Intune service:
|
||||
|
||||
|
||||
2. Verify that auto-enrollment is activated for those users who are going to enroll the devices into Intune. For additional details, see [Azure AD and Microsoft Intune: Automatic MDM enrollment in the new Portal](https://docs.microsoft.com/windows/client-management/mdm/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal).
|
||||
Also verify that the **MAM user scope** is set to **None**. Otherwise, it will have precedence over the MDM scope that will lead to issues.
|
||||
|
||||
|
||||
|
||||
> [!IMPORTANT]
|
||||
> For BYOD devices, the MAM user scope takes precedence if both MAM user scope and MDM user scope (automatic MDM enrollment) are enabled for all users (or the same groups of users). The device will use Windows Information Protection (WIP) Policies (if you configured them) rather than being MDM enrolled.
|
||||
|
||||
> For corporate devices, the MDM user scope takes precedence if both scopes are enabled. The devices get MDM enrolled.
|
||||
|
||||
3. Verify that the device OS version is Windows 10, version 1709 or later.
|
||||
4. Auto-enrollment into Intune via Group Policy is valid only for devices which are hybrid Azure AD joined. This means that the device must be joined into both local Active Directory and Azure Active Directory. To verify that the device is hybrid Azure AD joined, run `dsregcmd /status` from the command line.
|
||||
|
||||
@ -62,7 +66,7 @@ Also verify that the **MAM user scope** is set to **None**. Otherwise, it will h
|
||||
|
||||
Additionally, verify that the SSO State section displays **AzureAdPrt** as **YES**.
|
||||
|
||||
|
||||
|
||||
|
||||
This information can also be found on the Azure AD device list.
|
||||
|
||||
|
||||
@ -200,6 +200,9 @@ The following diagram shows the Policy configuration service provider in tree fo
|
||||
<dd>
|
||||
<a href="./policy-csp-applicationmanagement.md#applicationmanagement-allowshareduserappdata" id="applicationmanagement-allowshareduserappdata">ApplicationManagement/AllowSharedUserAppData</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-applicationmanagement.md#applicationmanagement-blocknonadminuserinstall"id="applicationmanagement-blocknonadminuserinstall">ApplicationManagement/BlockNonAdminUserInstall</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-applicationmanagement.md#applicationmanagement-disablestoreoriginatedapps" id="applicationmanagement-disablestoreoriginatedapps">ApplicationManagement/DisableStoreOriginatedApps</a>
|
||||
</dd>
|
||||
|
||||
@ -7,7 +7,7 @@ ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: manikadhiman
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 09/27/2019
|
||||
ms.date: 02/11/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
@ -39,6 +39,9 @@ manager: dansimp
|
||||
<dd>
|
||||
<a href="#applicationmanagement-allowshareduserappdata">ApplicationManagement/AllowSharedUserAppData</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#applicationmanagement-blocknonadminuserinstall">ApplicationManagement/BlockNonAdminUserInstall</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#applicationmanagement-disablestoreoriginatedapps">ApplicationManagement/DisableStoreOriginatedApps</a>
|
||||
</dd>
|
||||
@ -414,6 +417,83 @@ Most restricted value: 0
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="applicationmanagement-blocknonadminuserinstall"></a>**ApplicationManagement/BlockNonAdminUserInstall**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>7</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>7</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>7</sup></td>
|
||||
</tr>
|
||||
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Added in the next major release of Windows 10.
|
||||
|
||||
Manages non-administrator users' ability to install Windows app packages.
|
||||
|
||||
If you enable this policy, non-administrators will be unable to initiate installation of Windows app packages. Administrators who wish to install an app will need to do so from an Administrator context (for example, an Administrator PowerShell window). All users will still be able to install Windows app packages via the Microsoft Store, if permitted by other policies.
|
||||
|
||||
If you disable or do not configure this policy, all users will be able to initiate installation of Windows app packages.
|
||||
|
||||
<!--/Description-->
|
||||
<!--ADMXMapped-->
|
||||
ADMX Info:
|
||||
- GP English name: *Prevent non-admin users from installing packaged Windows apps*
|
||||
- GP name: *BlockNonAdminUserInstall*
|
||||
- GP path: *Windows Components/App Package Deployment*
|
||||
- GP ADMX file name: *AppxPackageManager.admx*
|
||||
|
||||
<!--/ADMXMapped-->
|
||||
<!--SupportedValues-->
|
||||
The following list shows the supported values:
|
||||
- 0 (default) - Disabled. All users will be able to initiate installation of Windows app packages.
|
||||
- 1 - Enabled. Non-administrator users will not be able to initiate installation of Windows app packages.
|
||||
<!--/SupportedValues-->
|
||||
<!--Example-->
|
||||
|
||||
<!--/Example-->
|
||||
<!--Validation-->
|
||||
|
||||
<!--/Validation-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="applicationmanagement-disablestoreoriginatedapps"></a>**ApplicationManagement/DisableStoreOriginatedApps**
|
||||
|
||||
@ -1032,6 +1112,7 @@ Footnotes:
|
||||
- 4 - Added in Windows 10, version 1803.
|
||||
- 5 - Added in Windows 10, version 1809.
|
||||
- 6 - Added in Windows 10, version 1903.
|
||||
- 7 - Added in the next major release of Windows 10.
|
||||
|
||||
<!--/Policies-->
|
||||
|
||||
|
||||
@ -307,6 +307,10 @@ ADMX Info:
|
||||
|
||||
<!--/ADMXMapped-->
|
||||
<!--SupportedValues-->
|
||||
The following list shows the supported values:
|
||||
|
||||
- 0 (default) – Disabled.
|
||||
- 1 – Allowed.
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--Example-->
|
||||
|
||||
Reference in New Issue
Block a user