diff --git a/windows/client-management/mdm/assignedaccess-csp.md b/windows/client-management/mdm/assignedaccess-csp.md
index 85fa624e4a..e31ceedfde 100644
--- a/windows/client-management/mdm/assignedaccess-csp.md
+++ b/windows/client-management/mdm/assignedaccess-csp.md
@@ -1,7 +1,7 @@
---
title: AssignedAccess CSP
description: Learn more about the AssignedAccess CSP.
-ms.date: 01/18/2024
+ms.date: 02/29/2024
---
@@ -11,19 +11,9 @@ ms.date: 01/18/2024
-The AssignedAccess configuration service provider (CSP) is used to set the device to run in kiosk mode. Once the CSP has been executed, the next user login that is associated with the kiosk mode puts the device into the kiosk mode running the application specified in the CSP configuration.
+The AssignedAccess configuration service provider (CSP) is used to configure a kiosk or restricted user experience. Once the CSP is executed, the next user login that is associated with the kiosk profile puts the device into the kiosk mode specified in the CSP configuration.
-- For a step-by-step guide for setting up devices to run in kiosk mode, see [Set up a single-app kiosk on Windows 10/11](/windows/configuration/kiosk-single-app).
-- For a step-by-step guide for configuring multi-app kiosks, see [Create a Windows 10 kiosk that runs multiple apps](/windows/configuration/lock-down-windows-10-to-specific-apps).
-
-> [!IMPORTANT]
-> The AssignedAccess CSP is supported in Windows 10 Enterprise and Windows 10 Education. Starting from Windows 10, version 1709, it is supported in Windows 10 Pro and Windows 10 S. Starting from Windows 10, version 1803, it is also supported in Windows Holographic for Business edition.
-
-> [!WARNING]
-> You can only assign one single app kiosk profile to an individual user account on a device. The single app profile does not support domain groups.
-
-> [!NOTE]
-> If the application calls `KeyCredentialManager.IsSupportedAsync` when it is running in assigned access mode and it returns false on the first run, invoke the settings screen and select an appropriate PIN to use with Windows Hello. This is the settings screen that is hidden by the application running in assigned access mode. You can only use Windows Hello if you first leave assigned access mode, select your convenience pin, and then go back into assigned access mode again.
+To learn more about how to configure Assigned Access, see [Configure kiosks and restricted user experiences](/windows/configuration/assigned-access).
@@ -59,20 +49,8 @@ This node accepts an AssignedAccessConfiguration xml as input.
-The input XML specifies the settings that you can configure in the kiosk or device.
+To learn how to configure xml file, see [Create an Assigned Access configuration XML file](/windows/configuration/assigned-access/configuration-file)
-In **Windows 10, version 1803** the Configuration node introduces single app kiosk profile to replace KioskModeApp CSP node. KioskModeApp node will be deprecated soon, so you should use the single app kiosk profile in config xml for Configuration node to configure public-facing single app Kiosk.
-
-In **Windows 10, version 1909**, Microsoft Edge kiosk mode support was added. This allows Microsoft Edge to be the specified kiosk application. For details about configuring Microsoft Edge kiosk mode, see [Configure a Windows 10 kiosk that runs Microsoft Edge](/DeployEdge/microsoft-edge-configure-kiosk-mode). Windows 10, version 1909 also allows for configuration of the breakout sequence. The breakout sequence specifies the keyboard shortcut that returns a kiosk session to the lock screen. The breakout sequence is defined with the format modifiers + keys. An example breakout sequence would look something like `shift+alt+a`, where `shift` and `alt` are the modifiers and `a` is the key.
-
-In **Windows 11, version 22H2 with [KB5026446](https://support.microsoft.com/kb/5026446)**, AssignedAccessConfiguration schema was updated to add StartPins and TaskbarLayout nodes to support pinning apps to the Start Menu and Taskbar respectively.
-
-- For more information about setting up a multi-app kiosk, see [Create a Windows 10 kiosk that runs multiple apps](/windows/configuration/lock-down-windows-10-to-specific-apps).
-- For more information on the schema, see [AssignedAccessConfiguration XSD](#assignedaccessconfiguration-xsd).
-- For examples, see [AssignedAccessConfiguration examples](#assignedaccessconfiguration-examples).
-
-> [!NOTE]
-> Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it can't revert all the enforced policies (for example, Start Layout).
@@ -165,8 +143,7 @@ This node supports Add, Delete, Replace and Get methods. When there's no configu
>
> This applies to both `domain\user`, `AzureAD\someone@contoso.onmicrosoft.com`, as long as a `\` is used in JSON string.
-- For more information about how to get the AUMID, see [Find the Application User Model ID of an installed app](/windows/configuration/find-the-application-user-model-id-of-an-installed-app).
-- For more information about single-app kiosk, see [Set up a single-app kiosk on Windows 10/11.](/windows/configuration/kiosk-single-app)
+- For more information about how to get the AUMID, see [Find the Application User Model ID of an installed app](/windows/configuration/store/find-aumid)
> [!IMPORTANT]
>
@@ -293,9 +270,8 @@ This node accepts a ShellLauncherConfiguration xml as input.
-In **Windows 10, version 1903**, Shell Launcher V2 was introduced to support both UWP and Win32 apps as the custom shell.
-For more information, see [Shell Launcher](/windows/configuration/kiosk-shelllauncher).
+To learn about Shell Launcher, see [What is Shell Launcher?](/windows/configuration/assigned-access/shell-launcher).
> [!IMPORTANT]
> You can't set both ShellLauncher and KioskModeApp at the same time on the device.
@@ -317,193 +293,8 @@ For more information, see [Shell Launcher](/windows/configuration/kiosk-shelllau
-**ShellLauncherConfiguration XSD**:
-> [!NOTE]
-> Shell Launcher V2 uses a separate XSD and namespace for backward compatibility. The original V1 XSD has a reference to the V2 XSD.
-
-- Shell Launcher V1 XSD
-
- ```xml
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- ```
-
-- Shell Launcher V2 XSD
-
- ```xml
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- ```
+Here's the Shell Launcher XSD reference article: [Shell Launcher XML Schema Definition (XSD)](/windows/configuration/assigned-access/shell-launcher/xsd).
**Examples**:
@@ -1026,589 +817,14 @@ By default, the StatusConfiguration node doesn't exist, and it implies this feat
## AssignedAccessConfiguration XSD
-- Schema for AssignedAccessConfiguration.
+Here's the Assigned Access XSD reference article: [Assigned Access XML Schema Definition (XSD)](/windows/configuration/assigned-access/xsd).
- ```xml
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- );
- ```
-
-- Schema for features introduced in Windows 10, version 1809 which added support for Microsoft Edge kiosk mode and breakout key sequence customization.
-
- ```xml
-
-
-
-
-
-
-
-
-
-
-
-
-
- ```
-
-- Schema for new features introduced in Windows 10 1809 release.
-
- ```xml
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- ```
-
-- Schema for Windows 10 prerelease.
-
- ```xml
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- ```
-
-## AssignedAccessConfiguration examples
-
-> [!NOTE]
-> To authorize a compatible configuration XML that includes 1809 or prerelease elements and attributes, always include the namespace of these add-on schemas, and decorate the attributes and elements accordingly with the namespace alias. For example, to configure the auto-launch feature that was added in the 1809 release, use the below sample. Notice an alias `r1809` is given to the 201810 namespace for the 1809 release, and the alias is tagged on AutoLaunch and AutoLaunchArguments inline.
->
-> ```xml
-> xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config"
-> xmlns:r1809="http://schemas.microsoft.com/AssignedAccess/201810/config"
-> >
->
->
->
->
->
-> ...
->
-> ```
-
-- Example XML configuration for a multi-app kiosk for Windows 11, version 22H2 with [KB5026446](https://support.microsoft.com/kb/5026446).
-
- > [!NOTE]
- > This example demonstrates the use of StartPins and TaskbarLayout elements. For more information, see [Set up a multi-app kiosk on Windows 11 devices](/windows/configuration/lock-down-windows-11-to-specific-apps).
- >
- > - StartPins element is used to pin apps to the Start menu and uses the [pinnedList JSON](/windows/configuration/customize-start-menu-layout-windows-11#get-the-pinnedlist-json) format.
- > - TaskbarLayout element is used to pin apps to the taskbar and uses the [TaskbarLayoutModification XML](/windows/configuration/customize-taskbar-windows-11#create-the-xml-file) format.
-
- ```xml
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- ]]>
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- ]]>
-
-
-
-
-
- MultiAppKioskUser
-
-
-
-
- ```
-
-- Example XML configuration for a multi-app kiosk for Windows 10.
-
- ```xml
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- ]]>
-
-
-
-
-
-
- MultiAppKioskUser
-
-
-
-
- ```
-
-- Example XML configuration for a Microsoft Edge kiosk. This Microsoft Edge kiosk is configured to launch www.bing.com on startup in a public browsing mode.
-
- ```xml
-
-
-
-
-
-
-
-
-
- EdgeKioskUser
-
-
-
-
- ```
-
-- Example XML configuration for setting a breakout sequence to be Ctrl+A on a Microsoft Edge kiosk.
-
- > [!NOTE]
- > **BreakoutSequence** can be applied to any kiosk type, not just an Edge kiosk.
-
- ```xml
-
-
-
-
-
-
-
-
-
-
- EdgeKioskUser
-
-
-
-
- ```
-
-
+For practical examples of Assigned Access configuration files, see [Assigned Access examples](/windows/configuration/assigned-access/examples).
## Windows Holographic for Business edition example
This example configures the following apps: Skype, Learning, Feedback Hub, and Calibration, for first line workers. Use this XML in a provisioning package using Windows Configuration Designer. For instructions, see [Configure HoloLens using a provisioning package](/hololens/hololens-provisioning).
-```xml
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- ]]>
-
-
-
-
-
-
-
-
- AzureAD\multiusertest@analogfre.onmicrosoft.com
-
-
-
-
-```
-
## Handling XML in Configuration
XML encoding (escaped) and CDATA of the XML in the Data node will both ensure that DM client can properly interpret the SyncML and send the configuration xml as string (in original format, unescaped) to AssignedAccess CSP to handle.
diff --git a/windows/configuration/assigned-access/index.md b/windows/configuration/assigned-access/index.md
index c1560b3726..5a56c1b812 100644
--- a/windows/configuration/assigned-access/index.md
+++ b/windows/configuration/assigned-access/index.md
@@ -110,4 +110,19 @@ These locations contain the latest "evaluated" configuration for each sign-in us
"HKCU\SOFTWARE\Microsoft\Windows\AssignedAccessConfiguration" (If it doesn't exist, it means no Assigned Access to be enforced for this user.)
+
+> [!WARNING]
+> You can only assign one single app kiosk profile to an individual user account on a device. The single app profile does not support domain groups.
+
+> [!NOTE]
+> If the application calls `KeyCredentialManager.IsSupportedAsync` when it is running in assigned access mode and it returns false on the first run, invoke the settings screen and select an appropriate PIN to use with Windows Hello. This is the settings screen that is hidden by the application running in assigned access mode. You can only use Windows Hello if you first leave assigned access mode, select your convenience pin, and then go back into assigned access mode again.
+
+> [!NOTE]
+> Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it can't revert all the enforced policies (for example, Start Layout).
+
+> [!IMPORTANT]
+> - You can't set both KioskModeApp and ShellLauncher at the same time on the device.
+
+> [!NOTE]
+> To authorize a compatible configuration XML that includes 1809 or prerelease elements and attributes, always include the namespace of these add-on schemas, and decorate the attributes and elements accordingly with the namespace alias. For example, to configure the auto-launch feature that was added in the 1809 release, use the below sample. Notice an alias `r1809` is given to the 201810 namespace for the 1809 release, and the alias is tagged on AutoLaunch and AutoLaunchArguments inline.
-->
\ No newline at end of file
diff --git a/windows/configuration/assigned-access/overview.md b/windows/configuration/assigned-access/overview.md
index e361b0d1b1..2edf095de2 100644
--- a/windows/configuration/assigned-access/overview.md
+++ b/windows/configuration/assigned-access/overview.md
@@ -18,8 +18,8 @@ Assigned Access is a Windows feature that you can use to configure a device as a
A single UWP application or Microsoft Edge is executed in full screen, above the lock screen. Users can only use that application. If the kiosk app is closed, it will automatically restart. Practical examples include:
- - Digital signs
- - Public web browsing kiosks
+ - Public browsing
+ - Interactive digital signage
This experience is sometimes referred to as *single-app kiosk*.
:::column-end:::
@@ -30,13 +30,15 @@ Assigned Access is a Windows feature that you can use to configure a device as a
:::column-end:::
:::column span="3":::
#### Restricted user experience
- Users can execute a defined list of applications, with a custom and locked down Start menu and Taskbar. Practical examples include:
+ Users can execute a defined list of applications, with a custom Start menu and Taskbar. Practical examples include:
- Frontline worker devices
- Student devices
- Lab devices
:::column-end:::
:::row-end:::
+When applying an Assigned Access configuration to a device, different policy settings are enforced, creating a locked down experience to the users.
+
Assigned Access profiles only apply to non-admin accounts. When an administrator signs in, the Assigned Access restrictions don't apply.
## Configure a kiosk
diff --git a/windows/configuration/assigned-access/shell-launcher/index.md b/windows/configuration/assigned-access/shell-launcher/index.md
index ee76caf41d..c43da0a8b1 100644
--- a/windows/configuration/assigned-access/shell-launcher/index.md
+++ b/windows/configuration/assigned-access/shell-launcher/index.md
@@ -36,7 +36,7 @@ Here are some limitations to consider when using Shell Launcher:
## Configure a device with Shell Launcher
-To configure Shell Launcher, you must use the [Assigned Access CSP](/windows/client-management/mdm/assignedaccess-csp#shelllauncher). The configuration of Shell Launcher is done using an XML file. The XML file is then applied to the device via the Assigned Access CSP, using one of the following options:
+The configuration of Shell Launcher is done using an XML file. The XML file is applied to the device via the [Assigned Access CSP](/windows/client-management/mdm/assignedaccess-csp#shelllauncher), using one of the following options:
- A Mobile Device Management (MDM) solution, like Microsoft Intune
- Provisioning packages