Microsoft Education documentation and resources
-
- IT Pro
+ IT Admins
-
-
-
+
@@ -132,7 +134,7 @@ author: CelesteDG
- - +
+@@ -226,6 +228,25 @@ author: CelesteDG+- + +
@@ -350,6 +371,25 @@ author: CelesteDG++ +++++++++
+ ++Microsoft Teams
+Make the most of Microsoft Teams and find out how to deploy, launch pilot teams, and launch Teams to the rest of your institution.
+- + +
++ +++++++++
+ ++Microsoft Teams
+Learn how the new classroom experiences in Microsoft Teams can help you manage your daily workflow more easily than ever before.
+diff --git a/education/windows/change-history-edu.md b/education/windows/change-history-edu.md index e3cec30bb9..8cce637c8d 100644 --- a/education/windows/change-history-edu.md +++ b/education/windows/change-history-edu.md @@ -7,17 +7,28 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: edu author: CelesteDG +ms.author: celested +ms.date: 06/19/2017 --- # Change history for Windows 10 for Education This topic lists new and updated topics in the [Windows 10 for Education](index.md) documentation. +## June 2017 + +| New or changed topic | Description | +| --- | ---- | +| [Windows 10 configuration recommendations for education customers](configure-windows-for-education.md) | Includes the following updates: - New configuration guidance for IT administrators to enable students and school personnel, who use assistive technology apps not available in the Microsoft Store for Education and use devices running Windows 10 S, to be successful in the classroom and in their jobs. - New configuration information when using Windows 10 S for education. | +| [Deployment recommendations for school IT administrators](edu-deployment-recommendations.md) | New configuration guidance for IT administrators to enable students and school personnel, who use assistive technology apps not available in the Microsoft Store for Education and use devices running Windows 10 S, to be successful in the classroom and in their jobs. | +| [Use the Set up School PCs app ](use-set-up-school-pcs-app.md) | Updated the recommended apps section to include information about Office 365 for Windows 10 S (Education Preview). | + ## May 2017 | New or changed topic | Description | | --- | ---- | | [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](switch-to-pro-education.md) | New. If you have an education tenant and use devices Windows 10 Pro or Windows 10 S in your schools, find out how you can opt-in to a free switch to Windows 10 Pro Education. | +| [Use the Set up School PCs app ](use-set-up-school-pcs-app.md) | Updated. Now includes network tips and updated step-by-step instructions that show the latest updates to the app such as Wi-Fi setup. | ## RELEASE: Windows 10, version 1703 (Creators Update) diff --git a/education/windows/chromebook-migration-guide.md b/education/windows/chromebook-migration-guide.md index a192cd0edf..f88c07f4b1 100644 --- a/education/windows/chromebook-migration-guide.md +++ b/education/windows/chromebook-migration-guide.md @@ -9,6 +9,7 @@ ms.sitesec: library ms.pagetype: edu, devices localizationpriority: high author: craigash +ms.author: celested --- # Chromebook migration guide diff --git a/education/windows/configure-windows-for-education.md b/education/windows/configure-windows-for-education.md index 03caa021e6..4cbabcfdff 100644 --- a/education/windows/configure-windows-for-education.md +++ b/education/windows/configure-windows-for-education.md @@ -1,11 +1,13 @@ --- title: Windows 10 configuration recommendations for education customers description: Provides guidance on ways to configure the OS diagnostic data, consumer experiences, Cortana, search, as well as some of the preinstalled apps, so that Windows is ready for your school. -keywords: Windows 10 deployment, recommendations, privacy settings, school, education, configurations +keywords: Windows 10 deployment, recommendations, privacy settings, school, education, configurations, accessibility, assistive technology ms.mktglfcycl: plan ms.sitesec: library localizationpriority: high author: CelesteDG +ms.author: celested +ms.date: 06/19/2017 --- # Windows 10 configuration recommendations for education customers @@ -14,18 +16,20 @@ author: CelesteDG - Windows 10 -Privacy is important to us, we want to provide you with ways to customize the OS diagnostic data, consumer experiences, Cortana, search, as well as some of the preinstalled apps, for usage with [education editions of Windows 10](windows-editions-for-education-customers.md) in education environments. To learn more about Microsoft’s commitment to privacy, see [Windows 10 and privacy](https://go.microsoft.com/fwlink/?LinkId=809305). +Privacy is important to us, we want to provide you with ways to customize the OS diagnostic data, consumer experiences, Cortana, search, as well as some of the preinstalled apps, for usage with [education editions of Windows 10](windows-editions-for-education-customers.md) in education environments. These features work on all Windows 10 editions, but education editions of Windows 10 have the settings preconfigured. See the following table for more information. To learn more about Microsoft's commitment to privacy, see [Windows 10 and privacy](https://go.microsoft.com/fwlink/?LinkId=809305). + +We want all students to have the chance to use the apps they need for success in the classroom and all school personnel to have apps they need for their job. Students and school personnel who use assistive technology apps not available in the Microsoft Store for Education, and use devices running Windows 10 S, will be able to configure the device at no additional charge to Windows 10 Pro Education. To learn more about the steps to configure this, see [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](switch-to-pro-education.md). In Windows 10, version 1703 (Creators Update), it is straightforward to configure Windows to be education ready. -| Area | How to configure | What this does | Notes | -| --- | --- | --- | --- | -| **Diagnostic Data** | **SetEduPolicies** | Sets Diagnostic Data to [Basic](https://technet.microsoft.com/itpro/windows/configure/configure-windows-telemetry-in-your-organization) | On Windows 10 Education or Windows 10 Pro Education, this is already set | -| **Microsoft consumer experiences** | **SetEduPolicies** | Disables suggested content from Windows such as app recommendations | On Windows 10 Education or Windows 10 Pro Education, this is already set | -| **Cortana** | **AllowCortana** | Disables Cortana | * Cortana is enabled by default on all editions in Windows 10, version 1703 * If using Windows 10 Pro Education or Windows 10 Education, upgrading from Windows 10, version 1607 to Windows 10, version 1703 will enable Cortana. You can use the **AllowCortana** policy to turn it off. | -| **Safe search** | **SetEduPolicies** | Locks Bing safe search to Strict in Microsoft Edge | On Windows 10 Education or Windows 10 Pro Education, this is already set | -| **Bing search advertising** | Ad free search with Bing | Disables ads when searching the internet with Bing in Microsoft Edge | Depending on your specific requirements, there are different ways to configure this as detailed in [Ad-free search with Bing](#ad-free-search-with-bing) | -| **Apps** | **SetEduPolicies** | Preinstalled apps like Microsoft Edge, Movies & TV, Groove, and Skype become education ready | * Any app can detect Windows is running in an education ready configuration through [IsEducationEnvironment](https://docs.microsoft.com/en-us/uwp/api/windows.system.profile.educationsettings) * On Windows 10 Education or Windows 10 Pro Education, this is already set | +| Area | How to configure | What this does | Windows 10 Education | Windows 10 Pro Education | Windows 10 S | +| --- | --- | --- | --- | --- | --- | +| **Diagnostic Data** | **SetEduPolicies** | Sets Diagnostic Data to [Basic](https://technet.microsoft.com/itpro/windows/configure/configure-windows-telemetry-in-your-organization) | This is already set | This is already set | The policy must be set | +| **Microsoft consumer experiences** | **SetEduPolicies** | Disables suggested content from Windows such as app recommendations | This is already set | This is already set | The policy must be set | +| **Cortana** | **AllowCortana** | Disables Cortana * Cortana is enabled by default on all editions in Windows 10, version 1703 | If using Windows 10 Education, upgrading from Windows 10, version 1607 to Windows 10, version 1703 will enable Cortana. See the [Recommended configuration](#recommended-configuration) section below for recommended Cortana settings. | If using Windows 10 Pro Education, upgrading from Windows 10, version 1607 to Windows 10, version 1703 will enable Cortana. See the [Recommended configuration](#recommended-configuration) section below for recommended Cortana settings. | See the [Recommended configuration](#recommended-configuration) section below for recommended Cortana settings. | +| **Safe search** | **SetEduPolicies** | Locks Bing safe search to Strict in Microsoft Edge | This is already set | This is already set | The policy must be set | +| **Bing search advertising** | Ad free search with Bing | Disables ads when searching the internet with Bing in Microsoft Edge | Depending on your specific requirements, there are different ways to configure this as detailed in [Ad-free search with Bing](#ad-free-search-with-bing) | Depending on your specific requirements, there are different ways to configure this as detailed in [Ad-free search with Bing](#ad-free-search-with-bing) | Depending on your specific requirements, there are different ways to configure this as detailed in [Ad-free search with Bing](#ad-free-search-with-bing) | +| **Apps** | **SetEduPolicies** | Preinstalled apps like Microsoft Edge, Movies & TV, Groove, and Skype become education ready * Any app can detect Windows is running in an education ready configuration through [IsEducationEnvironment](https://docs.microsoft.com/en-us/uwp/api/windows.system.profile.educationsettings) | This is already set | This is already set | The policy must be set | ## Recommended configuration @@ -39,7 +43,7 @@ It is easy to be education ready when using Microsoft products. We recommend the You can [sign up to learn more about Intune for Education](https://info.microsoft.com/US-WNDWS-CNTNT-FY17-01Jan-17-IntuneforEducationlandingpageandnurture292531_01Registration-ForminBody.html). -3. On PCs running Windows 10, version 1703 (Windows 10 Pro Education or Windows 10 Education): +3. On PCs running Windows 10, version 1703: 1. Provision the PC using one of these methods: * [Provision PCs with the Set up School PCs app](use-set-up-school-pcs-app.md) - This will automatically set both **SetEduPolicies** to True and **AllowCortana** to False. * [Provision PCs with a custom package created with Windows Configuration Designer](https://technet.microsoft.com/en-us/itpro/windows/configure/provisioning-create-package) - Make sure to set both **SetEduPolicies** to True and **AllowCortana** to False. @@ -48,6 +52,8 @@ It is easy to be education ready when using Microsoft products. We recommend the * Manually Azure AD join the PC during the Windows device setup experience. 3. Enroll the PCs in MDM. * If you have activated Intune for Education in your Azure AD tenant, enrollment will happen automatically when the PC is joined to Azure AD. Intune for Education will automatically set **SetEduPolicies** to True and **AllowCortana** to False. + 4. Ensure that needed assistive technology apps can be used. + * If you have students or school personnel who rely on assistive technology apps that are not available in the Microsoft Store for Education, and who are using a Windows 10 S device, configure their device to Windows 10 Pro Education to allow the download and use of non-Microsoft Store assistive technology apps. See [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](switch-to-pro-education.md) for more info. 4. Distribute the PCs to students. @@ -69,6 +75,9 @@ You can set all the education compliance areas through both provisioning and man ## AllowCortana **AllowCortana** is a policy that enables or disables Cortana. It is a policy node in the Policy configuration service provider, [AllowCortana](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#experience-allowcortana). +> [!NOTE] +> See the [Recommended configuration](#recommended-configuration) section for recommended Cortana settings. + Use one of these methods to set this policy. ### MDM diff --git a/education/windows/create-tests-using-microsoft-forms.md b/education/windows/create-tests-using-microsoft-forms.md index c2df9fb7ba..a5fdfd4970 100644 --- a/education/windows/create-tests-using-microsoft-forms.md +++ b/education/windows/create-tests-using-microsoft-forms.md @@ -7,6 +7,7 @@ ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: edu author: CelesteDG +ms.author: celested redirect_url: https://support.microsoft.com/help/4000711/windows-10-create-tests-using-microsoft-forms --- diff --git a/education/windows/deploy-windows-10-in-a-school-district.md b/education/windows/deploy-windows-10-in-a-school-district.md index 1669188d1a..70f71c103a 100644 --- a/education/windows/deploy-windows-10-in-a-school-district.md +++ b/education/windows/deploy-windows-10-in-a-school-district.md @@ -8,6 +8,7 @@ ms.pagetype: edu ms.sitesec: library localizationpriority: high author: craigash +ms.author: celested --- # Deploy Windows 10 in a school district diff --git a/education/windows/deploy-windows-10-in-a-school.md b/education/windows/deploy-windows-10-in-a-school.md index 8c0efa4efe..6c6ecf4977 100644 --- a/education/windows/deploy-windows-10-in-a-school.md +++ b/education/windows/deploy-windows-10-in-a-school.md @@ -8,6 +8,7 @@ ms.pagetype: edu ms.sitesec: library localizationpriority: high author: craigash +ms.author: celested --- # Deploy Windows 10 in a school diff --git a/education/windows/edu-deployment-recommendations.md b/education/windows/edu-deployment-recommendations.md index e10a79af57..7d76300a59 100644 --- a/education/windows/edu-deployment-recommendations.md +++ b/education/windows/edu-deployment-recommendations.md @@ -6,6 +6,8 @@ ms.mktglfcycl: plan ms.sitesec: library localizationpriority: high author: CelesteDG +ms.author: celested +ms.date: 06/19/2017 ms.prod: W10 --- @@ -15,17 +17,17 @@ ms.prod: W10 - Windows 10 -Your privacy is important to us, so we want to provide you with ways to customize the OS privacy settings, as well as some of the apps, so that you can choose what information is shared with Microsoft. To learn more about Microsoft’s commitment to privacy, see [Windows 10 and privacy](https://go.microsoft.com/fwlink/?LinkId=809305). +Your privacy is important to us, so we want to provide you with ways to customize the OS privacy settings, as well as some of the apps, so that you can choose what information is shared with Microsoft. To learn more about Microsoft’s commitment to privacy, see [Windows 10 and privacy](https://go.microsoft.com/fwlink/?LinkId=809305). The following sections provide some best practices and specific privacy settings we’d like you to be aware of. Also see [Windows 10 configuration recommendations for education customers](configure-windows-for-education.md) for more information about ways to customize the OS diagnostic data, consumer experiences, Cortana, and search. -Here are some best practices and specific privacy settings we’d like you to be aware of. Also see [Windows 10 configuration recommendations for education customers](configure-windows-for-education.md) for more information about ways to customize the OS diagnostic data, consumer experiences, Cortana, and search. +We want all students to have the chance to use the apps they need for success in the classroom and all school personnel to have apps they need for their job. Students and school personnel who use assistive technology apps not available in the Microsoft Store for Education, and use devices running Windows 10 S, will be able to configure the device at no additional charge to Windows 10 Pro Education. To learn more about the steps to configure this, see [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](switch-to-pro-education.md). ## Deployment best practices Keep these best practices in mind when deploying any edition of Windows 10 in schools or districts: * A Microsoft account is only intended for consumer services. Enterprises and educational institutions should use enterprise versions where possible, such as Skype for Business, OneDrive for Business, and so on. For schools, consider using mobile device management (MDM) or Group Policy to block students from adding a Microsoft account as a secondary account. - * If schools allow the use of personal accounts by their students to access personal services, schools should be aware that these accounts belong to individuals, not the school. * IT administrators, school officials, and teachers should also consider ratings when picking apps from the Windows Store. +* If you have students or school personnel who rely on assistive technology apps that are not available in the Microsoft Store for Education, and who are using a Windows 10 S device, configure their device to Windows 10 Pro Education to allow the download and use of non-Microsoft Store assistive technology apps. See [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](switch-to-pro-education.md) for more info. ## Windows 10 Contacts privacy settings diff --git a/education/windows/education-scenarios-store-for-business.md b/education/windows/education-scenarios-store-for-business.md index f9dbde2df7..25070b6aa8 100644 --- a/education/windows/education-scenarios-store-for-business.md +++ b/education/windows/education-scenarios-store-for-business.md @@ -7,6 +7,7 @@ ms.mktglfcycl: plan ms.sitesec: library localizationpriority: high author: trudyha +ms.author: trudyha --- # Working with Microsoft Store for Education diff --git a/education/windows/get-minecraft-for-education.md b/education/windows/get-minecraft-for-education.md index 595d935f57..036d1cf2b7 100644 --- a/education/windows/get-minecraft-for-education.md +++ b/education/windows/get-minecraft-for-education.md @@ -7,6 +7,7 @@ ms.mktglfcycl: plan ms.sitesec: library localizationpriority: high author: trudyha +ms.author: trudyha --- # Get Minecraft: Education Edition diff --git a/education/windows/images/suspc_createpackage_recommendedapps_office061217.png b/education/windows/images/suspc_createpackage_recommendedapps_office061217.png new file mode 100644 index 0000000000..ac2ccbe4eb Binary files /dev/null and b/education/windows/images/suspc_createpackage_recommendedapps_office061217.png differ diff --git a/education/windows/index.md b/education/windows/index.md index 9d3f183b1d..33b03ce19c 100644 --- a/education/windows/index.md +++ b/education/windows/index.md @@ -8,6 +8,7 @@ ms.sitesec: library ms.pagetype: edu localizationpriority: high author: CelesteDG +ms.author: celested --- # Windows 10 for Education diff --git a/education/windows/school-get-minecraft.md b/education/windows/school-get-minecraft.md index 2d28eccfc9..66feebb077 100644 --- a/education/windows/school-get-minecraft.md +++ b/education/windows/school-get-minecraft.md @@ -7,6 +7,7 @@ ms.mktglfcycl: plan ms.sitesec: library localizationpriority: high author: trudyha +ms.author: trudyha --- # For IT administrators - get Minecraft: Education Edition diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md index 39f0826ba4..120247f9d3 100644 --- a/education/windows/set-up-school-pcs-technical.md +++ b/education/windows/set-up-school-pcs-technical.md @@ -8,6 +8,7 @@ ms.sitesec: library ms.pagetype: edu localizationpriority: high author: CelesteDG +ms.author: celested --- # Technical reference for the Set up School PCs app diff --git a/education/windows/set-up-students-pcs-to-join-domain.md b/education/windows/set-up-students-pcs-to-join-domain.md index 81edf2b7a9..d33c9d5620 100644 --- a/education/windows/set-up-students-pcs-to-join-domain.md +++ b/education/windows/set-up-students-pcs-to-join-domain.md @@ -7,6 +7,7 @@ ms.mktglfcycl: plan ms.sitesec: library localizationpriority: high author: CelesteDG +ms.author: celested --- # Set up student PCs to join domain diff --git a/education/windows/set-up-students-pcs-with-apps.md b/education/windows/set-up-students-pcs-with-apps.md index bcb92096ac..32d966f479 100644 --- a/education/windows/set-up-students-pcs-with-apps.md +++ b/education/windows/set-up-students-pcs-with-apps.md @@ -7,6 +7,7 @@ ms.mktglfcycl: plan ms.sitesec: library localizationpriority: high author: CelesteDG +ms.author: celested --- # Provision student PCs with apps diff --git a/education/windows/set-up-windows-10.md b/education/windows/set-up-windows-10.md index 1d43aed651..00647deb81 100644 --- a/education/windows/set-up-windows-10.md +++ b/education/windows/set-up-windows-10.md @@ -8,6 +8,7 @@ ms.sitesec: library ms.pagetype: edu localizationpriority: high author: CelesteDG +ms.author: celested --- # Set up Windows devices for education diff --git a/education/windows/switch-to-pro-education.md b/education/windows/switch-to-pro-education.md index a42e464435..1619f08a9a 100644 --- a/education/windows/switch-to-pro-education.md +++ b/education/windows/switch-to-pro-education.md @@ -8,6 +8,7 @@ ms.sitesec: library ms.pagetype: edu localizationpriority: high author: CelesteDG +ms.author: celested --- # Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S @@ -41,30 +42,32 @@ There are two ways to switch from Windows 10 S to Windows 10 Pro Education, outl 1. **Bulk switch through Microsoft Store for Education** - In this scenario, the global admin for the Azure AD education tenant can use Microsoft Store to switch all Windows 10 S devices on the tenant to Windows 10 Pro Education. See [Switch using Microsoft Store for Education](#switch-using-microsoft-store-for-education) for details on how to do this. + In this scenario, the global admin for the Azure AD education tenant can use Microsoft Store to switch all Windows 10 S devices on the tenant to Windows 10 Pro Education. + + See [Switch using Microsoft Store for Education](#switch-using-microsoft-store-for-education) for details on how to do this. 2. **Asynchronous switch** In this scenario, the global admin must acquire the necessary keys and then select a method for key distribution. **Key acquisition options:** - - - Volume Licensing customers - For schools with active Microsoft Volume Licensing agreements, global admins can obtain free MAK keys for Windows 10 Pro Education. + - **Volume Licensing customers** - For schools with active Microsoft Volume Licensing agreements, global admins can obtain free MAK keys for Windows 10 Pro Education. > [!NOTE] > Windows 10 S is a Qualified OS (QOS) for Academic Volume Licensing only. + + - **Non-Volume Licensing customers** - For schools without an active Microsoft Volume Licensing agreement, the global admin can contact CSS, fill out a form and provide a proof of purchase to receive MAK keys for Windows 10 Pro Education. - - Non-Volume Licensing customers - For schools without an active Microsoft Volume Licensing agreement, the global admin can contact CSS, fill out a form and provide a proof of purchase to receive MAK keys for Windows 10 Pro Education. + **Key distribution options:** + + You can find step-by-step info on how to use each of the options described here in [Switch options from Windows 10 S to Windows 10 Pro Education](#switch-options-from-windows-10-s-to-windows-10-pro-education). - **Key distribution options:** - - - Bulk key distribution - You can apply MAK keys to switch the operating system on select devices or groups of devices using one of these methods: + - **Bulk key distribution** - You can apply MAK keys to switch the operating system on select devices or groups of devices using one of these methods: - Use Microsoft Intune for Education. See [Switch using Intune for Education](#switch-using-intune-for-education) for details on how to do this. - Use Windows Configuration Designer to create a provisioning package that will provision the switch on the device(s). See [Switch using Windows Configuration Designer](#switch-using-windows-configuration-designer) for details on how to do this. - Use the mobile device management (MDM) policy, **UpgradeEditionWithProductKey**. See [Switch using MDM](#switch-using-mdm) for details on how to do this. - Use scripting. See [Switch using scripting](#switch-using-scripting) for details on how to do this. - - - Manual key entry - You can also manually apply the MAK key using one of these methods: + - **Manual key entry** - You can also manually apply the MAK key using one of these methods: - Enter the MAK key in the Windows **Settings > Activation** page. See [Switch using the Activation page](#switch-using-the-activation-page) for details on how to do this. - Install with a media and key through Windows setup. We don't recommend this option due to the potential for multi-reboot requirements. diff --git a/education/windows/take-a-test-app-technical.md b/education/windows/take-a-test-app-technical.md index 2e60824894..5da7470ad4 100644 --- a/education/windows/take-a-test-app-technical.md +++ b/education/windows/take-a-test-app-technical.md @@ -8,6 +8,7 @@ ms.sitesec: library ms.pagetype: edu localizationpriority: high author: CelesteDG +ms.author: celested --- # Take a Test app technical reference diff --git a/education/windows/take-a-test-multiple-pcs.md b/education/windows/take-a-test-multiple-pcs.md index 19b0f65e62..ba5ffb4d9d 100644 --- a/education/windows/take-a-test-multiple-pcs.md +++ b/education/windows/take-a-test-multiple-pcs.md @@ -8,6 +8,7 @@ ms.sitesec: library ms.pagetype: edu localizationpriority: high author: CelesteDG +ms.author: celested --- # Set up Take a Test on multiple PCs diff --git a/education/windows/take-a-test-single-pc.md b/education/windows/take-a-test-single-pc.md index 19053b9c55..71827e3366 100644 --- a/education/windows/take-a-test-single-pc.md +++ b/education/windows/take-a-test-single-pc.md @@ -8,6 +8,7 @@ ms.sitesec: library ms.pagetype: edu localizationpriority: high author: CelesteDG +ms.author: celested --- # Set up Take a Test on a single PC diff --git a/education/windows/take-tests-in-windows-10.md b/education/windows/take-tests-in-windows-10.md index c526121def..94b00c53fa 100644 --- a/education/windows/take-tests-in-windows-10.md +++ b/education/windows/take-tests-in-windows-10.md @@ -8,6 +8,7 @@ ms.sitesec: library ms.pagetype: edu localizationpriority: high author: CelesteDG +ms.author: celested --- # Take tests in Windows 10 diff --git a/education/windows/teacher-get-minecraft.md b/education/windows/teacher-get-minecraft.md index 24cf0d3cb4..fb8d30ef6f 100644 --- a/education/windows/teacher-get-minecraft.md +++ b/education/windows/teacher-get-minecraft.md @@ -7,6 +7,7 @@ ms.mktglfcycl: plan ms.sitesec: library localizationpriority: high author: trudyha +ms.author: trudyha --- # For teachers - get Minecraft: Education Edition diff --git a/education/windows/use-set-up-school-pcs-app.md b/education/windows/use-set-up-school-pcs-app.md index bba42e5d55..bfc4179cfa 100644 --- a/education/windows/use-set-up-school-pcs-app.md +++ b/education/windows/use-set-up-school-pcs-app.md @@ -8,6 +8,8 @@ ms.sitesec: library ms.pagetype: edu localizationpriority: high author: CelesteDG +ms.author: celested +ms.date: 06/26/2017 --- # Use the Set up School PCs app @@ -66,6 +68,7 @@ Set up School PCs makes it easy to set up Windows 10 PCs with Microsoft's recomm > [!WARNING] > Only use the provisioning package on PCs that you want to configure and lock down for students. After you apply the provisioning package to a student PC, the PC must be reset to remove the settings. + * The student PCs must be in range of the Wi-Fi network that you configured in Set up School PCs or have a wired Ethernet connection when you set them up. Otherwise, setup will fail. * If the PC has already been set up and you want to return to the first-run experience to apply a new package, you can reset the PC to get to a clean state and get it back to the first-run experience and ready to provision again. To do this: @@ -90,18 +93,16 @@ Set up School PCs makes it easy to set up Windows 10 PCs with Microsoft's recomm Learn more about what Set up School PCs does, including provisioning details, in [Technical reference for the Set up School PCs app](set-up-school-pcs-technical.md). +## Prerequisites -## Set up School PCs app step-by-step +- [Download the latest Set up School PCs app from the Microsoft Store](https://www.microsoft.com/store/apps/9nblggh4ls40). +- Install the app on your work PC and make sure you're connected to your school's network. +- You must be an administrator on Office 365 and Azure Active Directory, and have Microsoft Store for Education configured. It's best if you sign up for and configure Intune for Education before using the Set up School PCs app. +- Have a USB drive, 1 GB or larger, to save the provisioning package. We recommend an 8 GB or larger USB drive if you're installing Office. -What you need: +## Set up School PCs step-by-step -- The **Set up School PCs** app, installed on your work PC and connected to your school's network. - - To get started, [download the latest Set up School PCs app from the Microsoft Store](https://www.microsoft.com/store/apps/9nblggh4ls40). - -- A USB drive, 1 GB or larger. We recommend an 8 GB or larger USB drive if you're installing Office. - -### Create the provisioning package in the app +### Create the provisioning package The **Set up School PCs** app guides you through the configuration choices for the student PCs. @@ -145,7 +146,7 @@ The **Set up School PCs** app guides you through the configuration choices for t  -5. To assign a name to the student PCs, in the **Assign a name to these student PCs** page: +5. To assign a name to the student PCs, in the **Name these devices** page: 1. Add a short name that Set up School PCs will use as a prefix to identify and easily manage the group of devices, apps, and other settings through your device management client. > [!NOTE] @@ -191,15 +192,21 @@ The **Set up School PCs** app guides you through the configuration choices for t 3. Click **Next** or **Skip** depending on whether you want to set up Take a Test. -8. In the **Add recommended apps** page, you can choose from a set of recommended Microsoft Store apps to provision. The recommended apps include Minecraft: Education Edition and several STEM and Makerspace apps. +8. In the **Add recommended apps** page, you can choose from a set of recommended Microsoft Store apps to provision. The recommended apps include the following: + * **Office 365 for Windows 10 S (Education Preview)** + * Office 365 for Windows 10 S will only work on student PCs running Windows 10 S. If you try to install this app on other editions of Windows, setup will fail. + * When adding the Office 365 for Windows 10 S to a package, the device you use to run Set up School PCs does not have to be running Windows 10 S. + * **Minecraft: Education Edition** - Free trial + * Popular **STEM and Makerspace apps** + 1. Select the apps that you would like to provision and then click **Next** when you're done. 2. Click **Skip** if you don't want to provision any apps. - **Figure 6** - Select from a set of recommended Microsoft Store apps + **Figure 6** - Select from a set of recommended Microsoft Store apps -  +  - The set of recommended Microsoft Store for Education apps may vary from what we show here. + The set of recommended Microsoft Store for Education apps may vary from what we show here. 9. In the **Review package summary** page, make sure that all the settings you configured appear correctly. 1. If you need to change any of the settings, you can on the sections to go back to that page and make your changes. diff --git a/education/windows/windows-editions-for-education-customers.md b/education/windows/windows-editions-for-education-customers.md index b798212e27..f25dbdafb2 100644 --- a/education/windows/windows-editions-for-education-customers.md +++ b/education/windows/windows-editions-for-education-customers.md @@ -8,6 +8,7 @@ ms.sitesec: library ms.pagetype: edu localizationpriority: high author: CelesteDG +ms.author: celested --- # Windows 10 editions for education customers diff --git a/mdop/docfx.json b/mdop/docfx.json index 5b4039884d..a9a41d5222 100644 --- a/mdop/docfx.json +++ b/mdop/docfx.json @@ -20,7 +20,13 @@ "ms.technology": "mdop", "ms.sitesec": "library", "ms.topic": "article", - "ms.author": "jamiet" + "ms.author": "jamiet", + "ms.date": "04/05/2017", + "_op_documentIdPathDepotMapping": { + "./": { + "depot_name": "Win.mdop" + } + } }, "externalReference": [ ], diff --git a/smb/docfx.json b/smb/docfx.json index 2e849d2d22..866b2b152c 100644 --- a/smb/docfx.json +++ b/smb/docfx.json @@ -29,9 +29,14 @@ "overwrite": [], "externalReference": [], "globalMetadata": { - "uhfHeaderId": "MSDocsHeader-WindowsIT", - "breadcrumb_path": "/windows/smb/breadcrumb/toc.json" - }, + "uhfHeaderId": "MSDocsHeader-WindowsIT", + "breadcrumb_path": "/windows/smb/breadcrumb/toc.json", + "_op_documentIdPathDepotMapping": { + "./": { + "depot_name": "TechNet.smb" + } + } + }, "fileMetadata": {}, "template": [], "dest": "smb" diff --git a/store-for-business/TOC.md b/store-for-business/TOC.md index ba2c1b8c8a..514ff6cfea 100644 --- a/store-for-business/TOC.md +++ b/store-for-business/TOC.md @@ -27,4 +27,5 @@ ### [Update Microsoft Store for Business and Microsoft Store for Education account settings](update-windows-store-for-business-account-settings.md) ### [Manage user accounts in Microsoft Store for Business and Education](manage-users-and-groups-windows-store-for-business.md) ## [Troubleshoot Microsoft Store for Business](troubleshoot-windows-store-for-business.md) +## [Notifications in Microsoft Store for Business and Education](notifications-microsoft-store-business.md) diff --git a/store-for-business/docfx.json b/store-for-business/docfx.json index 05874cfbb2..9fe69e52a3 100644 --- a/store-for-business/docfx.json +++ b/store-for-business/docfx.json @@ -35,7 +35,13 @@ "uhfHeaderId": "MSDocsHeader-WindowsIT", "ms.author": "trudyha", "ms.technology": "windows", - "ms.topic": "article" + "ms.topic": "article", + "ms.date": "05/09/2017", + "_op_documentIdPathDepotMapping": { + "./": { + "depot_name": "MSDN.store-for-business" + } + } }, "fileMetadata": {}, "template": [], diff --git a/store-for-business/education/TOC.md b/store-for-business/education/TOC.md index 2e4ef3a73c..1c2ebc03b3 100644 --- a/store-for-business/education/TOC.md +++ b/store-for-business/education/TOC.md @@ -32,4 +32,5 @@ ### [Update Microsoft Store for Business and Microsoft Store for Education account settings](/microsoft-store/update-windows-store-for-business-account-settings?toc=/microsoft-store/education/toc.json) ### [Manage user accounts in Microsoft Store for Business and Education](/microsoft-store/manage-users-and-groups-windows-store-for-business?toc=/microsoft-store/education/toc.json) ## [Troubleshoot Microsoft Store for Business](/microsoft-store/troubleshoot-windows-store-for-business?toc=/microsoft-store/education/toc.json) +## [Notifications in Microsoft Store for Business and Education](/microsoft-store/notifications-microsoft-store-business?toc=/microsoft-store/education/toc.json) diff --git a/store-for-business/notifications-microsoft-store-business.md b/store-for-business/notifications-microsoft-store-business.md new file mode 100644 index 0000000000..cb657a21ef --- /dev/null +++ b/store-for-business/notifications-microsoft-store-business.md @@ -0,0 +1,33 @@ +--- +title: Notifications in Microsoft Store for Business and Education (Windows 10) +description: Notifications alert you to issues or outages with Micrososft Store for Business and Education. +keywords: notifications, alerts +ms.assetid: +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: store +author: TrudyHa +localizationpriority: high +--- + +# Notifications in Microsoft Store for Business and Education + + +**Applies to** + +- Windows 10 +- Windows 10 Mobile + +Microsoft Store for Business and Microsoft Store for Education use a set of notifications to alert admins if there is an issue or outage with Microsoft Store. + +## Notifications for admins + +| Store area | Notification message | Customer impact | +| ---------- | -------------------- | --------------- | +| General | We’re on it. Something happened on our end with the Store. Waiting a bit might help. | You might be unable to sign in. There might be an intermittent Azure AD outage. | +| Manage | We’re on it. Something happened on our end with management for apps and software. We’re working to fix the problem. | You might be unable to manage inventory, including viewing inventory, distributing apps, assigning licenses, or viewing and managing order history. | +| Shop | We’re on it. Something happened on our end with purchasing. We’re working to fix the problem. | Shop might not be available. You might not be able to purchase new, or additional licenses. | +| Private store | We’re on it. Something happened on our end with your organization’s private store. People in your organization can’t download apps right now. We’re working to fix the problem. | People in your organization might not be able to view the private store, or get apps. | +| Acquistion and licensing | We’re on it. People in your org might not be able to install or use certain apps. We’re working to fix the problem. | People in your org might not be able to claim a license from your private store. | +| Partner | We’re on it. Something happened on our end with Find a Partner. We’re working to fix the problem. | You might not be able to search for a partner. | \ No newline at end of file diff --git a/store-for-business/update-windows-store-for-business-account-settings.md b/store-for-business/update-windows-store-for-business-account-settings.md index 637220cb67..f844b5251a 100644 --- a/store-for-business/update-windows-store-for-business-account-settings.md +++ b/store-for-business/update-windows-store-for-business-account-settings.md @@ -38,9 +38,12 @@ We need an email address in case we need to contact you about your Microsoft Sto Taxes for Microsoft Store for Business purchases are determined by your business address. Businesses in these countries can provide their VAT number or local equivalent: - Austria - Belgium +- Bulgaria - Croatia +- Cyprus - Czech Republic - Denmark +- Estonia - Finland - France - Germany @@ -48,6 +51,10 @@ Taxes for Microsoft Store for Business purchases are determined by your business - Hungary - Ireland - Italy +- Latvia +- Liechtenstein +- Lithuania +- Luxembourg - Malta - Netherlands - Norway @@ -65,8 +72,10 @@ These countries can provide their VAT number or local equivalent in **Payments & |Market| Tax identifier | |------|----------------| +| Australia | ABN (optional) | | Brazil | CNPJ (required) | | India | CST ID, VAT ID (both are optional) | +| New Zealand | GST Registration number (optional) | | Taiwan | VAT ID (optional) | ### Tax-exempt status diff --git a/store-for-business/windows-store-for-business-overview.md b/store-for-business/windows-store-for-business-overview.md index 0edcf1dfa2..430cd5c616 100644 --- a/store-for-business/windows-store-for-business-overview.md +++ b/store-for-business/windows-store-for-business-overview.md @@ -472,7 +472,7 @@ Microsoft Store for Business and Education is currently available in these marke- United Kingdom
- United States
- Uruguay
-- Viet Nam
+- Vietnam
- Virgin Islands, U.S.
- Zambia
- Zimbabwe
@@ -488,7 +488,11 @@ Customers in these markets can use Microsoft Store for Business and Education to ### Support for free apps and Minecraft: Education Edition Customers in these markets can use Microsoft Store for Business and Education to acquire free apps and Minecraft: Education Edition: +- Albania +- Bosnia - Brazil +- Georgia +- Korea - Taiwan - Ukraine diff --git a/windows/access-protection/credential-guard/credential-guard-known-issues.md b/windows/access-protection/credential-guard/credential-guard-known-issues.md index a3780e1d3f..d3b2ea0fff 100644 --- a/windows/access-protection/credential-guard/credential-guard-known-issues.md +++ b/windows/access-protection/credential-guard/credential-guard-known-issues.md @@ -17,34 +17,39 @@ author: brianlic-msft Credential Guard has certain application requirements. Credential Guard blocks specific authentication capabilities. Therefore applications that require such capabilities will not function when Credential Guard is enabled. For further information, see [Application requirements](https://docs.microsoft.com/en-us/windows/access-protection/credential-guard/credential-guard-requirements#application-requirements). -The following known issues have been fixed by servicing releases made available in the Cumulative Security Updates for April 2017: +The following known issue has been fixed by servicing releases made available in the Cumulative Security Updates for April 2017: -- KB4015217: [Credential Guard generates double bad password count on Active Directory domain-joined Windows 10 machines](https://support.microsoft.com/en-us/help/4015217/windows-10-update-kb4015217) +- [KB4015217 Credential Guard generates double bad password count on Active Directory domain-joined Windows 10 machines](https://support.microsoft.com/en-us/help/4015217/windows-10-update-kb4015217) - This issue can potentially lead to unexpected account lockouts. -See also Knowledge Base articles [KB4015219](https://support.microsoft.com/en-us/help/4015219/windows-10-update-kb4015219) and + This issue can potentially lead to unexpected account lockouts. See also Microsoft® Knowledge Base articles [KB4015219](https://support.microsoft.com/en-us/help/4015219/windows-10-update-kb4015219) and [KB4015221](https://support.microsoft.com/en-us/help/4015221/windows-10-update-kb4015221) -The following issue is under investigation. For available workarounds, see the following Knowledge Base article: -- [Installing AppSense Environment Manager on Windows 10 machines causes LSAiso.exe to exhibit high CPU usage when Credential Guard is enabled](http://www.appsense.com/kb/160525073917945) * [1] - - *Registration required to access this article. - - [1] For further technical information on LSAiso.exe, see this MSDN article: [Isolated User Mode (IUM) Processes](https://msdn.microsoft.com/library/windows/desktop/mt809132(v=vs.85).aspx) - The following issue affects Cisco AnyConnect Secure Mobility Client: -- [Blue screen on Windows 10 computers running Device Guard and Credential Guard with Cisco Anyconnect 4.3.04027](https://quickview.cloudapps.cisco.com/quickview/bug/CSCvc66692)** +- [Blue screen on Windows 10 computers running Device Guard and Credential Guard with Cisco Anyconnect 4.3.04027](https://quickview.cloudapps.cisco.com/quickview/bug/CSCvc66692) \* -**Registration required to access this article. +*Registration required to access this article. -Products that connect to Virtualization Based Security (VBS) protected processes can cause Credential Guard-enabled Windows 10 clients to exhibit high CPU usage. For further information, see the following Knowledge Base article: +The following issue affects McAfee Application and Change Control (MACC): +- [KB88869 Windows 10 machines exhibit high CPU sage with McAfee Application and Change Control (MACC) installed when Credential Guard is enabled](https://kc.mcafee.com/corporate/index?page=content&id=KB88869) [1] + -- KB88869: [Windows 10 machines exhibit high CPU usage with McAfee Application and Change Control (MACC) installed when Credential Guard is enabled](https://kc.mcafee.com/corporate/index?page=content&id=KB88869) +The following issue affects AppSense Environment Manager. + For further information, see the following Knowledge Base article: +- [Installing AppSense Environment Manager on Windows 10 machines causes LSAISO.exe to exhibit high CPU usage when Credential Guard is enabled](http://www.appsense.com/kb/160525073917945) [1] \** -The following issue is under investigation: +The following issue affects Citrix applications: +- Windows 10 machines exhibit high CPU usage with Citrix applications installed when Credential Guard is enabled. [1] + +[1] Products that connect to Virtualization Based Security (VBS) protected processes can cause Credential Guard-enabled Windows 10 or Windows Server 2016 machines to exhibit high CPU usage. For technical and troubleshooting information, see the following Microsoft Knowledge Base article: + +- [KB4032786 High CPU usage in the LSAISO process on Windows 10 or Windows Server 2016](https://support.microsoft.com/en-us/help/4032786) + +For further technical information on LSAISO.exe, see the MSDN article: [Isolated User Mode (IUM) Processes](https://msdn.microsoft.com/library/windows/desktop/mt809132(v=vs.85).aspx) + + + \** Registration is required to access this article. -- Windows 10 machines exhibit high CPU usage with Citrix applications installed when Credential Guard is enabled. ## Vendor support diff --git a/windows/access-protection/docfx.json b/windows/access-protection/docfx.json index 2a01ff236f..4d805de5fe 100644 --- a/windows/access-protection/docfx.json +++ b/windows/access-protection/docfx.json @@ -35,7 +35,13 @@ "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", "ms.technology": "windows", "ms.topic": "article", - "ms.author": "justinha" + "ms.author": "justinha", + "ms.date": "04/05/2017", + "_op_documentIdPathDepotMapping": { + "./": { + "depot_name": "MSDN.win-access-protection" + } + } }, "fileMetadata": {}, "template": [], diff --git a/windows/application-management/app-v/appv-auto-batch-sequencing.md b/windows/application-management/app-v/appv-auto-batch-sequencing.md index a90e25e2eb..5de2cf686f 100644 --- a/windows/application-management/app-v/appv-auto-batch-sequencing.md +++ b/windows/application-management/app-v/appv-auto-batch-sequencing.md @@ -155,6 +155,7 @@ There are 3 types of log files that occur when you sequence multiple apps at the - **Log.txt file**. Located in the **Output Package** folder. This file contains all code included in the NewAppVSequencerPackage cmdlet, including the allowed parameters. ### Related topics + - [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) - [How to install the App-V Sequencer](appv-install-the-sequencer.md) diff --git a/windows/application-management/app-v/appv-auto-batch-updating.md b/windows/application-management/app-v/appv-auto-batch-updating.md index 0430b81a0b..9dd0ce0b52 100644 --- a/windows/application-management/app-v/appv-auto-batch-updating.md +++ b/windows/application-management/app-v/appv-auto-batch-updating.md @@ -158,6 +158,7 @@ There are 3 types of log files that occur when you sequence multiple apps at the - **Log.txt file**. Located in the **Output Package** folder. This file contains all code included in the NewAppVSequencerPackage cmdlet, including the allowed parameters. ### Related topics + - [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) - [How to install the App-V Sequencer](appv-install-the-sequencer.md) diff --git a/windows/application-management/docfx.json b/windows/application-management/docfx.json index 62b8aeb9de..285dcee673 100644 --- a/windows/application-management/docfx.json +++ b/windows/application-management/docfx.json @@ -35,7 +35,13 @@ "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", "ms.technology": "windows", "ms.topic": "article", - "ms.author": "elizapo" + "ms.author": "elizapo", + "ms.date": "04/05/2017", + "_op_documentIdPathDepotMapping": { + "./": { + "depot_name": "MSDN.win-app-management" + } + } }, "fileMetadata": {}, "template": [], diff --git a/windows/client-management/TOC.md b/windows/client-management/TOC.md index 57e0175c71..40c24a2981 100644 --- a/windows/client-management/TOC.md +++ b/windows/client-management/TOC.md @@ -9,5 +9,5 @@ ## [Reset a Windows 10 Mobile device](reset-a-windows-10-mobile-device.md) ## [Windows 10 Mobile deployment and management guide](windows-10-mobile-and-mdm.md) ## [Windows libraries](windows-libraries.md) -## [Mobile device management protocol](mdm/index.md) +## [Mobile device management for solution providers](mdm/index.md) ## [Change history for Client management](change-history-for-client-management.md) diff --git a/windows/client-management/docfx.json b/windows/client-management/docfx.json index 72ba73ffff..f649a5d1af 100644 --- a/windows/client-management/docfx.json +++ b/windows/client-management/docfx.json @@ -35,7 +35,13 @@ "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", "ms.technology": "windows", "ms.topic": "article", - "ms.author": "dongill" + "ms.author": "dongill", + "ms.date": "04/05/2017", + "_op_documentIdPathDepotMapping": { + "./": { + "depot_name": "MSDN.win-client-management" + } + } }, "fileMetadata": {}, "template": [], diff --git a/windows/client-management/index.md b/windows/client-management/index.md index 7dc6c63ae6..226c9237e7 100644 --- a/windows/client-management/index.md +++ b/windows/client-management/index.md @@ -28,4 +28,5 @@ Learn about the administrative tools, tasks and best practices for managing Wind |[Reset a Windows 10 Mobile device](reset-a-windows-10-mobile-device.md)| Instructions for resetting a Windows 10 Mobile device using either *factory* or *'wipe and persist'* reset options| |[Deploy Windows 10 Mobile](windows-10-mobile-and-mdm.md)| Considerations and instructions for deploying Windows 10 Mobile| |[Windows libraries](windows-libraries.md)| Considerations and instructions for managing Windows 10 libraries such as My Documents, My Pictures, and My Music.| +|[Mobile device management for solution providers](mdm/index.md) | Procedural and reference documentation for solution providers providing mobile device management (MDM) for Windows 10 devices. | |[Change history for Client management](change-history-for-client-management.md) | This topic lists new and updated topics in the Client management documentation for Windows 10 and Windows 10 Mobile. | \ No newline at end of file diff --git a/windows/client-management/mdm/activesync-csp.md b/windows/client-management/mdm/activesync-csp.md index a395891a14..f63def3424 100644 --- a/windows/client-management/mdm/activesync-csp.md +++ b/windows/client-management/mdm/activesync-csp.md @@ -7,6 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- # ActiveSync CSP diff --git a/windows/client-management/mdm/activesync-ddf-file.md b/windows/client-management/mdm/activesync-ddf-file.md index 8aa90d6d7c..0ef6a1b1eb 100644 --- a/windows/client-management/mdm/activesync-ddf-file.md +++ b/windows/client-management/mdm/activesync-ddf-file.md @@ -7,6 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- # ActiveSync DDF file diff --git a/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md b/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md index e1c6986fe5..da5ae04b1b 100644 --- a/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md +++ b/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md @@ -7,6 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- # Add an Azure AD tenant and Azure AD subscription diff --git a/windows/client-management/mdm/alljoynmanagement-csp.md b/windows/client-management/mdm/alljoynmanagement-csp.md index 0746ed4175..94d224ad36 100644 --- a/windows/client-management/mdm/alljoynmanagement-csp.md +++ b/windows/client-management/mdm/alljoynmanagement-csp.md @@ -7,6 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- # AllJoynManagement CSP diff --git a/windows/client-management/mdm/alljoynmanagement-ddf.md b/windows/client-management/mdm/alljoynmanagement-ddf.md index ebc2840da3..0b2febb114 100644 --- a/windows/client-management/mdm/alljoynmanagement-ddf.md +++ b/windows/client-management/mdm/alljoynmanagement-ddf.md @@ -7,6 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- # AllJoynManagement DDF diff --git a/windows/client-management/mdm/application-csp.md b/windows/client-management/mdm/application-csp.md index 463b2e0c07..ad21866a9d 100644 --- a/windows/client-management/mdm/application-csp.md +++ b/windows/client-management/mdm/application-csp.md @@ -7,6 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- # APPLICATION configuration service provider diff --git a/windows/client-management/mdm/applicationrestrictions-xsd.md b/windows/client-management/mdm/applicationrestrictions-xsd.md index 312d90524e..f2b7971e0c 100644 --- a/windows/client-management/mdm/applicationrestrictions-xsd.md +++ b/windows/client-management/mdm/applicationrestrictions-xsd.md @@ -7,6 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- # ApplicationRestrictions XSD diff --git a/windows/client-management/mdm/applocker-csp.md b/windows/client-management/mdm/applocker-csp.md index a73544002c..e1097181a3 100644 --- a/windows/client-management/mdm/applocker-csp.md +++ b/windows/client-management/mdm/applocker-csp.md @@ -7,6 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- # AppLocker CSP diff --git a/windows/client-management/mdm/applocker-ddf-file.md b/windows/client-management/mdm/applocker-ddf-file.md index e332216b02..8212ab4928 100644 --- a/windows/client-management/mdm/applocker-ddf-file.md +++ b/windows/client-management/mdm/applocker-ddf-file.md @@ -7,6 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- # AppLocker DDF file diff --git a/windows/client-management/mdm/applocker-xsd.md b/windows/client-management/mdm/applocker-xsd.md index 1d578d006d..7b7aa1f830 100644 --- a/windows/client-management/mdm/applocker-xsd.md +++ b/windows/client-management/mdm/applocker-xsd.md @@ -7,6 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- # AppLocker XSD diff --git a/windows/client-management/mdm/appv-deploy-and-config.md b/windows/client-management/mdm/appv-deploy-and-config.md index d7f18cf787..bfbbb46f16 100644 --- a/windows/client-management/mdm/appv-deploy-and-config.md +++ b/windows/client-management/mdm/appv-deploy-and-config.md @@ -6,6 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- # Deploy and configure App-V apps using MDM diff --git a/windows/client-management/mdm/assign-seats.md b/windows/client-management/mdm/assign-seats.md index b39d6d9cdf..510be6e748 100644 --- a/windows/client-management/mdm/assign-seats.md +++ b/windows/client-management/mdm/assign-seats.md @@ -7,6 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- # Assign seat diff --git a/windows/client-management/mdm/assignedaccess-csp.md b/windows/client-management/mdm/assignedaccess-csp.md index aad87ff0e5..8c6466d2d4 100644 --- a/windows/client-management/mdm/assignedaccess-csp.md +++ b/windows/client-management/mdm/assignedaccess-csp.md @@ -7,6 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- # AssignedAccess CSP diff --git a/windows/client-management/mdm/assignedaccess-ddf.md b/windows/client-management/mdm/assignedaccess-ddf.md index 4f2fae2306..f3cb07376f 100644 --- a/windows/client-management/mdm/assignedaccess-ddf.md +++ b/windows/client-management/mdm/assignedaccess-ddf.md @@ -7,6 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- # AssignedAccess DDF diff --git a/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md b/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md index ebdb1d406e..d3ca116cea 100644 --- a/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md +++ b/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md @@ -7,6 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index 308b678f24..2007e89d95 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -6,6 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- # BitLocker CSP diff --git a/windows/client-management/mdm/bitlocker-ddf-file.md b/windows/client-management/mdm/bitlocker-ddf-file.md index 2b0491ab35..50a36cc987 100644 --- a/windows/client-management/mdm/bitlocker-ddf-file.md +++ b/windows/client-management/mdm/bitlocker-ddf-file.md @@ -6,6 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- # BitLocker DDF file diff --git a/windows/client-management/mdm/bootstrap-csp.md b/windows/client-management/mdm/bootstrap-csp.md index 86259803e4..50513be9bc 100644 --- a/windows/client-management/mdm/bootstrap-csp.md +++ b/windows/client-management/mdm/bootstrap-csp.md @@ -7,6 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- # BOOTSTRAP CSP diff --git a/windows/client-management/mdm/browserfavorite-csp.md b/windows/client-management/mdm/browserfavorite-csp.md index e762d03a4f..5e68ea5e83 100644 --- a/windows/client-management/mdm/browserfavorite-csp.md +++ b/windows/client-management/mdm/browserfavorite-csp.md @@ -7,6 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- # BrowserFavorite CSP diff --git a/windows/client-management/mdm/bulk-assign-and-reclaim-seats-from-user.md b/windows/client-management/mdm/bulk-assign-and-reclaim-seats-from-user.md index 3d370d247f..33f5904925 100644 --- a/windows/client-management/mdm/bulk-assign-and-reclaim-seats-from-user.md +++ b/windows/client-management/mdm/bulk-assign-and-reclaim-seats-from-user.md @@ -7,6 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- # Bulk assign and reclaim seats from users diff --git a/windows/client-management/mdm/bulk-enrollment-using-windows-provisioning-tool.md b/windows/client-management/mdm/bulk-enrollment-using-windows-provisioning-tool.md index dca0fac617..7a31519c1d 100644 --- a/windows/client-management/mdm/bulk-enrollment-using-windows-provisioning-tool.md +++ b/windows/client-management/mdm/bulk-enrollment-using-windows-provisioning-tool.md @@ -10,6 +10,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- diff --git a/windows/client-management/mdm/cellularsettings-csp.md b/windows/client-management/mdm/cellularsettings-csp.md index 2eb3f56669..2923939d83 100644 --- a/windows/client-management/mdm/cellularsettings-csp.md +++ b/windows/client-management/mdm/cellularsettings-csp.md @@ -7,6 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- # CellularSettings CSP diff --git a/windows/client-management/mdm/certificate-authentication-device-enrollment.md b/windows/client-management/mdm/certificate-authentication-device-enrollment.md index 06d6f265b6..0a2bceab37 100644 --- a/windows/client-management/mdm/certificate-authentication-device-enrollment.md +++ b/windows/client-management/mdm/certificate-authentication-device-enrollment.md @@ -7,6 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- # Certificate authentication device enrollment diff --git a/windows/client-management/mdm/certificate-renewal-windows-mdm.md b/windows/client-management/mdm/certificate-renewal-windows-mdm.md index 03875bfea6..c281ee131a 100644 --- a/windows/client-management/mdm/certificate-renewal-windows-mdm.md +++ b/windows/client-management/mdm/certificate-renewal-windows-mdm.md @@ -10,6 +10,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- # Certificate Renewal diff --git a/windows/client-management/mdm/certificatestore-csp.md b/windows/client-management/mdm/certificatestore-csp.md index 20bda706fb..96b14e8fb7 100644 --- a/windows/client-management/mdm/certificatestore-csp.md +++ b/windows/client-management/mdm/certificatestore-csp.md @@ -7,6 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- # CertificateStore CSP diff --git a/windows/client-management/mdm/certificatestore-ddf-file.md b/windows/client-management/mdm/certificatestore-ddf-file.md index dce1073030..64e0b3693f 100644 --- a/windows/client-management/mdm/certificatestore-ddf-file.md +++ b/windows/client-management/mdm/certificatestore-ddf-file.md @@ -7,6 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- # CertificateStore DDF file diff --git a/windows/client-management/mdm/cleanpc-csp.md b/windows/client-management/mdm/cleanpc-csp.md index 4f2d5cc211..87f6daf4e2 100644 --- a/windows/client-management/mdm/cleanpc-csp.md +++ b/windows/client-management/mdm/cleanpc-csp.md @@ -6,6 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- # CleanPC CSP diff --git a/windows/client-management/mdm/cleanpc-ddf.md b/windows/client-management/mdm/cleanpc-ddf.md index cfbd44cc65..82e162729b 100644 --- a/windows/client-management/mdm/cleanpc-ddf.md +++ b/windows/client-management/mdm/cleanpc-ddf.md @@ -7,6 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- # CleanPC DDF diff --git a/windows/client-management/mdm/clientcertificateinstall-csp.md b/windows/client-management/mdm/clientcertificateinstall-csp.md index 6391e50c7d..587a1318fc 100644 --- a/windows/client-management/mdm/clientcertificateinstall-csp.md +++ b/windows/client-management/mdm/clientcertificateinstall-csp.md @@ -7,6 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- # ClientCertificateInstall CSP diff --git a/windows/client-management/mdm/clientcertificateinstall-ddf-file.md b/windows/client-management/mdm/clientcertificateinstall-ddf-file.md index d94173af03..66c326a853 100644 --- a/windows/client-management/mdm/clientcertificateinstall-ddf-file.md +++ b/windows/client-management/mdm/clientcertificateinstall-ddf-file.md @@ -7,6 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- # ClientCertificateInstall DDF file diff --git a/windows/client-management/mdm/cm-cellularentries-csp.md b/windows/client-management/mdm/cm-cellularentries-csp.md index 94a6e27f51..392f0820ef 100644 --- a/windows/client-management/mdm/cm-cellularentries-csp.md +++ b/windows/client-management/mdm/cm-cellularentries-csp.md @@ -7,6 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- # CM\_CellularEntries CSP diff --git a/windows/client-management/mdm/cm-proxyentries-csp.md b/windows/client-management/mdm/cm-proxyentries-csp.md index 693b4feb34..3612c0995d 100644 --- a/windows/client-management/mdm/cm-proxyentries-csp.md +++ b/windows/client-management/mdm/cm-proxyentries-csp.md @@ -7,6 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- # CM\_ProxyEntries CSP diff --git a/windows/client-management/mdm/cmpolicy-csp.md b/windows/client-management/mdm/cmpolicy-csp.md index e83953965b..daa2d26d67 100644 --- a/windows/client-management/mdm/cmpolicy-csp.md +++ b/windows/client-management/mdm/cmpolicy-csp.md @@ -7,6 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- # CMPolicy CSP diff --git a/windows/client-management/mdm/cmpolicyenterprise-csp.md b/windows/client-management/mdm/cmpolicyenterprise-csp.md index a3c9b663bf..3decd7a9a4 100644 --- a/windows/client-management/mdm/cmpolicyenterprise-csp.md +++ b/windows/client-management/mdm/cmpolicyenterprise-csp.md @@ -7,6 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- # CMPolicyEnterprise CSP diff --git a/windows/client-management/mdm/cmpolicyenterprise-ddf-file.md b/windows/client-management/mdm/cmpolicyenterprise-ddf-file.md index 6305ea17c3..7f8e457270 100644 --- a/windows/client-management/mdm/cmpolicyenterprise-ddf-file.md +++ b/windows/client-management/mdm/cmpolicyenterprise-ddf-file.md @@ -7,6 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- # CMPolicyEnterprise DDF file diff --git a/windows/client-management/mdm/configuration-service-provider-reference.md b/windows/client-management/mdm/configuration-service-provider-reference.md index a6d30377d2..498d52cb2a 100644 --- a/windows/client-management/mdm/configuration-service-provider-reference.md +++ b/windows/client-management/mdm/configuration-service-provider-reference.md @@ -7,6 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- # Configuration service provider reference diff --git a/windows/client-management/mdm/create-a-custom-configuration-service-provider.md b/windows/client-management/mdm/create-a-custom-configuration-service-provider.md index 1d424f8364..2e6ce78778 100644 --- a/windows/client-management/mdm/create-a-custom-configuration-service-provider.md +++ b/windows/client-management/mdm/create-a-custom-configuration-service-provider.md @@ -7,6 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- # Create a custom configuration service provider diff --git a/windows/client-management/mdm/customdeviceui-csp.md b/windows/client-management/mdm/customdeviceui-csp.md index 955159f333..5e4e2289db 100644 --- a/windows/client-management/mdm/customdeviceui-csp.md +++ b/windows/client-management/mdm/customdeviceui-csp.md @@ -7,6 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- # CustomDeviceUI CSP diff --git a/windows/client-management/mdm/customdeviceui-ddf.md b/windows/client-management/mdm/customdeviceui-ddf.md index d44a97a49e..1299aadd20 100644 --- a/windows/client-management/mdm/customdeviceui-ddf.md +++ b/windows/client-management/mdm/customdeviceui-ddf.md @@ -7,6 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- # CustomDeviceUI DDF diff --git a/windows/client-management/mdm/data-structures-windows-store-for-business.md b/windows/client-management/mdm/data-structures-windows-store-for-business.md index 18b093df38..7a1bbaa552 100644 --- a/windows/client-management/mdm/data-structures-windows-store-for-business.md +++ b/windows/client-management/mdm/data-structures-windows-store-for-business.md @@ -10,6 +10,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower +ms.date: 06/19/2017 --- # Data structures for Windows Store for Business @@ -28,6 +29,7 @@ Here's the list of data structures used in the Windows Store for Business REST A - [LicenseType](#licensetype) - [LocalizedProductDetail](#localizedproductdetail) - [OfflineLicense](#offlinelicense) +- [PackageContentInfo](#packagecontentinfo) - [PackageLocation](#packagelocation) - [ProductArchitectures](#productarchitectures) - [ProductDetails](#productdetails) @@ -85,26 +87,22 @@ Specifies the properties of the alternate identifier.
@@ -117,31 +115,26 @@ Specifies the properties of the alternate identifier.- - + Name Type -Description seatDetails
Collection of [SeatDetails](#seatdetails)
+ collection of [SeatDetails](#seatdetails)
failedSeatOperations
Collection of [FailedSeatRequest](#failedseatrequest)
+ collection of [FailedSeatRequest](#failedseatrequest)
@@ -173,7 +166,7 @@ Specifies the properties of the alternate identifier.- - + Name Type -Description failureReason
string
productKey
[ProductKey](#productkey)
userName
string
contentId
string
Identifies a specific application
Identifies a specific application.
location
fileSize
integer -64
+ integer-64
Size of the file.
packageRank
integer-3232
integer-32
Optional
Care must be taken to get a support statement from the software provider that their app is safe with WIP before adding it to your **Allowed apps** list. If you don’t get this statement, it’s possible that you could experience app compat issues due to an app losing the ability to access a necessary file after revocation. + +#### Add a Recommended app to your Allowed apps list +For this example, we’re going to add Microsoft Edge, a recommended app, to the **Allowed apps** list. + +**To add a recommended app** +1. From the **App policy** blade, click the name of your policy, and then click **Allowed apps** from the menu that appears. + + The **Allowed apps** blade appears, showing you any apps that are already included in the list for this policy. + +  + +2. From the **Allowed apps** blade, click **Add apps**. + + The **Add apps** blade appears, showing you all **Recommended apps**. + +  + +3. Select each app you want to access your enterprise data, and then click **OK**. + + The **Allowed apps** blade updates to show you your selected apps. + +  + +#### Add a Store app to your Allowed apps list +For this example, we’re going to add Microsoft Power BI, a store app, to the **Allowed apps** list. + +**To add a Store app** +1. From the **App policy** blade, click the name of your policy, and then click **Allowed apps** from the menu that appears. + + The **Allowed apps** blade appears, showing you any apps that are already included in the list for this policy. + +2. From the **Allowed apps** blade, click **Add apps**. + +3. On the **Add apps** blade, click **Store apps** from the dropdown list. + + The blade changes to show boxes for you to add a publisher and app name. + +4. Type the name of the app and the name of its publisher, and then click **OK**. For this UWP app example, the **Publisher** is `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US` and the Product **name** is `Microsoft.MicrosoftPowerBIForWindows`. + +5. After you’ve entered the info into the fields, click **OK** to add the app to your **Allowed apps** list. + + >[!NOTE] + >To add multiple Store apps at the same time, you can click the menu **(…)** at the end of the app row, and then continue to add more apps. When you’re done, click **OK**. + +  + +If you don't know the publisher or product name, you can find them for both desktop devices and Windows 10 Mobile phones by following these steps. + +**To find the publisher and product name values for Store apps without installing them** +1. Go to the [Windows Store for Business](https://go.microsoft.com/fwlink/p/?LinkID=722910) website, and find your app. For example, *Microsoft Power BI*. + +2. Copy the ID value from the app URL. For example, Microsoft Power BI ID URL is https://www.microsoft.com/en-us/store/p/microsoft-power-bi/9nblgggzlxn1, and you'd copy the ID value, `9nblgggzlxn1`. + +3. In a browser, run the Store for Business portal web API, to return a JavaScript Object Notation (JSON) file that includes the publisher and product name values. For example, run https://bspmts.mp.microsoft.com/v1/public/catalog/Retail/Products/9nblgggzlxn1/applockerdata, where `9nblgggzlxn1` is replaced with your ID value. + + The API runs and opens a text editor with the app details. + + ```json + { + "packageIdentityName": "Microsoft.MicrosoftPowerBIForWindows", + "publisherCertificateName": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" + } + ``` + +4. Copy the `publisherCertificateName` value into the **Publisher** box and copy the `packageIdentityName` value into the **Name** box of Intune. + + >[!Important] + >The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as `CN=` followed by the `windowsPhoneLegacyId`.
For example:
+{+ +**To find the publisher and product name values for apps installed on Windows 10 mobile phones** +1. If you need to add mobile apps that aren't distributed through the Store for Business, you must use the **Windows Device Portal** feature. + + >**Note**
"windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d",
}
Your PC and phone must be on the same wireless network. + +2. On the Windows Phone, go to **Settings**, choose **Update & security**, and then choose **For developers**. + +3. In the **For developers** screen, turn on **Developer mode**, turn on **Device Discovery**, and then turn on **Device Portal**. + +4. Copy the URL in the **Device Portal** area into your device's browser, and then accept the SSL certificate. + +5. In the **Device discovery** area, press **Pair**, and then enter the PIN into the website from the previous step. + +6. On the **Apps** tab of the website, you can see details for the running apps, including the publisher and product names. + +7. Start the app for which you're looking for the publisher and product name values. + +8. Copy the `publisherCertificateName` value and paste it into the **Publisher Name** box and the `packageIdentityName` value into the **Product Name** box of Intune. + + >[!Important] + >The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as `CN=` followed by the `windowsPhoneLegacyId`.
For example:
+{+ +#### Add a Desktop app to your Allowed apps list +For this example, we’re going to add WordPad, a desktop app, to the **Allowed apps** list. + +**To add a Desktop app** +1. From the **App policy** blade, click the name of your policy, and then click **Allowed apps** from the menu that appears. + + The **Allowed apps** blade appears, showing you any apps that are already included in the list for this policy. + +2. From the **Allowed apps** blade, click **Add apps**. + +3. On the **Add apps** blade, click **Desktop apps** from the dropdown list. + + The blade changes to show boxes for you to add the following, based on what results you want returned: + +
"windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d",
}+
+ +4. After you’ve entered the info into the fields, click **OK** to add the app to your **Allowed apps** list. + + >[!Note] + >To add multiple Desktop apps at the same time, you can click the menu **(…)** at the end of the app row, and then continue to add more apps. When you’re done, click **OK**. + +  + + **To find the Publisher values for Desktop apps** + If you’re unsure about what to include for the publisher, you can run this PowerShell command: + + ```ps1 + Get-AppLockerFileInformation -Path "+ +Field +Manages ++ +All fields marked as “*” +All files signed by any publisher. (Not recommended) ++ +Publisher only +If you only fill out this field, you’ll get all files signed by the named publisher. +
This might be useful if your company is the publisher and signer of internal line-of-business apps.+ +Publisher and Name only +If you only fill out these fields, you’ll get all files for the specified product, signed by the named publisher. ++ +Publisher, Name, and File only +If you only fill out these fields, you’ll get any version of the named file or package for the specified product, signed by the named publisher. ++ +Publisher, Name, File, and Min version only +If you only fill out these fields, you’ll get the specified version or newer releases of the named file or package for the specified product, signed by the named publisher. +
This option is recommended for enlightened apps that weren't previously enlightened.+ +Publisher, Name, File, and Max version only +If you only fill out these fields, you’ll get the specified version or older releases of the named file or package for the specified product, signed by the named publisher. ++ +All fields completed +If you fill out all fields, you’ll get the specified version of the named file or package for the specified product, signed by the named publisher. +" + ``` + Where `" "` goes to the location of the app on the device. For example, `Get-AppLockerFileInformation -Path "C:\Program Files\Windows NT\Accessories\wordpad.exe"`. + + In this example, you'd get the following info: + + ``` json + Path Publisher + ---- --------- + %PROGRAMFILES%\WINDOWS NT\ACCESSORIES\WORDPAD.EXE O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US + ``` + Where the text, `O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US` is the publisher name to enter into the **Publisher** box and `WORDPAD.EXE` is the text to enter into the **File** box. + +#### Import a list of apps to your Allowed apps list +For this example, we’re going to add an AppLocker XML file to the **Allowed apps** list. You’ll use this option if you want to add multiple apps at the same time. For more info about AppLocker, see the [AppLocker](https://technet.microsoft.com/itpro/windows/keep-secure/applocker-overview) content. + +**To create a list of Allowed apps using the AppLocker tool** +1. Open the Local Security Policy snap-in (SecPol.msc). + +2. In the left blade, expand **Application Control Policies**, expand **AppLocker**, and then click **Packaged App Rules**. + +  + +3. Right-click in the right-hand blade, and then click **Create New Rule**. + + The **Create Packaged app Rules** wizard appears. + +4. On the **Before You Begin** page, click **Next**. + +  + +5. On the **Permissions** page, make sure the **Action** is set to **Allow** and the **User or group** is set to **Everyone**, and then click **Next**. + +  + +6. On the **Publisher** page, click **Select** from the **Use an installed packaged app as a reference** area. + +  + +7. In the **Select applications** box, pick the app that you want to use as the reference for your rule, and then click **OK**. For this example, we’re using Microsoft Dynamics 365. + +  + +8. On the updated **Publisher** page, click **Create**. + +  + +9. Click **No** in the dialog box that appears, asking if you want to create the default rules. You must not create default rules for your WIP policy. + +  + +9. Review the Local Security Policy snap-in to make sure your rule is correct. + +  + +10. In the left blade, right-click on **AppLocker**, and then click **Export policy**. + + The **Export policy** box opens, letting you export and save your new policy as XML. + +  + +11. In the **Export policy** box, browse to where the policy should be stored, give the policy a name, and then click **Save**. + + The policy is saved and you’ll see a message that says 1 rule was exported from the policy. + + **Example XML file**
+ This is the XML file that AppLocker creates for Microsoft Dynamics 365. + + ```xml + ++ + ``` + +12. After you’ve created your XML file, you need to import it by using Microsoft Intune. + +**To import your list of Allowed apps using Microsoft Intune** + +1. From the **Allowed apps** area, click **Import apps**. + + The blade changes to let you add your import file. + +  + +2. Browse to your exported AppLocker policy file, and then click **Open**. + + The file imports and the apps are added to your **Allowed app** list. + +#### Add exempt apps to your policy +If you're running into compatibility issues where your app is incompatible with WIP, but still needs to be used with enterprise data, you can exempt the app from the WIP restrictions. This means that your apps won't include auto-encryption or tagging and won't honor your network restrictions. It also means that your exempted apps might leak. + +**To exempt a Store app, a Desktop app, or an AppLocker policy file from the Allowed apps list** + +1. From the **App policy** blade, click the name of your policy, and then click **Exempt apps** from the menu that appears. + + The **Exempt apps** blade appears, showing you any apps that are already included in the list for this policy. + +2. From the **Exempt apps** blade, click **Add apps**. + + Be aware that when you exempt apps, they’re allowed to bypass the WIP restrictions and access your corporate data. To allow apps, see the [Add app rules to your policy](#add-apps-to_your-allowed-apps-list) section of this topic. + +3. Fill out the rest of the app info, based on the type of app you’re adding: + + - **Recommended app.** Follow the instructions in the [Add a Recommended app to your Allowed apps list](#add-a-recommended-app-to_your-allowed-apps-list) section of this topic. + + - **Store app.** Follow the instructions in the [Add a Store app to your Allowed apps list](#add-a-store-app-to_your-allowed-apps-list) section of this topic. + + - **Desktop app.** Follow the instructions in the [Add a Desktop app to your Allowed apps list](#add-a-desktop-app-to_your-allowed-apps-list) section of this topic. + + - **AppLocker policy file.** Follow the instructions to create your app list in the [Import a list of apps to your Allowed apps list](#import-a-list-of-apps-to_your-allowed-apps-list) section of this topic, using a list of exempted apps. + +4. Click **OK**. + +### Manage the WIP protection mode for your enterprise data +After you've added the apps you want to protect with WIP, you'll need to apply a management and protection mode. + +We recommend that you start with **Silent** or **Allow Overrides** while verifying with a small group that you have the right apps on your allowed apps list. After you're done, you can change to your final enforcement policy, **Hide Overrides**. + +>[!NOTE] +>For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md). + +**To add your protection mode** + +1. From the **App policy** blade, click the name of your policy, and then click **Required settings** from the menu that appears. + + The **Required settings** blade appears. + +  + + |Mode |Description | + |-----|------------| + |Hide Overrides |WIP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between other people and devices outside of your enterprise.| + |Allow Overrides |WIP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log. For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md).| + |Silent |WIP runs silently, logging inappropriate data sharing, without blocking anything that would’ve been prompted for employee interaction while in Allow Override mode. Unallowed actions, like apps inappropriately trying to access a network resource or WIP-protected data, are still stopped.| + |Off (not recommended) |WIP is turned off and doesn't help to protect or audit your data.+ ++ ++ ++ ++ + + + +
After you turn off WIP, an attempt is made to decrypt any WIP-tagged files on the locally attached drives. Be aware that your previous decryption and policy info isn’t automatically reapplied if you turn WIP protection back on.| + +2. Click **Save**. + +### Define your enterprise-managed corporate identity +Corporate identity, usually expressed as your primary Internet domain (for example, contoso.com), helps to identify and tag your corporate data from apps you’ve marked as protected by WIP. For example, emails using contoso.com are identified as being corporate and are restricted by your Windows Information Protection policies. + +Starting with Windows 10, version 1703, Intune automatically determines your corporate identity and adds it to the Corporate identity field. You can specify multiple domains owned by your enterprise by separating them with the "|" character. For example, (`contoso.com|newcontoso.com`). With multiple domains, the first one is designated as your corporate identity and all of the additional ones as being owned by the first one. We strongly recommend that you include all of your email address domains in this list. + +**To change your corporate identity** + +1. From the **App policy** blade, click the name of your policy, and then click **Required settings** from the menu that appears. + + The **Required settings** blade appears. + +2. If the identity isn’t correct, or if you need to add additional domains, type info into the **Corporate identity** field. For example, `contoso.com|newcontoso.com`. + +  + +### Choose where apps can access enterprise data +After you've added a protection mode to your apps, you'll need to decide where those apps can access enterprise data on your network. + +There are no default locations included with WIP, you must add each of your network locations. This area applies to any network endpoint device that gets an IP address in your enterprise’s range and is also bound to one of your enterprise domains, including SMB shares. Local file system locations should just maintain encryption (for example, on local NTFS, FAT, ExFAT). + +>[!Important] +>Every WIP policy should include policy that defines your enterprise network locations.
Classless Inter-Domain Routing (CIDR) notation isn’t supported for WIP configurations. + +**To define where your allowed apps can find and send enterprise data on you network** + +1. From the **App policy** blade, click the name of your policy, and then click **Advanced settings** from the menu that appears. + + The **Advanced settings** blade appears. + +2. Click **Add network boundary** from the Network perimeter area. + + The **Add network boundary** blade appears. + +  + +3. Select the type of network boundary to add from the **Boundary type** box. + +4. Type a name for your boundary into the **Name** box, add your values to the **Value** box, based on the following options, and then click **OK**. + ++
+ +5. Repeat steps 1-4 to add any additional network boundaries. + +6. Decide if you want to Windows to look for additional network settings: + +  + + - **Enterprise Proxy Servers list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the proxy servers you specified in the network boundary definition as the complete list of proxy servers available on your network. If you clear this box, Windows will search for additional proxy servers in your immediate network. + + - **Enterprise IP Ranges list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the IP ranges you specified in the network boundary definition as the complete list of IP ranges available on your network. If you clear this box, Windows will search for additional IP ranges on any domain-joined devices connected to your network. + +### Upload your Data Recovery Agent (DRA) certificate +After you create and deploy your WIP policy to your employees, Windows begins to encrypt your corporate data on the employees’ local device drive. If somehow the employees’ local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the Data Recovery Agent (DRA) certificate lets Windows use an included public key to encrypt the local data while you maintain the private key that can unencrypt the data. + +>[!Important] +>Using a DRA certificate isn’t mandatory. However, we strongly recommend it. For more info about how to find and export your data recovery certificate, see the [Data Recovery and Encrypting File System (EFS)](https://go.microsoft.com/fwlink/p/?LinkId=761462) topic. For more info about creating and verifying your EFS DRA certificate, see the [Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](https://tnstage.redmond.corp.microsoft.com/en-us/itpro/windows/keep-secure/create-and-verify-an-efs-dra-certificate) topic. + +**To upload your DRA certificate** +1. From the **App policy** blade, click the name of your policy, and then click **Advanced settings** from the menu that appears. + + The **Advanced settings** blade appears. + +2. In the **Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data** box, click **Browse** to add a data recovery certificate for your policy. + +  + +### Choose your optional WIP-related settings +After you've decided where your protected apps can access enterprise data on your network, you’ll be asked to decide if you want to add any optional WIP settings. + +**To set your optional settings** + +1. Choose to set any or all optional settings: + +  + + - **Prevent corporate data from being accessed by apps when the device is locked. Applies only to Windows 10 Mobile.** Determines whether to encrypt enterprise data using a key that's protected by an employee's PIN code on a locked device. Apps won't be able to read corporate data when the device is locked. The options are: + + - **On (recommended).** Turns on the feature and provides the additional protection. + + - **Off, or not configured.** Doesn't enable this feature. + + - **Revoke encryption keys on unenroll.** Determines whether to revoke a user’s local encryption keys from a device when it’s unenrolled from Windows Information Protection. If the encryption keys are revoked, a user no longer has access to encrypted corporate data. The options are: + + - **On, or not configured (recommended).** Revokes local encryption keys from a device during unenrollment. + + - **Off.** Stop local encryption keys from being revoked from a device during unenrollment. For example if you’re migrating between Mobile Device Management (MDM) solutions. + + - **Show the Windows Information Protection icon overlay.** Determines whether the Windows Information Protection icon overlay appears on corporate files in the Save As and File Explorer views. The options are: + + - **On.** Allows the Windows Information Protection icon overlay to appear on corporate files in the Save As and File Explorer views. Additionally, for unenlightened but allowed apps, the icon overlay also appears on the app tile and with Managed text on the app name in the **Start** menu. + + - **Off, or not configured (recommended).** Stops the Windows Information Protection icon overlay from appearing on corporate files or unenlightened, but allowed apps. Not configured is the default option. + + - **Use Azure RMS for WIP.** Determines whether to use Azure Rights Management encryption with Windows Information Protection. + + - **On.** Starts using Azure Rights Management encryption with WIP. By turning this option on, you can also add a TemplateID GUID to specify who can access the Azure Rights Management protected files, and for how long. For more info about setting up Azure Rights management and using a template ID with WIP, see the [Choose to set up Azure Rights Management with WIP](#choose-to-set-up-azure-rights-management-with-wip) section of this topic. + + - **Off, or not configured.** Stops using Azure Rights Management encryption with WIP. + +### Choose to set up Azure Rights Management with WIP +WIP can integrate with Microsoft Azure Rights Management to enable secure sharing of files by using removable drives such as USB drives. For more info about Azure Rights Management, see [Microsoft Azure Rights Management](https://products.office.com/en-us/business/microsoft-azure-rights-management). To integrate Azure Rights Management with WIP, you must already have Azure Rights Management set up. + +To configure WIP to use Azure Rights Management, you must set the **AllowAzureRMSForEDP** MDM setting to **1** in Microsoft Intune. This setting tells WIP to encrypt files copied to removable drives with Azure Rights Management, so they can be shared amongst your employees on computers running at least Windows 10, version 1703. + +Optionally, if you don’t want everyone in your organization to be able to share your enterprise data, you can set the **RMSTemplateIDForEDP** MDM setting to the **TemplateID** of the Azure Rights Management template used to encrypt the data. You must make sure to mark the template with the **EditRightsData** option. + +>[!NOTE] +>For more info about setting the **AllowAzureRMSForEDP** and the **RMSTemplateIDForEDP** MDM settings, see the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/enterprisedataprotection-csp) topic. For more info about setting up and using a custom template, see [Configuring custom templates for the Azure Rights Management service](https://docs.microsoft.com/en-us/information-protection/deploy-use/configure-custom-templates) topic. + +## Related topics +- [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md) + +- [Deploy your Windows Information Protection (WIP) policy](deploy-wip-policy-using-intune.md) + +- [Associate and deploy your Windows Information Protection (WIP) and VPN policies by using Microsoft Intune](create-vpn-and-wip-policy-using-intune.md) + +- [General guidance and best practices for Windows Information Protection (WIP)](guidance-and-best-practices-wip.md) + +- [What is Azure Rights Management?]( https://docs.microsoft.com/en-us/information-protection/understand-explore/what-is-azure-rms) + +- [Create and deploy Windows Information Protection (WIP) app protection policy with Intune and MAM](https://docs.microsoft.com/en-us/intune/deploy-use/create-windows-information-protection-policy-with-intune) + +- [Intune MAM Without Enrollment](https://blogs.technet.microsoft.com/configmgrdogs/2016/02/04/intune-mam-without-enrollment/) + +- [Azure RMS Documentation Update for May 2016](https://blogs.technet.microsoft.com/enterprisemobility/2016/05/31/azure-rms-documentation-update-for-may-2016/) + +>[!NOTE] +>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). \ No newline at end of file diff --git a/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune.md b/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune.md index 2b277e056a..cbdd0a70de 100644 --- a/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune.md +++ b/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune.md @@ -1,5 +1,5 @@ --- -title: Create a Windows Information Protection (WIP) policy using Microsoft Intune (Windows 10) +title: Create a Windows Information Protection (WIP) with enrollment policy using the classic console for Microsoft Intune (Windows 10) description: Microsoft Intune helps you create and deploy your Windows Information Protection (WIP) policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. ms.assetid: 4b307c99-3016-4d6a-9ae7-3bbebd26e721 ms.prod: w10 @@ -10,12 +10,12 @@ author: eross-msft localizationpriority: high --- -# Create a Windows Information Protection (WIP) policy using Microsoft Intune +# Create a Windows Information Protection (WIP) using the classic console for Microsoft Intune **Applies to:** -- Windows 10, version 1703 -- Windows 10 Mobile (except Microsoft Azure Rights Management, which is only available on the desktop) +- Windows 10, version 1607 and later +- Windows 10 Mobile, version 1607 and later Microsoft Intune helps you create and deploy your Windows Information Protection (WIP) policy, including letting you choose your allowed apps, your WIP-protection level, and how to find enterprise data on the network. @@ -39,7 +39,7 @@ During the policy-creation process in Intune, you can choose the apps you want t The steps to add your app rules are based on the type of rule template being applied. You can add a store app (also known as a Universal Windows Platform (UWP) app), a signed Windows desktop app, or an AppLocker policy file. >[!Important] ->WIP-aware apps are expected to prevent enterprise data from going to unprotected network locations and to avoid encrypting personal data. On the other hand, WIP-unaware apps might not respect the corporate network boundary, and WIP-unaware apps will encrypt all files they create or modify. This means that they could encrypt personal data and cause data loss during the revocation process.+ +Boundary type +Value format +Description ++ +Cloud Resources +With proxy: contoso.sharepoint.com,contoso.internalproxy1.com| +
contoso.visualstudio.com,contoso.internalproxy2.com
Without proxy: contoso.sharepoint.com|contoso.visualstudio.comSpecify the cloud resources to be treated as corporate and protected by WIP. +
For each cloud resource, you may also optionally specify a proxy server from your Internal proxy servers list to route traffic for this cloud resource. Be aware that all traffic routed through your Internal proxy servers is considered enterprise.
If you have multiple resources, you must separate them using the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example:URL <,proxy>|URL <,proxy>.
Important
In some cases, such as when an app connects directly to a cloud resource through an IP address, Windows can’t tell whether it’s attempting to connect to an enterprise cloud resource or to a personal site. In this case, Windows blocks the connection by default. To stop Windows from automatically blocking these connections, you can add the/*AppCompat*/string to the setting. For example:URL <,proxy>|URL <,proxy>|/*AppCompat*/.
When using this string, we recommend that you also turn on [Azure Active Directory Conditional Access](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-conditional-access), using the Domain joined or marked as compliant option, which blocks apps from accessing any enterprise cloud resources that are protected by conditional access.+ +Network domain names +corp.contoso.com,region.contoso.com +Starting with Windows 10, version 1703, this field is optional. +
Specify the DNS suffixes used in your environment. All traffic to the fully-qualified domains appearing in this list will be protected.
If you have multiple resources, you must separate them using the "," delimiter.+ +Proxy servers +proxy.contoso.com:80;proxy2.contoso.com:443 +Specify the proxy servers your devices will go through to reach your cloud resources. Using this server type indicates that the cloud resources you’re connecting to are enterprise resources. +
This list shouldn’t include any servers listed in your Internal proxy servers list. Internal proxy servers must be used only for WIP-protected (enterprise) traffic.
If you have multiple resources, you must separate them using the ";" delimiter.+ +Internal proxy servers +contoso.internalproxy1.com;contoso.internalproxy2.com +Specify the internal proxy servers your devices will go through to reach your cloud resources. Using this server type indicates that the cloud resources you’re connecting to are enterprise resources. +
This list shouldn’t include any servers listed in your Proxy servers list. Proxy servers must be used only for non-WIP-protected (non-enterprise) traffic.
If you have multiple resources, you must separate them using the ";" delimiter.+ +IPv4 ranges +**Starting IPv4 Address:** 3.4.0.1 +
**Ending IPv4 Address:** 3.4.255.254
**Custom URI:** 3.4.0.1-3.4.255.254,
10.0.0.1-10.255.255.254Starting with Windows 10, version 1703, this field is optional. +
Specify the addresses for a valid IPv4 value range within your intranet. These addresses, used with your Network domain names, define your corporate network boundaries.
If you have multiple ranges, you must separate them using the "," delimiter.+ +IPv6 ranges +**Starting IPv6 Address:** 2a01:110:: +
**Ending IPv6 Address:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff
**Custom URI:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff,
fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffffStarting with Windows 10, version 1703, this field is optional. +
Specify the addresses for a valid IPv6 value range within your intranet. These addresses, used with your Network domain names, define your corporate network boundaries.
If you have multiple ranges, you must separate them using the "," delimiter.+ +Neutral resources +sts.contoso.com,sts.contoso2.com +Specify your authentication redirection endpoints for your company. +
These locations are considered enterprise or personal, based on the context of the connection before the redirection.
If you have multiple resources, you must separate them using the "," delimiter.Care must be taken to get a support statement from the software provider that their app is safe with WIP before adding it to your **App Rules** list. If you don’t get this statement, it’s possible that you could experience app compat issues due to an app losing the ability to access a necessary file after revocation. +>Enlightened apps are expected to prevent enterprise data from going to unprotected network locations and to avoid encrypting personal data. On the other hand, WIP-unaware apps might not respect the corporate network boundary, and WIP-unaware apps will encrypt all files they create or modify. This means that they could encrypt personal data and cause data loss during the revocation process.
Care must be taken to get a support statement from the software provider that their app is safe with WIP before adding it to your **App Rules** list. If you don’t get this statement, it’s possible that you could experience app compat issues due to an app losing the ability to access a necessary file after revocation. #### Add a store app rule to your policy For this example, we’re going to add Microsoft OneNote, a store app, to the **App Rules** list. @@ -309,13 +309,13 @@ If you're running into compatibility issues where your app is incompatible with ### Manage the WIP protection mode for your enterprise data After you've added the apps you want to protect with WIP, you'll need to apply a management and protection mode. -We recommend that you start with **Silent** or **Override** while verifying with a small group that you have the right apps on your protected apps list. After you're done, you can change to your final enforcement policy, either **Override** or **Block**. +We recommend that you start with **Silent** or **Allow Overrides** while verifying with a small group that you have the right apps on your protected apps list. After you're done, you can change to your final enforcement policy, either **Allow Overrides** or **Hide Overrides**. |Mode |Description | |-----|------------| -|Block |WIP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between other people and devices outside of your enterprise.| -|Override |WIP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log, accessible through the [Reporting CSP](https://go.microsoft.com/fwlink/p/?LinkID=746459). | -|Silent |WIP runs silently, logging inappropriate data sharing, without blocking anything that would’ve been prompted for employee interaction while in Override mode. Unallowed actions, like apps inappropriately trying to access a network resource or WIP-protected data, are still blocked.| +|Hide Overrides|WIP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between other people and devices outside of your enterprise.| +|Allow Overrides|WIP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log, accessible through the [Reporting CSP](https://go.microsoft.com/fwlink/p/?LinkID=746459). | +|Silent |WIP runs silently, logging inappropriate data sharing, without blocking anything that would’ve been prompted for employee interaction while in Allow Overrides mode. Unallowed actions, like apps inappropriately trying to access a network resource or WIP-protected data, are still blocked.| |Off (not recommended) |WIP is turned off and doesn't help to protect or audit your data.
After you turn off WIP, an attempt is made to decrypt any WIP-tagged files on the locally attached drives. Be aware that your previous decryption and policy info isn’t automatically reapplied if you turn WIP protection back on.|  diff --git a/windows/threat-protection/windows-information-protection/create-wip-policy-using-sccm.md b/windows/threat-protection/windows-information-protection/create-wip-policy-using-sccm.md index 4dbf46f1e8..d8a879c4d2 100644 --- a/windows/threat-protection/windows-information-protection/create-wip-policy-using-sccm.md +++ b/windows/threat-protection/windows-information-protection/create-wip-policy-using-sccm.md @@ -63,7 +63,7 @@ During the policy-creation process in System Center Configuration Manager, you c The steps to add your app rules are based on the type of rule template being applied. You can add a store app (also known as a Universal Windows Platform (UWP) app), a signed Windows desktop app, or an AppLocker policy file. >[!IMPORTANT] ->WIP-aware apps are expected to prevent enterprise data from going to unprotected network locations and to avoid encrypting personal data. On the other hand, WIP-unaware apps might not respect the corporate network boundary, and WIP-unaware apps will encrypt all files they create or modify. This means that they could encrypt personal data and cause data loss during the revocation process.
Care must be taken to get a support statement from the software provider that their app is safe with WIP before adding it to your **App rules** list. If you don’t get this statement, it’s possible that you could experience app compat issues due to an app losing the ability to access a necessary file after revocation. +>Enlightened apps are expected to prevent enterprise data from going to unprotected network locations and to avoid encrypting personal data. On the other hand, WIP-unaware apps might not respect the corporate network boundary, and WIP-unaware apps will encrypt all files they create or modify. This means that they could encrypt personal data and cause data loss during the revocation process.
Care must be taken to get a support statement from the software provider that their app is safe with WIP before adding it to your **App rules** list. If you don’t get this statement, it’s possible that you could experience app compat issues due to an app losing the ability to access a necessary file after revocation. #### Add a store app rule to your policy For this example, we’re going to add Microsoft OneNote, a store app, to the **App Rules** list. @@ -94,7 +94,9 @@ If you don't know the publisher or product name, you can find them for both desk 1. Go to the [Windows Store for Business](https://go.microsoft.com/fwlink/p/?LinkID=722910) website, and find your app. For example, Microsoft OneNote. - >**Note**
If your app is already installed on desktop devices, you can use the AppLocker local security policy MMC snap-in to gather the info for adding the app to the protected apps list. For info about how to do this, see the steps in the [Add an AppLocker policy file](#add-an-applocker-policy-file) section. + >[!NOTE] + + >If your app is already installed on desktop devices, you can use the AppLocker local security policy MMC snap-in to gather the info for adding the app to the protected apps list. For info about how to do this, see the steps in the [Add an AppLocker policy file](#add-an-applocker-policy-file) section. 2. Copy the ID value from the app URL. For example, Microsoft OneNote's ID URL is https://www.microsoft.com/store/apps/onenote/9wzdncrfhvjl, and you'd copy the ID value, `9wzdncrfhvjl`. @@ -111,7 +113,8 @@ If you don't know the publisher or product name, you can find them for both desk 4. Copy the `publisherCertificateName` value and paste them into the **Publisher Name** box, copy the `packageIdentityName` value into the **Product Name** box of Intune. - >**Important**
The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as “CN=” followed by the `windowsPhoneLegacyId`.For example:
+ >[!IMPORTANT] + >The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as “CN=” followed by the `windowsPhoneLegacyId`.
For example:
```json { "windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d", @@ -121,7 +124,8 @@ If you don't know the publisher or product name, you can find them for both desk **To find the Publisher and Product Name values for apps installed on Windows 10 mobile phones** 1. If you need to add mobile apps that aren't distributed through the Store for Business, you must use the **Windows Device Portal** feature. - >**Note**
Your PC and phone must be on the same wireless network. + >[!NOTE] + >Your PC and phone must be on the same wireless network. 2. On the Windows Phone, go to **Settings**, choose **Update & security**, and then choose **For developers**. @@ -137,7 +141,8 @@ If you don't know the publisher or product name, you can find them for both desk 8. Copy the `publisherCertificateName` value and paste it into the **Publisher Name** box and the `packageIdentityName` value into the **Product Name** box of Intune. - >**Important**
The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as “CN=” followed by the `windowsPhoneLegacyId`. + >[!IMPORTANT] + >The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as “CN=” followed by the `windowsPhoneLegacyId`. >For example:```json { @@ -460,6 +465,9 @@ After you've decided where your protected apps can access enterprise data on you - **No.** Hides the **Personal** option from employees. Be aware that if you pick this option, apps that use the **Save As** dialog box might encrypt new files as corporate data unless a different file path is given during the original file creation. After this happens, decryption of work files becomes more difficult. + >[!IMPORTANT] + >The **Show the Personal option in the File ownership menus of File Explorer and the Save As dialog box** option is only available for Configuration Manager versions 1610 and below. + - **Prevent corporate data from being accessed by apps when the device is locked. Applies only to Windows 10 Mobile**. Determines whether to encrypt enterprise data using a key that's protected by an employee's PIN code on a locked device. Apps won't be able to read corporate data when the device is locked. The options are: - **Yes (recommended).** Turns on the feature and provides the additional protection. diff --git a/windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md b/windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md new file mode 100644 index 0000000000..60eb44c676 --- /dev/null +++ b/windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md @@ -0,0 +1,43 @@ +--- +title: Deploy your Windows Information Protection (WIP) policy using the Azure portal for Microsoft Intune (Windows 10) +description: After you’ve created your Windows Information Protection (WIP) policy, you'll need to deploy it to your organization's enrolled devices. +keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, Intune +ms.prod: w10 +ms.mktglfcycl: explore +ms.sitesec: library +ms.pagetype: security +author: eross-msft +localizationpriority: high +--- + +# Deploy your Windows Information Protection (WIP) policy using the Azure portal for Microsoft Intune + +**Applies to:** + +- Windows 10, version 1607 and later +- Windows 10 Mobile, version 1607 and later (except Microsoft Azure Rights Management, which is only available on the desktop) + +After you’ve created your Windows Information Protection (WIP) policy, you'll need to deploy it to your organization's enrolled devices. Enrollment can be done for business or personal devices, allowing the devices to use your managed apps and to sync with your managed content and information. + +**To deploy your WIP policy** + +1. On the **App policy** pane, click your newly-created policy, click **User groups** from the menu that appears, and then click **Add user group**. + + A list of user groups, made up of all of the security groups in your Azure Active Directory, appear in the **Add user group** pane. + +2. Choose the group you want your policy to apply to, and then click **Select** to deploy the policy. + + The policy is deployed to the selected users' devices. + +  + + +>[!NOTE] +>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). + +## Related topics +- [Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune.md) + +- [Associate and deploy your Windows Information Protection (WIP) and VPN policies by using Microsoft Intune](create-vpn-and-wip-policy-using-intune.md) + +- [General guidance and best practices for Windows Information Protection (WIP)](guidance-and-best-practices-wip.md) diff --git a/windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune.md b/windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune.md index c7dcdf364b..a3b19da3c4 100644 --- a/windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune.md +++ b/windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune.md @@ -1,5 +1,5 @@ --- -title: Deploy your Windows Information Protection (WIP) policy using Microsoft Intune (Windows 10) +title: Deploy your Windows Information Protection (WIP) policy using the classic console for Microsoft Intune (Windows 10) description: After you’ve created your Windows Information Protection (WIP) policy, you'll need to deploy it to your organization's enrolled devices. ms.assetid: 9c4a01e7-0b1c-4f15-95d0-0389f0686211 keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, Intune @@ -11,11 +11,11 @@ author: eross-msft localizationpriority: high --- -# Deploy your Windows Information Protection (WIP) policy using Microsoft Intune +# Deploy your Windows Information Protection (WIP) policy using the classic console for Microsoft Intune **Applies to:** -- Windows 10, version 1607 -- Windows 10 Mobile +- Windows 10, version 1607 and later +- Windows 10 Mobile, version 1607 and later After you’ve created your Windows Information Protection (WIP) policy, you'll need to deploy it to your organization's enrolled devices. Enrollment can be done for business or personal devices, allowing the devices to use your managed apps and to sync with your managed content and information. diff --git a/windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md b/windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md index 77df2d4e51..159440b9aa 100644 --- a/windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md +++ b/windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md @@ -1,6 +1,6 @@ --- title: List of enlightened Microsoft apps for use with Windows Information Protection (WIP) (Windows 10) -description: Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your Protected Apps list. +description: Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your allowed apps list. ms.assetid: 17c85ea3-9b66-4b80-b511-8f277cb4345f keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection ms.prod: w10 @@ -21,7 +21,7 @@ localizationpriority: high Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your allowed apps list. ## Enlightened versus unenlightened apps -Apps can be enlightened (also referred to as WIP-aware) or unenlightened (also referred to as WIP-unaware). +Apps can be enlightened or unenlightened: - **Enlightened apps** can differentiate between corporate and personal data, correctly determining which to protect, based on your policies. @@ -31,6 +31,8 @@ Apps can be enlightened (also referred to as WIP-aware) or unenlightened (also r - Windows **Save As** experiences only allow you to save your files as enterprise. +- **WIP-work only apps** are unenlightened line-of-business apps that have been tested and deemed safe for use in an enterprise with WIP and Mobile App Management (MAM) solutions. + ## List of enlightened Microsoft apps Microsoft has made a concerted effort to enlighten several of our more popular apps, including the following: @@ -42,9 +44,13 @@ Microsoft has made a concerted effort to enlighten several of our more popular a - Mobile Office apps, including Word, Excel, PowerPoint, OneNote, and Outlook Mail and Calendar -- Microsoft Photos +- Office 365 ProPlus apps, including Word, Excel, PowerPoint, OneNote, and Outlook - +- OneDrive app + +- OneDrive sync client (OneDrive.exe, the next generation sync client) + +- Microsoft Photos - Groove Music @@ -58,6 +64,11 @@ Microsoft has made a concerted effort to enlighten several of our more popular a - Microsoft Remote Desktop +## List of WIP-work only apps from Microsoft +Microsoft still has apps that are unenlightened, but which have been tested and deemed safe for use in an enterprise with WIP and MAM solutions. + +- Skype for Business + ## Adding enlightened Microsoft apps to the allowed apps list You can add any or all of the enlightened Microsoft apps to your allowed apps list. Included here is the **Publisher name**, **Product or File name**, and **App Type** info for both Microsoft Intune and System Center Configuration Manager. @@ -70,12 +81,14 @@ You can add any or all of the enlightened Microsoft apps to your allowed apps li |PowerPoint Mobile |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Product Name:** Microsoft.Office.PowerPoint
**App Type:** Universal app | |OneNote |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Product Name:** Microsoft.Office.OneNote
**App Type:** Universal app | |Outlook Mail and Calendar |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Product Name:** microsoft.windowscommunicationsapps
**App Type:** Universal app | +|Office 365 ProPlus|Office 365 ProPlus apps are set up as a suite. You must use the [O365 ProPlus - Allow and Exempt AppLocker policy files (.zip files)](http://download.microsoft.com/download/7/0/D/70D72459-D72D-4673-B309-F480E3BEBCC9/O365%20ProPlus%20-%20WIP%20Enterprise%20AppLocker%20Policy%20Files.zip) to turn the suite on for WIP.
We don't recommend setting up Office by using individual paths or publisher rules.| |Microsoft Photos |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Product Name:** Microsoft.Windows.Photos
**App Type:** Universal app | |Groove Music |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Product Name:** Microsoft.ZuneMusic
**App Type:** Universal app | |Microsoft Movies & TV |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Product Name:** Microsoft.ZuneVideo
**App Type:** Universal app | |Microsoft Messaging |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Product Name:** Microsoft.Messaging
**App Type:** Universal app | |IE11 |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Binary Name:** iexplore.exe
**App Type:** Desktop app | -|Microsoft OneDrive |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Binary Name:** onedrive.exe
**App Type:** Desktop app| +|OneDrive Sync Client|**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Binary Name:** onedrive.exe
**App Type:** Desktop app| +|OneDrive app|**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Product Name:** Microsoft.Microsoftskydrive
**Product Version:**Product version: 17.21.0.0 (and later)
**App Type:** Universal app | |Notepad |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Binary Name:** notepad.exe
**App Type:** Desktop app | |Microsoft Paint |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Binary Name:** mspaint.exe
**App Type:** Desktop app | |Microsoft Remote Desktop |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Binary Name:** mstsc.exe
**App Type:** Desktop app | diff --git a/windows/threat-protection/windows-information-protection/mandatory-settings-for-wip.md b/windows/threat-protection/windows-information-protection/mandatory-settings-for-wip.md index d8d0fb1910..dfd5630dc2 100644 --- a/windows/threat-protection/windows-information-protection/mandatory-settings-for-wip.md +++ b/windows/threat-protection/windows-information-protection/mandatory-settings-for-wip.md @@ -24,7 +24,7 @@ This list provides all of the tasks and settings that are required for the opera |Task|Description| |----|-----------| |Add at least one app to the **Allowed apps** list in your WIP policy.|You must have at least one app added to your **Allowed apps** list. For more info about where this area is and how to add apps, see the **Add apps to your Allowed apps list** section of the policy creation topics.| -|Choose your WIP protection level.|You must choose the level of protection you want to apply to your WIP-protected content, including **Override**, **Silent**, or **Block**. For more info about where this area is and how to decide on your protection level, see the **Manage the WIP protection mode for your enterprise data** section of the policy creation topics. For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md).| +|Choose your WIP protection level.|You must choose the level of protection you want to apply to your WIP-protected content, including **Allow Overrides**, **Silent**, or **Hide Overrides**. For more info about where this area is and how to decide on your protection level, see the **Manage the WIP protection mode for your enterprise data** section of the policy creation topics. For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md).| |Specify your corporate identity.|This field is automatically filled out for you by Microsoft Intune. However, you must manually correct it if it’s incorrect or if you need to add additional domains. For more info about where this area is and what it means, see the **Define your enterprise-managed corporate identity** section of the policy creation topics. |Specify your network domain names.|Starting with Windows 10, version 1703, this field is optional.
Specify the DNS suffixes used in your environment. All traffic to the fully-qualified domains appearing in this list will be protected. For more info about where this area is and how to add your suffixes, see the table that appears in the **Choose where apps can access enterprise data** section of the policy creation topics.| |Specify your enterprise IPv4 or IPv6 ranges.|Starting with Windows 10, version 1703, this field is optional.
Specify the addresses for a valid IPv4 or IPv6 value range within your intranet. These addresses, used with your Network domain names, define your corporate network boundaries. For more info about where this area is and what it means, see the table that appears in the **Define your enterprise-managed corporate identity** section of the policy creation topics.| diff --git a/windows/threat-protection/windows-information-protection/overview-create-wip-policy.md b/windows/threat-protection/windows-information-protection/overview-create-wip-policy.md index eb659e55c3..caf17860ce 100644 --- a/windows/threat-protection/windows-information-protection/overview-create-wip-policy.md +++ b/windows/threat-protection/windows-information-protection/overview-create-wip-policy.md @@ -21,7 +21,8 @@ Microsoft Intune and System Center Configuration Manager helps you create and de ## In this section |Topic |Description | |------|------------| -|[Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune.md) |Intune helps you create and deploy your WIP policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. | +|[Create a Windows Information Protection (WIP) policy using the classic console for Microsoft Intune](create-wip-policy-using-intune.md) |Details about how to use the classic console for Microsoft Intune to create and deploy your WIP policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. | +|[Create a Windows Information Protection (WIP) with enrollment policy using the Azure portal for Microsoft Intune](create-wip-policy-using-intune-azure.md)|Details about how to use the Azure portal for Microsoft Intune to create and deploy your WIP policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. | |[Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager](create-wip-policy-using-sccm.md) |System Center Configuration Manager helps you create and deploy your WIP policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. | |[Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md) |Steps to create, verify, and perform a quick recovery using a Encrypting File System (EFS) Data Recovery Agent (DRA) certificate. | |[Determine the Enterprise Context of an app running in Windows Information Protection (WIP)](wip-app-enterprise-context.md) |Use the Task Manager to determine whether an app is considered work, personal or exempt by Windows Information Protection (WIP). | diff --git a/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip.md b/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip.md index fe8a354526..19071542aa 100644 --- a/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip.md +++ b/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip.md @@ -76,13 +76,13 @@ WIP gives you a new way to manage data policy enforcement for apps and documents - **Copying or downloading enterprise data.** When an employee or an app downloads content from a location like SharePoint, a network share, or an enterprise web location, while using a WIP-protected device, WIP encrypts the data on the device. - - **Using allowed apps.** Managed apps (apps that you've included on the **Allowed apps** list in your WIP policy) are allowed to access your enterprise data and will interact differently when used with unallowed, non-enterprise aware, or personal-only apps. For example, if WIP management is set to **Block**, your employees can copy and paste from one protected app to another allowed app, but not to personal apps. Imagine an HR person wants to copy a job description from an allowed app to the internal career website, an enterprise-protected location, but goofs and tries to paste into a personal app instead. The paste action fails and a notification pops up, saying that the app couldn’t paste because of a policy restriction. The HR person then correctly pastes to the career website without a problem. + - **Using allowed apps.** Managed apps (apps that you've included on the **Allowed apps** list in your WIP policy) are allowed to access your enterprise data and will interact differently when used with unallowed, non-enterprise aware, or personal-only apps. For example, if WIP management is set to **Hide overrides**, your employees can copy and paste from one protected app to another allowed app, but not to personal apps. Imagine an HR person wants to copy a job description from an allowed app to the internal career website, an enterprise-protected location, but goofs and tries to paste into a personal app instead. The paste action fails and a notification pops up, saying that the app couldn’t paste because of a policy restriction. The HR person then correctly pastes to the career website without a problem. - **Managed apps and restrictions.** With WIP you can control which apps can access and use your enterprise data. After adding an app to your allowed apps list, the app is trusted with enterprise data. All apps not on this list are stopped from accessing your enterprise data, depending on your WIP management-mode. You don’t have to modify line-of-business apps that never touch personal data to list them as allowed apps; just include them in the allowed apps list. - - **Deciding your level of data access.** WIP lets you block overrides, allow overrides, or audit employees' data sharing actions. Blocking overrides stops the action immediately. Allowing overrides lets the employee know there's a risk, but lets him or her continue to share the data while recording and auditing the action. Silent just logs the action without stopping anything that the employee could've overridden while using that setting; collecting info that can help you to see patterns of inappropriate sharing so you can take educative action or find apps that should be added to your allowed apps list. For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md). + - **Deciding your level of data access.** WIP lets you hide overrides, allow overrides, or audit employees' data sharing actions. Hiding overrides stops the action immediately. Allowing overrides lets the employee know there's a risk, but lets him or her continue to share the data while recording and auditing the action. Silent just logs the action without stopping anything that the employee could've overridden while using that setting; collecting info that can help you to see patterns of inappropriate sharing so you can take educative action or find apps that should be added to your allowed apps list. For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md). - **Data encryption at rest.** WIP helps protect enterprise data on local files and on removable media. @@ -131,8 +131,8 @@ You can set your WIP policy to use 1 of 4 protection and management modes: |Mode|Description| |----|-----------| -|Block |WIP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing enterprise data to non-enterprise-protected apps in addition to sharing enterprise data between apps or attempting to share outside of your organization’s network.| -|Override |WIP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log.| +|Hide overrides |WIP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing enterprise data to non-enterprise-protected apps in addition to sharing enterprise data between apps or attempting to share outside of your organization’s network.| +|Allow overrides |WIP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log.| |Silent |WIP runs silently, logging inappropriate data sharing, without stopping anything that would’ve been prompted for employee interaction while in Allow overrides mode. Unallowed actions, like apps inappropriately trying to access a network resource or WIP-protected data, are still stopped.| |Off |WIP is turned off and doesn't help to protect or audit your data.After you turn off WIP, an attempt is made to decrypt any WIP-tagged files on the locally attached drives. Be aware that your previous decryption and policy info isn’t automatically reapplied if you turn WIP protection back on.
**Note**
For more info about setting your WIP-protection modes, see either [Create a Windows Information Protection (WIP) policy using Intune](create-wip-policy-using-intune.md) or [Create and deploy a Windows Information Protection (WIP) policy using Configuration Manager](create-wip-policy-using-sccm.md), depending on your management solution. | diff --git a/windows/threat-protection/windows-information-protection/recommended-network-definitions-for-wip.md b/windows/threat-protection/windows-information-protection/recommended-network-definitions-for-wip.md index 0d5eb4ca6f..f07d6ab555 100644 --- a/windows/threat-protection/windows-information-protection/recommended-network-definitions-for-wip.md +++ b/windows/threat-protection/windows-information-protection/recommended-network-definitions-for-wip.md @@ -24,7 +24,7 @@ We recommend that you add the following URLs to the Enterprise Cloud Resources a ## Recommended Enterprise Cloud Resources This table includes the recommended URLs to add to your Enterprise Cloud Resources network setting, based on the apps you use in your organization. -|If your organization uses... |Add these entries to your Enterprise Cloud Resources network setting
(Replace "contoso" with your domain name(s) | +|If your organization uses... |Add these entries to your Enterprise Cloud Resources network setting
(Replace "contoso" with your domain name(s)| |-----------------------------|---------------------------------------------------------------------| |Office 365 for Business |- contoso.sharepoint.com
- contoso-my.sharepoint.com
- contoso-files.sharepoint.com
- tasks.office.com
- protection.office.com
- meet.lync.com
- teams.microsoft.com
- www.yammer.com
- yammer.com
- persona.yammer.com
+>[!NOTE] >At this time, only the English (en-us) content is available for editing. **To edit a topic** -1. All contributors who are ***not*** a Microsoft employee must [sign a Microsoft Contribution Licensing Agreement (CLA)](https://cla.microsoft.com/) before contributing to any Microsoft repositories. -If you've already contributed to Microsoft repositories in the past, congratulations! You've already completed this step. +1. All contributors who are ***not*** a Microsoft employee must [sign a Microsoft Contribution Licensing Agreement (CLA)](https://cla.microsoft.com/) before updating or adding to any Microsoft repositories. +If you've previously contributed to topics in the Microsoft repositories, congratulations! You've already completed this step. 2. Go to the page on TechNet that you want to update, and then click **Edit**. diff --git a/windows/whats-new/docfx.json b/windows/whats-new/docfx.json index bdecd75985..1bbc64ff9e 100644 --- a/windows/whats-new/docfx.json +++ b/windows/whats-new/docfx.json @@ -35,7 +35,13 @@ "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", "ms.technology": "windows", "ms.topic": "article", - "ms.author": "trudyha" + "ms.author": "trudyha", + "ms.date": "04/05/2017", + "_op_documentIdPathDepotMapping": { + "./": { + "depot_name": "MSDN.win-whats-new" + } + } }, "fileMetadata": {}, "template": [], diff --git a/windows/whats-new/index.md b/windows/whats-new/index.md index b64a85a590..e0bd472d86 100644 --- a/windows/whats-new/index.md +++ b/windows/whats-new/index.md @@ -1,6 +1,6 @@ --- title: What's new in Windows 10 (Windows 10) -description: Learn about new features in Windows 10 for IT professionals, such as Enterprise Data Protection, Windows Hello, Device Guard, and more. +description: Learn about new features in Windows 10 for IT professionals, such as Windows Information Protection, Windows Hello, Device Guard, and more. ms.assetid: F1867017-76A1-4761-A200-7450B96AEF44 keywords: ["What's new in Windows 10", "Windows 10", "anniversary update", "contribute", "edit topic"] ms.prod: w10 @@ -20,7 +20,7 @@ Windows 10 provides IT professionals with advanced protection against modern sec - [What's new in Windows 10, versions 1507 and 1511](whats-new-windows-10-version-1507-and-1511.md) -- [Edit an existing topic using the Contribute link](contribute-to-a-topic.md) +- [Edit an existing topic using the Edit link](contribute-to-a-topic.md) ## Learn more - - +
-
-
+
-
3