diff --git a/windows/client-management/mdm/dmacc-csp.md b/windows/client-management/mdm/dmacc-csp.md index aa91c7caf5..4871449a95 100644 --- a/windows/client-management/mdm/dmacc-csp.md +++ b/windows/client-management/mdm/dmacc-csp.md @@ -1,317 +1,1597 @@ --- title: DMAcc CSP -description: Learn how the DMAcc configuration service provider (CSP) allows an OMA Device Management (DM) version 1.2 server to handle OMA DM account objects. -ms.reviewer: +description: Learn more about the DMAcc CSP. +author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.topic: article +ms.date: 02/21/2023 +ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage -author: vinaypamnani-msft -ms.date: 06/26/2017 +ms.topic: reference --- + + + # DMAcc CSP -The table below shows the applicability of Windows: + + +The DMAcc configuration service provider allows an OMA Device Management (DM) version 1.2 server to handle OMA DM account objects. The server can use this configuration service provider to add a new account or to manage an existing account, including an account that was bootstrapped by using the [w7 APPLICATION](w7-application-csp.md) configuration service provider. -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - -The DMAcc configuration service provider allows an OMA Device Management (DM) version 1.2 server to handle OMA DM account objects. The server can use this configuration service provider to add a new account or to manage an existing account, including an account that was bootstrapped by using the [w7 APPLICATION configuration service provider](w7-application-csp.md) - -> [!Note] +> [!NOTE] >This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION and ID\_CAP\_DEVICE\_MANAGEMENT\_ADMIN capabilities to be accessed from a network configuration application. For the DMAcc CSP, you can't use the Replace command unless the node already exists. + -The following shows the DMAcc configuration service provider management object in tree format as used by OMA Device Management version 1.2. The OMA Client Provisioning protocol isn't supported by this configuration service provider. + +The following example shows the DMAcc configuration service provider in tree format. +```text +./SyncML/DMAcc +--- {AccountUID} +------ AAuthPref +------ AppAddr +--------- {ObjectName} +------------ Addr +------------ AddrType +------------ Port +--------------- {ObjectName} +------------------ PortNbr +------ AppAuth +--------- {ObjectName} +------------ AAuthData +------------ AAuthLevel +------------ AAuthName +------------ AAuthSecret +------------ AAuthType +------ AppID +------ Ext +--------- Microsoft +------------ BackCompatRetryDisabled +------------ ConnRetryFreq +------------ CRLCheck +------------ DefaultEncoding +------------ DisableOnRoaming +------------ InitialBackOffTime +------------ InitiateSession +------------ MaxBackOffTime +------------ ProtoVer +------------ Role +------------ SSLCLIENTCERTSEARCHCRITERIA +------------ UseHwDevID +------------ UseNonceResync +------ Name +------ PrefConRef +------ ServerID ``` -./SyncML -DMAcc -----* ---------AppID ---------ServerID ---------Name ---------PrefConRef ---------AppAddr -------------* -----------------Addr -----------------AddrType -----------------Port ---------------------* -------------------------PortNbr ---------AAuthPref ---------AppAuth -------------* -----------------AAuthLevel -----------------AAuthType -----------------AAuthName -----------------AAuthSecret -----------------AAuthData ---------Ext -------------Microsoft -----------------Role -----------------ProtoVer -----------------DefaultEncoding -----------------UseHwDevID -----------------ConnRetryFreq -----------------InitialBackOffTime -----------------MaxBackOffTime -----------------BackCompatRetryDisabled -----------------UseNonceResync -----------------CRLCheck -----------------DisableOnRoaming -----------------SSLCLIENTCERTSEARCHCRITERIA + + + +## {AccountUID} + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./SyncML/DMAcc/{AccountUID} ``` -**DMAcc** -Required. Defines the root node of all OMA DM server accounts that use the OMA DM version 1.2 protocol. + -***AccountUID*** -Optional. Defines the unique identifier for an OMA DM server account that uses the OMA DM version 1.2 protocol. + + +This interior node acts as a placeholder for zero or more OMA DM server accounts. If this OMA DM server account is bootstrapped using the [w7 APPLICATION](w7-application-csp.md), the name of this +node is generated from the 256-bit version of SHA-2 hash of the w7 PROVIDER-ID parm. + -For a [w7 APPLICATION configuration service provider](w7-application-csp.md) bootstrapped account, this element is assigned a unique name by the OMA DM Client. The unique name is the hexadecimal representation of the 256-bit SHA-2 hash of the provider ID. The OMA DM server can change this node name in subsequent OMA DM sessions. + + + -***AccountUID*/AppID** -Required. Specifies the application identifier for the OMA DM account. + +**Description framework properties**: -This value must be set to "w7". +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Add, Delete, Get, Replace | +| Dynamic Node Naming | ClientInventory | + -Value type is string. Supported operations are Add, Get, and Replace. + + + -***AccountUID*/ServerID** -Required. Specifies the OMA DM server's unique identifier for the current OMA DM account. This value is case-sensitive. + -Value type is string. Supported operations are Add, Get, and Replace. + +### {AccountUID}/AAuthPref -***AccountUID*/Name** -Optional. Specifies the display name of the application. + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + -Value type is string. Supported operations are Add, Get, and Replace. + +```Device +./SyncML/DMAcc/{AccountUID}/AAuthPref +``` + -***AccountUID*/PrefConRef** -Optional. Specifies the preferred connectivity for the OMA DM account. + + +Specifies the application authentication preference. Supported values: BASIC, DIGEST. If this value is empty, the client attempts to use the authentication mechanism negotiated in the previous session if one exists. If the value is empty, no previous session exists, and MD5 credentials exist, clients try MD5 authorization first. If the criteria are not met then the client tries BASIC authorization first. + -This element contains either a URI to a NAP management object or a connection GUID used by Connection Manager. If this element is missing, the device uses the default connection that is provided by Connection Manager. + + + -Value type is string. Supported operations are Add, Get, and Replace. + +**Description framework properties**: -***AccountUID*/AppAddr** +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Get, Replace | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| BASIC | The client attempts BASIC authentication. | +| DIGEST | The client attempts MD5 authentication. | + + + + + + + + + +### {AccountUID}/AppAddr + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./SyncML/DMAcc/{AccountUID}/AppAddr +``` + + + + Interior node for DM server address. + -Required. + + + -**AppAddr/***ObjectName* -Required. Defines the OMA DM server address. Only one server address can be configured. + +**Description framework properties**: -When the [w7 APPLICATION configuration service provider](w7-application-csp.md) is being mapped to the DMAcc Configuration Service Provider, the name of this element is "1". This DM address is the first one encountered in the w7 APPLICATION configuration service provider; other DM accounts are ignored. +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Add, Get | + -***ObjectName*/Addr** -Required. Specifies the address of the OMA DM account. The type of address stored is specified by the AddrType element. + + + -Value type is string. Supported operations are Add, Get, and Replace. + -***ObjectName*/AddrType** -Required. Specifies the format and interpretation of the Addr node value. The default is "URI". + +#### {AccountUID}/AppAddr/{ObjectName} -The default value of "URI" specifies that the OMA DM account address in **Addr** is a URI address. A value of "IPv4" specifies that the OMA DM account address in **Addr** is an IP address. + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + -Value type is string. Supported operations are Add, Get, and Replace. + +```Device +./SyncML/DMAcc/{AccountUID}/AppAddr/{ObjectName} +``` + -***ObjectName*/Port** + + +Defines the OMA DM server address. Only one server address can be configured. When mapping the [w7 APPLICATION](w7-application-csp.md) configuration service provider to the DMAcc Configuration Service Provider, the name of this element is "1". This is the first DM address encountered in the [w7 APPLICATION](w7-application-csp.md) configuration service provider, other DM accounts are ignored. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Add, Get | +| Dynamic Node Naming | ClientInventory | + + + + + + + + + +##### {AccountUID}/AppAddr/{ObjectName}/Addr + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./SyncML/DMAcc/{AccountUID}/AppAddr/{ObjectName}/Addr +``` + + + + +Specifies the address of the OMA DM account. The type of address stored is specified by the AddrType element. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Get, Replace | + + + + + + + + + +##### {AccountUID}/AppAddr/{ObjectName}/AddrType + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./SyncML/DMAcc/{AccountUID}/AppAddr/{ObjectName}/AddrType +``` + + + + +Specifies the format and interpretation of the Addr node value. The default is "URI". The default value of "URI" specifies that the OMA DM account address in Addr is a URI address. A value of "IPv4" specifies that the OMA DM account address in Addr is an IP address. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Get, Replace | +| Default Value | URI | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| URI (Default) | The OMA DM account address in Addr is a URI address. | +| IPv4 | The OMA DM account address in Addr is an IP address. | + + + + + + + + + +##### {AccountUID}/AppAddr/{ObjectName}/Port + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./SyncML/DMAcc/{AccountUID}/AppAddr/{ObjectName}/Port +``` + + + + Interior node for port information. + -Optional. + + + -**Port/***ObjectName* -Required. Only one port number can be configured. + +**Description framework properties**: -When the [w7 APPLICATION configuration service provider](w7-application-csp.md) is being mapped to the DMAcc Configuration Service Provider, the name of this element is "1". +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Add, Get | + -***ObjectName*/PortNbr** -Required. Specifies the port number of the OMA MD account address. This number must be a decimal number that fits within the range of a 16-bit unsigned integer. + + + -Value type is string. Supported operations are Add, Get, and Replace. + -***AccountUID*/AAuthPref** -Optional. Specifies the application authentication preference. + +###### {AccountUID}/AppAddr/{ObjectName}/Port/{ObjectName} -A value of "BASIC" specifies that the client attempts BASIC authentication. A value of "DIGEST' specifies that the client attempts MD5 authentication. + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + -If this value is empty, the client attempts to use the authentication mechanism negotiated in the previous session if one exists. If the value is empty, no previous session exists, and MD5 credentials exist, clients try MD5 authorization first. If the criteria aren't met, then the client tries BASIC authorization first. + +```Device +./SyncML/DMAcc/{AccountUID}/AppAddr/{ObjectName}/Port/{ObjectName} +``` + -Value type is string. Supported operations are Add, Get, and Replace. + + +Only one port number can be configured. When mapping the [w7 APPLICATION](w7-application-csp.md) configuration service provider to the DMAcc Configuration Service Provider, the name of this element is "1". + -***AccountUID*/AppAuth** -Optional. Defines authentication settings. + + + -**AppAuth/***ObjectName* -Required. Defines one set of authentication settings. + +**Description framework properties**: -When the [w7 APPLICATION configuration service provider](w7-application-csp.md) is being mapped to the DMAcc Configuration Service Provider, the name of this element is same name as the AAuthLevel value ("CLRED" or "SRVCRED"). +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Add, Get, Replace | +| Dynamic Node Naming | ClientInventory | + -***ObjectName*/AAuthlevel** -Required. Specifies the application authentication level. + + + -A value of "CLCRED" indicates that the credentials client will authenticate itself to the OMA DM server at the OMA DM protocol level. A value of "SRVCRED" indicates that the credentials server will authenticate itself to the OMA DM Client at the OMA DM protocol level. + -Value type is string. Supported operations are Add and Replace. + +###### {AccountUID}/AppAddr/{ObjectName}/Port/{ObjectName}/PortNbr -***ObjectName*/AAuthType** -Required. Specifies the authentication type. + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + -If the AAuthlevel is "CLCRED", the supported values are "BASIC" and "DIGEST". If the AAuthlevel is "SRVCRED", the supported value is "DIGEST". + +```Device +./SyncML/DMAcc/{AccountUID}/AppAddr/{ObjectName}/Port/{ObjectName}/PortNbr +``` + -Value type is string. Supported operations are Add, Get, and Replace. + + +Specifies the port number of the OMA MD account address. This must be a decimal number that fits within the range of a 16-bit unsigned integer. + -***ObjectName*/AAuthName** -Optional. Specifies the authentication name. + + + -Value type is string. Supported operations are Add, Get, and Replace. + +**Description framework properties**: -***ObjectName*/AAuthSecret** -Optional. Specifies the password or secret used for authentication. +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Get, Replace | + -Value type is string. Supported operations are Add and Replace. + + + -***ObjectName*/AAuthData** -Optional. Specifies the next nonce used for authentication. + -"Nonce" refers to a number used once. It's often a random or pseudo-random number issued in an authentication protocol to ensure that old communications can't be reused in repeat attacks. + +### {AccountUID}/AppAuth -Value type is binary. Supported operations are Add and Replace. + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + -***AccountUID*/Ext** -Required. Defines a set of extended parameters. + +```Device +./SyncML/DMAcc/{AccountUID}/AppAuth +``` + -This element holds vendor-specific information about the OMA DM account and is created automatically when the OMA DM account is created. + + +Defines authentication settings. + -**Ext/Microsoft** -Required. Defines a set of Microsoft-specific extended parameters. + + + -This element is created automatically when the OMA DM account is created. + +**Description framework properties**: -**Microsoft/BackCompatRetryDisabled** -Optional. Specifies whether to retry resending a package with an older protocol version (for example, 1.1) in the SyncHdr on subsequent attempts (not including the first time). The default is "FALSE". +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Add, Get | + -The default value of "FALSE" indicates that backward-compatible retries are enabled. A value of "TRUE" indicates that backward-compatible retries are disabled. + + + -Value type is bool. Supported operations are Add, Get, and Replace. + -**Microsoft/ConnRetryFreq** -Optional. Specifies the number of retries the DM client performs when there are Connection Manager level or wininet level errors. + +#### {AccountUID}/AppAuth/{ObjectName} -The default value is 3. + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + -Value type is integer. Supported operations are Add, Get, and Replace. + +```Device +./SyncML/DMAcc/{AccountUID}/AppAuth/{ObjectName} +``` + -**Microsoft/DefaultEncoding** -Optional. Specifies whether the OMA DM client will use WBXML or XML for the DM package when communicating with the server. The default is "application/vnd.syncml.dm+xml". + + +Defines one set of authentication settings. When mapping the [w7 APPLICATION](w7-application-csp.md) configuration service provider to the DMAcc Configuration Service Provider, the name of this element is same name as the AAuthLevel value ("CLRED" or "SRVCRED"). + -The default value of "application/vnd.syncml.dm+xml" specifies that XML is used. A value of "application/vnd.syncml.dm+wbxml" specifies that WBXML is used. + + + -Value type is string. Supported operations are Add, Get, and Replace. + +**Description framework properties**: -**Microsoft/InitialBackOffTime** -Optional. Specifies the initial wait time in milliseconds when the OMA DM client retries for the first time. The wait time grows exponentially. +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Add, Get | +| Dynamic Node Naming | ClientInventory | + -The default value is 16000. + + + -Value type is integer. Supported operations are Add, Get, and Replace. + -**Microsoft/MaxBackOffTime** -Optional. This node specifies the maximum number of milliseconds to wait before attempting a connection retry. + +##### {AccountUID}/AppAuth/{ObjectName}/AAuthData -The default value is 86400000. + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + -Value type is integer. Supported operations are Add, Get, and Replace. + +```Device +./SyncML/DMAcc/{AccountUID}/AppAuth/{ObjectName}/AAuthData +``` + -**Microsoft/ProtoVer** -Optional. Specifies the OMA DM Protocol version that the server supports. There's no default value. + + +Specifies the next nonce used for authentication. "Nonce" refers to a number used once. It is often a random or pseudo-random number issued in an authentication protocol to ensure that old communications cannot be reused in repeat attacks. + -Valid values are "1.1" and "1.2". The protocol version set by this element will match the protocol version that the DM client reports to the server in SyncHdr in package 1. If this element isn't specified when adding a DM server account, the latest DM protocol version that the client supports is used. Windows 10 clients support version 1.2. + + + -Value type is string. Supported operations are Add, Get, and Replace. + +**Description framework properties**: -**Microsoft/Role** -Required. Specifies the role mask that the OMA DM session runs with when it communicates with the server. +| Property name | Property value | +|:--|:--| +| Format | bin | +| Access Type | Add, Replace | + -If this parameter isn't present, the DM session is given the role mask of the OMA DM session that the server created. The following list shows the valid security role masks and their values. + + + -- 4 = SECROLE\_OPERATO -- 8 = SECROLE\_MANAGE -- 16 = SECROLE\_USER\_AUT -- 128 = SECROLE\_OPERATOR\_TPS + + +##### {AccountUID}/AppAuth/{ObjectName}/AAuthLevel + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./SyncML/DMAcc/{AccountUID}/AppAuth/{ObjectName}/AAuthLevel +``` + + + + +Specifies the application authentication level. A value of "CLCRED" indicates that the credentials client will authenticate itself to the OMA DM server at the OMA DM protocol level. A value of "SRVCRED" indicates that the credentials server will authenticate itself to the OMA DM Client at the OMA DM protocol level. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Get, Replace | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| CLCRED | The credentials client will authenticate itself to the OMA DM server at the OMA DM protocol level. | +| SRVCRED | The credentials server will authenticate itself to the OMA DM Client at the OMA DM protocol level. | + + + + + + + + + +##### {AccountUID}/AppAuth/{ObjectName}/AAuthName + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./SyncML/DMAcc/{AccountUID}/AppAuth/{ObjectName}/AAuthName +``` + + + + +Specifies the authentication name. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Get, Replace | + + + + + + + + + +##### {AccountUID}/AppAuth/{ObjectName}/AAuthSecret + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./SyncML/DMAcc/{AccountUID}/AppAuth/{ObjectName}/AAuthSecret +``` + + + + +Specifies the password or secret used for authentication. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Replace | + + + + + + + + + +##### {AccountUID}/AppAuth/{ObjectName}/AAuthType + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./SyncML/DMAcc/{AccountUID}/AppAuth/{ObjectName}/AAuthType +``` + + + + +Specifies the authentication type. If AAuthLevel is CLCRED, the supported types include BASIC and DIGEST. If AAuthLevel is SRVCRED, the only supported type is DIGEST. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Get, Replace | +| Dependency [AAuthlevelDependency] | Dependency Type: `DependsOn`
Dependency URI: `Vendor/MSFT/DMAcc/[AccountUID]/AppAuth/[ObjectName]/AAuthLevel`
Dependency Allowed Value: ``
Dependency Allowed Value Type: `ENUM`
| + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| BASIC | BASIC. | +| DIGEST | DIGEST. | + + + + + + + + + +### {AccountUID}/AppID + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./SyncML/DMAcc/{AccountUID}/AppID +``` + + + + +Specifies the application identifier for the OMA DM account.. The only supported value is w7. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Get, Replace | +| Default Value | w7 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| w7 (Default) | The only supported value. | + + + + + + + + + +### {AccountUID}/Ext + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./SyncML/DMAcc/{AccountUID}/Ext +``` + + + + +Defines a set of extended parameters. This element holds vendor-specific information about the OMA DM account and is created automatically when the OMA DM account is created. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Get | + + + + + + + + + +#### {AccountUID}/Ext/Microsoft + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./SyncML/DMAcc/{AccountUID}/Ext/Microsoft +``` + + + + +Defines a set of Microsoft-specific extended parameters. This element is created automatically when the OMA DM account is created. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Get | + + + + + + + + + +##### {AccountUID}/Ext/Microsoft/BackCompatRetryDisabled + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./SyncML/DMAcc/{AccountUID}/Ext/Microsoft/BackCompatRetryDisabled +``` + + + + +This node specifies whether to disable the ability of the DM client to communicate with a down-level server. +Possible Values: +false (default) -- Compatibility with down-level servers is enabled +true -- Compatibility with down-level servers is disabled. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | bool | +| Access Type | Add, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Backward-compatible retries are enabled. | +| 1 | Backward-compatible retries are disabled. | + + + + + + + + + +##### {AccountUID}/Ext/Microsoft/ConnRetryFreq + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./SyncML/DMAcc/{AccountUID}/Ext/Microsoft/ConnRetryFreq +``` + + + + +This node specifies how many times DM client will retry a connection to the server if the connection fails. The default value is 3 retries. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Get, Replace | +| Default Value | 3 | + + + + + + + + + +##### {AccountUID}/Ext/Microsoft/CRLCheck + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./SyncML/DMAcc/{AccountUID}/Ext/Microsoft/CRLCheck +``` + + + + +Allows connection to the DM server to check the Certificate Revocation List (CRL). Set to true to enable SSL revocation. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | bool | +| Access Type | Add, Get, Replace | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | False. | +| 1 | True. | + + + + + + + + + +##### {AccountUID}/Ext/Microsoft/DefaultEncoding + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./SyncML/DMAcc/{AccountUID}/Ext/Microsoft/DefaultEncoding +``` + + + + +This node specifies the encoding that the OMA-DM client will use to encode its first package. Valid values include "application/vnd.syncml.dm+xml" (for XML) and +"application/vnd.syncml.dm+wbxml" (for WBXML). If this node is left unspecified, the OMA-DM client defaults to "application/vnd.syncml.dm+xml". + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Get, Replace | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| application/vnd.syncml.dm+xml | XML is used. | +| application/vnd.syncml.dm+wbxml | WBXML is used. | + + + + + + + + + +##### {AccountUID}/Ext/Microsoft/DisableOnRoaming + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./SyncML/DMAcc/{AccountUID}/Ext/Microsoft/DisableOnRoaming +``` + + + + +Determines whether the OMA DM client should be launched when roaming. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | bool | +| Access Type | Add, Get, Replace | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | False. | +| 1 | True. | + + + + + + + + + +##### {AccountUID}/Ext/Microsoft/InitialBackOffTime + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./SyncML/DMAcc/{AccountUID}/Ext/Microsoft/InitialBackOffTime +``` + + + + +This node specifies the initial amount of time (in milliseconds) that the DM client waits before attempting a connection retry. After the initial wait, the wait +time grows exponentially. The default value is 16000 milliseconds. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Get, Replace | +| Default Value | 16000 | + + + + + + + + + +##### {AccountUID}/Ext/Microsoft/InitiateSession + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1703 [10.0.15063] and later | + + + +```Device +./SyncML/DMAcc/{AccountUID}/Ext/Microsoft/InitiateSession +``` + + + + +When this node is added, a session is started with the MDM server. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | null | +| Access Type | Add, Replace | + + + + + + + + + +##### {AccountUID}/Ext/Microsoft/MaxBackOffTime + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./SyncML/DMAcc/{AccountUID}/Ext/Microsoft/MaxBackOffTime +``` + + + + +This node specifies the maximum number of milliseconds to wait before attempting a connection retry. The default value is 86400000. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Get, Replace | +| Default Value | 86400000 | + + + + + + + + + +##### {AccountUID}/Ext/Microsoft/ProtoVer + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./SyncML/DMAcc/{AccountUID}/Ext/Microsoft/ProtoVer +``` + + + + +This node value corresponds to what the client would put in the VerDTD element of an OMA-DM package. No default value is assumed. The only valid value for this +node is 1.1 or 1.2. + + + + +The protocol version set by this element will match the protocol version that the DM client reports to the server in SyncHdr in package 1. If this element isn't specified when adding a DM server account, the latest DM protocol version that the client supports is used. + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Get, Replace | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 1.1 | 1.1. | +| 1.2 | 1.2. | + + + + + + + + + +##### {AccountUID}/Ext/Microsoft/Role + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./SyncML/DMAcc/{AccountUID}/Ext/Microsoft/Role +``` + + + + +If this node is unspecified, its default value is the access role of the session that created the server account. The value for this node must be a subset of the +roles used in creating this server account. + + + + The acceptable access roles for this node can't be more than the roles assigned to the DMAcc object. + -Value type is integer. Supported operations are Get and Replace. + +**Description framework properties**: -**Microsoft/UseHWDevID** -Optional. Specifies whether to use the hardware ID for the ./DevInfo/DevID element in the DM account to identify the device. The default is "FALSE". +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Get, Replace | + -The default value of "FALSE" specifies that an application-specific GUID is returned for the ./DevInfo/DevID rather than the hardware device ID. + +**Allowed values**: -A value is "TRUE" specifies that the hardware device ID will be provided for the ./DevInfo/DevID element and the Source LocURI for the OMA DM package that is sent to the server. In this case: +| Flag | Description | +|:--|:--| +| 4 | SECROLE_OPERATOR. | +| 8 | SECROLE_MANAGER. | +| 16 | SECROLE_USER_AUTH. | +| 128 | SECROLE_OPERATOR_TPS. | + -- For GSM phones, the IMEI is returned. -- For CDMA phones, the MEID is returned. -- For dual SIM phones, this value is retrieved from the UICC of the primary data line. + + + -Value type is bool. Supported operations are Add, Get, and Replace. + -**Microsoft/UseNonceResync** -Optional. Specifies whether the OMA DM client should use the nonce resynchronization procedure if the server trigger notification fails authentication. The default is "FALSE". + +##### {AccountUID}/Ext/Microsoft/SSLCLIENTCERTSEARCHCRITERIA -If the authentication fails because the server nonce doesn't match the server nonce that is stored on the device, then the device can use the backup nonce as the server nonce. For this procedure to be successful, if the device didn't authenticate with the preconfigured nonce value, the server must then use the backup nonce when sending the signed server notification message. + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + -The default value of "FALSE" specifies that the client doesn't try to authenticate the notification with the backup server nonce if authentication to the stored nonce fails. A value of "TRUE" specifies that the client initiates a DM session if the backup server nonce is received after authentication failed. + +```Device +./SyncML/DMAcc/{AccountUID}/Ext/Microsoft/SSLCLIENTCERTSEARCHCRITERIA +``` + -Value type is bool. Supported operations are Add, Get, and Replace. - -**CRLCheck** -Optional. Allows connection to the DM server to check the Certificate Revocation List (CRL). Set to true to enable SSL revocation. - -Value type is bool. Supported operations are Add, Get, and Replace. - -**DisableOnRoaming** -Optional. Determines whether the OMA DM client should be launched when roaming. - -Value type is bool. Supported operations are Add, Get, and Replace. - -**SSLCLIENTCERTSEARCHCRITERIA** -Optional. The SSLCLIENTCERTSEARCHCRITERIA parameter is used to specify the client certificate search criteria. This parameter supports search by subject attribute and certificate stores. If any other criteria are provided, it's ignored. - -The string is a concatenation of name/value pairs, each member of the pair delimited by the "&" character. The name and values are delimited by the "=" character. If there are multiple values, each value is delimited by the Unicode character "U+F000". If the name or value contains characters not in the UNRESERVED set (as specified in RFC2396), then those characters are URI-escaped per the RFC. - -The supported names are Subject and Stores; wildcard certificate search isn't supported. - -Stores specifies which certificate stores the DM client will search to find the SSL client certificate. The valid store value is My%5CUser. The store name isn't case sensitive. - -> [!Note] -> %EF%80%80 is the UTF8-encoded character U+F000. - -Subject specifies the certificate to search for. For example, to specify that you want a certificate with a particular Subject attribute (“CN=Tester,O=Microsoft”), use the following schema: + + +The SSLCLIENTCERTSEARCHCRITERIA parameter is used to specify the client certificate search criteria. This parameter supports search by subject attribute and certificate stores. If any other criteria are provided, it is ignored. The string is a concatenation of name/value pairs, each member of the pair delimited by the "&" character. The name and values are delimited by the "=" character. If there are multiple values, each value is delimited by the Unicode character "U+F000". If the name or value contains characters not in the UNRESERVED set (as specified in RFC2396), then those characters are URI-escaped per the RFC. The supported names are Subject and Stores; wildcard certificate search is not supported. Stores specifies which certificate stores the DM client will search to find the SSL client certificate. The valid store value is My%5CUser. The store name is not case sensitive. Subject specifies the certificate to search for. For example, to specify that you want a certificate with a particular Subject attribute ("CN=Tester,O=Microsoft"), use the following: + + + ```xml + value="Subject=CN%3DTester,O%3DMicrosoft&Stores=My%5CUser" /> ``` + -Value type is string. Supported operations are Add, Get, and Replace. + +**Description framework properties**: -**InitiateSession** -Optional. When this node is added, a session is started with the MDM server. +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Get, Replace | + -Supported operations are Add, and Replace. + + + -## Related topics + -[Configuration service provider reference](index.yml) + +##### {AccountUID}/Ext/Microsoft/UseHwDevID + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./SyncML/DMAcc/{AccountUID}/Ext/Microsoft/UseHwDevID +``` + + + + +A value of true indicates that, during an OMA-DM session with this server, the value of the ./DevInfo/DevId node is the hardware ID of device (e.g, IMEI for a +GSM device, ESN for a CDMA Device, hashed UUID for a non-radio device). The default value of false indicates that the value of ./DevInfo/DevId node is a hash of +the UUID of the device. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | bool | +| Access Type | Add, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | An application-specific GUID is returned for the ./DevInfo/DevID rather than the hardware device ID. | +| 1 | The hardware device ID will be provided for the ./DevInfo/DevID element and the Source LocURI for the OMA DM package that is sent to the server. | + + + + + + + + + +##### {AccountUID}/Ext/Microsoft/UseNonceResync + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./SyncML/DMAcc/{AccountUID}/Ext/Microsoft/UseNonceResync +``` + + + + +This node specifies whether the DM client can use the nonce resynchronization protocol when authentication of a server notification fails. If nonce +resynchronization is disabled and authentication of the server notification fails, the notification is dropped. +Possible Values: +false (default) : Nonce resynchronization is disabled. +true : Nonce resynchronization is enabled. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | bool | +| Access Type | Add, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | The client does not try to authenticate the notification with the backup server nonce if authentication to the stored nonce fails. | +| 1 | The client initiates a DM session if the backup server nonce is received after authentication failed. | + + + + + + + + + +### {AccountUID}/Name + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./SyncML/DMAcc/{AccountUID}/Name +``` + + + + +Specifies the display name of the application. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Get, Replace | + + + + + + + + + +### {AccountUID}/PrefConRef + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./SyncML/DMAcc/{AccountUID}/PrefConRef +``` + + + + +The only supported values include the NAPID of a bootstrapped NAP management object or a connection GUID used by connection manager. If this node is missing, the device +will use the default connection provided by connection manager. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Get, Replace | + + + + + + + + + +### {AccountUID}/ServerID + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./SyncML/DMAcc/{AccountUID}/ServerID +``` + + + + +Specifies the OMA DM server's unique identifier for the current OMA DM account. This value is case-sensitive. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Get, Replace | + + + + + + + + + + + + + + +## Related articles + +[Configuration service provider reference](configuration-service-provider-reference.md) diff --git a/windows/client-management/mdm/dmacc-ddf-file.md b/windows/client-management/mdm/dmacc-ddf-file.md index f2d4b6a20f..57bfdbcc89 100644 --- a/windows/client-management/mdm/dmacc-ddf-file.md +++ b/windows/client-management/mdm/dmacc-ddf-file.md @@ -1,875 +1,1094 @@ --- title: DMAcc DDF file -description: Learn about the OMA DM device description framework (DDF) for the DMAcc configuration service provider (CSP). -ms.reviewer: +description: View the XML file containing the device description framework (DDF) for the DMAcc configuration service provider. +author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.topic: article +ms.date: 02/21/2023 +ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage -author: vinaypamnani-msft -ms.date: 12/05/2017 +ms.topic: reference --- + + # DMAcc DDF file -This topic shows the OMA DM device description framework (DDF) for the **DMAcc** configuration service provider. DDF files are used only with OMA DM provisioning XML. - -Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-ddf.md). - -The XML below is the current version for this CSP. +The following XML file contains the device description framework (DDF) for the DMAcc configuration service provider. ```xml -]> +]> - 1.2 + 1.2 + + + + DMAcc + ./SyncML + + + + + This interior node is a common parent to all OMA DM server account nodes that use OMA DM 1.2 protocol. + + + + + + + + + + + + + + 10.0.10586 + 1.0 + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBF;0xCA;0xCB;0xCD; + + - DMAcc - ./SyncML + + + + + + + + + + This interior node acts as a placeholder for zero or more OMA DM server accounts. If this OMA DM server account is bootstrapped using the w7 APPLICATION, the name of this node is generated from the 256-bit version of SHA-2 hash of the w7 PROVIDER-ID parm. + + + + + + + + + + AccountUID + + + + + + + + + AppID - - - - This interior node is a common parent to all OMA DM server account nodes that use OMA DM 1.2 protocol. - - - - - - - - - - - urn:oma:mo:oma-dm-dmacc:1.1 - + + + + + + w7 + Specifies the application identifier for the OMA DM account.. The only supported value is w7. + + + + + + + + + + Application ID for DM Account MO + + + + + + w7 + The only supported value. + + + + + + ServerID + + + + + + + Specifies the OMA DM server's unique identifier for the current OMA DM account. This value is case-sensitive. + + + + + + + + + + Server Identifier + + + + + + + + + Name + + + + + + + Specifies the display name of the application. + + + + + + + + + + Displayable name for the Management Server + + + + + + + + + PrefConRef + + + + + + + The only supported values include the NAPID of a bootstrapped NAP management object or a connection GUID used by connection manager. If this node is missing, the device will use the default connection provided by connection manager. + + + + + + + + + + Reference to preferred connectivity + + + + + + + + + AppAddr + + + + + + Interior node for DM server address. + + + + + + + + + + A collection of references to DM server address + + + - * + + + + + + + + Defines the OMA DM server address. Only one server address can be configured. When mapping the w7 APPLICATION configuration service provider to the DMAcc Configuration Service Provider, the name of this element is "1". This is the first DM address encountered in the w7 APPLICATION configuration service provider, other DM accounts are ignored. + + + + + + + + + + ObjectName + + + + + + + + + Addr - - - - - - - This interior node acts as a placeholder for zero or more OMA DM server accounts. If this OMA DM server account is bootstrapped using the w7 APPLICATION, the name of this node is generated from the 256-bit version of SHA-2 hash of the w7 PROVIDER-ID parm. - - - - - - - - - - - - + + + + + + Specifies the address of the OMA DM account. The type of address stored is specified by the AddrType element. + + + + + + + + + + Management Server Address + + + + + + + + + AddrType + + + + + + + URI + Specifies the format and interpretation of the Addr node value. The default is "URI". The default value of "URI" specifies that the OMA DM account address in Addr is a URI address. A value of "IPv4" specifies that the OMA DM account address in Addr is an IP address. + + + + + + + + + + Management Server Address Type + + + + + + URI + The OMA DM account address in Addr is a URI address. + + + IPv4 + The OMA DM account address in Addr is an IP address. + + + + + + Port + + + + + + Interior node for port information. + + + + + + + + + + A collection of all Port objects + + + - AppID + + + + + + + + + Only one port number can be configured. When mapping the w7 APPLICATION configuration service provider to the DMAcc Configuration Service Provider, the name of this element is "1". + + + + + + + + + + ObjectName + + + + + + + + + PortNbr - - - - - - The only supported value is w7. - - - - - - - - - - Application ID for DM Account MO - - text/plain - + + + + + + Specifies the port number of the OMA MD account address. This must be a decimal number that fits within the range of a 16-bit unsigned integer. + + + + + + + + + + Port + + + + + + - - ServerID - - - - - - - - - - - - - - - - Server Identifier - - text/plain - - - - - Name - - - - - - - - - - - - - - - - Displayable name for the Management Server - - text/plain - - - - - PrefConRef - - - - - - - The only supported values include the NAPID of a bootstrapped NAP management object or a connection GUID used by connection manager. If this node is missing, the device will use the default connection provided by connection manager. - - - - - - - - - - Reference to preferred connectivity - - text/plain - - - - - AppAddr - - - - - - Only the first address provisioned is used. - - - - - - - - - - A collection of references to DM server address - - - - - - * - - - - - - - - - - - - - - - The "name" node for AppAddr object - - - - - - Addr - - - - - - - - - - - - - - - - Management Server Address - - text/plain - - - - - AddrType - - - - - - - - - - - - - - - - Management Server Address Type - - text/plain - - - - - Port - - - - - - - - - - - - - - - A collection of all Port objects - - - - - - * - - - - - - - - - - - - - - - - The "name" node for a Port object - - - - - - PortNbr - - - - - - - - - - - - - - - - Port - - text/plain - - - - - - - - - AAuthPref - - - - - - - Supported values: BASIC, DIGEST - - - - - - - - - - Application Authentication Type preference - - text/plain - - - - - AppAuth - - - - - - - - - - - - - - - A collection of all references to multiple Application Authentication objects - - - - - - * - - - - - - - - - - - - - - - The "name" node for multiple Application Authentication objects - - - - - - AAuthLevel - - - - - - - - - - - - - - - - Application Authentication level - - text/plain - - - - - AAuthType - - - - - - - If AAuthLevel is CLCRED, the supported types include BASIC and DIGEST. If AAuthLevel is SRVCRED, the only supported type is DIGEST. - - - - - - - - - - Application Authentication Type - - text/plain - - - - - AAuthName - - - - - - - - - - - - - - - - Application Authentication Name - - text/plain - - - - - AAuthSecret - - - - - - - - - - - - - - - Application Authentication Secret - - text/plain - - - - - AAuthData - - - - - - - - - - - - - - - Application Authentication Data - - text/plain - - - - - - - Ext - - - - - - - - - - - - - - Vendor specific information - - - - - - Microsoft - - - - - - - - - - - - - - The collection of Microsoft specific settings - - - - - - Role - - - - - - If this node is unspecified, its default value is the access role of the session that created the server account. The value for this node must be a subset of the roles used in creating this server account. - - - - - - - - - - The security role mask that the DM session should run with - - text/plain - - - - - ProtoVer - - - - - - - This node value corresponds to what the client would put in the VerDTD element of an OMA-DM package. No default value is assumed. The only valid value for this node is 1.1 or 1.2. - - - - - - - - - - The OMA-DM protocol version that the client should use in communicating with the server - - text/plain - - - - - DefaultEncoding - - - - - - - This node specifies the encoding that the OMA-DM client will use to encode its first package. Valid values include "application/vnd.syncml.dm+xml" (for XML) and "application/vnd.syncml.dm+wbxml" (for WBXML). If this node is left unspecified, the OMA-DM client defaults to "application/vnd.syncml.dm+xml". - - - - - - - - - - - text/plain - - - - - UseHwDevID - - - - - - - A value of true indicates that, during an OMA-DM session with this server, the value of the ./DevInfo/DevId node is the hardware ID of device (e.g, IMEI for a GSM device, ESN for a CDMA Device, hashed UUID for a non-radio device). The default value of false indicates that the value of ./DevInfo/DevId node is a hash of the UUID of the device. - - - - - - - - - - - text/plain - - - - - ConnRetryFreq - - - - - - - This node specifies how many times DM client will retry a connection to the server if the connection fails. The default value is 3 retries. - - - - - - - - - - - text/plain - - - - - InitialBackOffTime - - - - - - - This node specifies the initial amount of time (in milliseconds) that the DM client waits before attempting a connection retry. After the initial wait, the wait time grows exponentially. The default value is 16000 milliseconds. - - - - - - - - - - - text/plain - - - - - MaxBackOffTime - - - - - - - This node specifies the maximum number of milliseconds to wait before attempting a connection retry. The default value is 86400000. - - - - - - - - - - - text/plain - - - - - BackCompatRetryDisabled - - - - - - - This node specifies whether to disable the ability of the DM client to communicate with a down-level server. + + + + + AAuthPref + + + + + + + Specifies the application authentication preference. Supported values: BASIC, DIGEST. If this value is empty, the client attempts to use the authentication mechanism negotiated in the previous session if one exists. If the value is empty, no previous session exists, and MD5 credentials exist, clients try MD5 authorization first. If the criteria are not met then the client tries BASIC authorization first. + + + + + + + + + + Application Authentication Type preference + + + + + + BASIC + The client attempts BASIC authentication. + + + DIGEST + The client attempts MD5 authentication. + + + + + + AppAuth + + + + + + Defines authentication settings. + + + + + + + + + + A collection of all references to multiple Application Authentication objects + + + + + + + + + + + + + Defines one set of authentication settings. When mapping the w7 APPLICATION configuration service provider to the DMAcc Configuration Service Provider, the name of this element is same name as the AAuthLevel value ("CLRED" or "SRVCRED"). + + + + + + + + + + ObjectName + + + + + + + + + + + AAuthLevel + + + + + + + Specifies the application authentication level. A value of "CLCRED" indicates that the credentials client will authenticate itself to the OMA DM server at the OMA DM protocol level. A value of "SRVCRED" indicates that the credentials server will authenticate itself to the OMA DM Client at the OMA DM protocol level. + + + + + + + + + + Application Authentication level + + + + + + CLCRED + The credentials client will authenticate itself to the OMA DM server at the OMA DM protocol level. + + + SRVCRED + The credentials server will authenticate itself to the OMA DM Client at the OMA DM protocol level. + + + + + + AAuthType + + + + + + + Specifies the authentication type. If AAuthLevel is CLCRED, the supported types include BASIC and DIGEST. If AAuthLevel is SRVCRED, the only supported type is DIGEST. + + + + + + + + + + Application Authentication Type + + + + + + BASIC + BASIC + + + DIGEST + DIGEST + + + + + + + DIGEST + DIGEST + + + + Vendor/MSFT/DMAcc/[AccountUID]/AppAuth/[ObjectName]/AAuthLevel + + + SRVCRED + SRVCRED + + + + + + + + + AAuthName + + + + + + + Specifies the authentication name. + + + + + + + + + + Application Authentication Name + + + + + + + + + AAuthSecret + + + + + + Specifies the password or secret used for authentication. + + + + + + + + + + Application Authentication Secret + + + + + + + + + AAuthData + + + + + + Specifies the next nonce used for authentication. "Nonce" refers to a number used once. It is often a random or pseudo-random number issued in an authentication protocol to ensure that old communications cannot be reused in repeat attacks. + + + + + + + + + + Application Authentication Data + + + + + + + + + + + Ext + + + + + Defines a set of extended parameters. This element holds vendor-specific information about the OMA DM account and is created automatically when the OMA DM account is created. + + + + + + + + + + Vendor specific information + + + + + + Microsoft + + + + + Defines a set of Microsoft-specific extended parameters. This element is created automatically when the OMA DM account is created. + + + + + + + + + + The collection of Microsoft specific settings + + + + + + Role + + + + + + If this node is unspecified, its default value is the access role of the session that created the server account. The value for this node must be a subset of the roles used in creating this server account. + + + + + + + + + + The security role mask that the DM session should run with + + + + + + 4 + SECROLE_OPERATOR + + + 8 + SECROLE_MANAGER + + + 16 + SECROLE_USER_AUTH + + + 128 + SECROLE_OPERATOR_TPS + + + + + + ProtoVer + + + + + + + This node value corresponds to what the client would put in the VerDTD element of an OMA-DM package. No default value is assumed. The only valid value for this node is 1.1 or 1.2. + + + + + + + + + + The OMA-DM protocol version that the client should use in communicating with the server + + + + + + 1.1 + 1.1 + + + 1.2 + 1.2 + + + + + + DefaultEncoding + + + + + + + This node specifies the encoding that the OMA-DM client will use to encode its first package. Valid values include "application/vnd.syncml.dm+xml" (for XML) and "application/vnd.syncml.dm+wbxml" (for WBXML). If this node is left unspecified, the OMA-DM client defaults to "application/vnd.syncml.dm+xml". + + + + + + + + + + + + + + + application/vnd.syncml.dm+xml + XML is used + + + application/vnd.syncml.dm+wbxml + WBXML is used + + + + + + UseHwDevID + + + + + + + 0 + A value of true indicates that, during an OMA-DM session with this server, the value of the ./DevInfo/DevId node is the hardware ID of device (e.g, IMEI for a GSM device, ESN for a CDMA Device, hashed UUID for a non-radio device). The default value of false indicates that the value of ./DevInfo/DevId node is a hash of the UUID of the device. + + + + + + + + + + + + + + + 0 + An application-specific GUID is returned for the ./DevInfo/DevID rather than the hardware device ID. + + + 1 + The hardware device ID will be provided for the ./DevInfo/DevID element and the Source LocURI for the OMA DM package that is sent to the server. + + + + + + ConnRetryFreq + + + + + + + 3 + This node specifies how many times DM client will retry a connection to the server if the connection fails. The default value is 3 retries. + + + + + + + + + + + + + + + + + + InitialBackOffTime + + + + + + + 16000 + This node specifies the initial amount of time (in milliseconds) that the DM client waits before attempting a connection retry. After the initial wait, the wait time grows exponentially. The default value is 16000 milliseconds. + + + + + + + + + + + + + + + + + + MaxBackOffTime + + + + + + + 86400000 + This node specifies the maximum number of milliseconds to wait before attempting a connection retry. The default value is 86400000. + + + + + + + + + + + + + + + + + + BackCompatRetryDisabled + + + + + + + 0 + This node specifies whether to disable the ability of the DM client to communicate with a down-level server. Possible Values: false (default) -- Compatibility with down-level servers is enabled true -- Compatibility with down-level servers is disabled - - - - - - - - - - - text/plain - - - - - UseNonceResync - - - - - - - This node specifies whether the DM client can use the nonce resynchronization protocol when authentication of a server notification fails. If nonce resynchronization is disabled and authentication of the server notification fails, the notification is dropped. + + + + + + + + + + + + + + + 0 + Backward-compatible retries are enabled. + + + 1 + Backward-compatible retries are disabled. + + + + + + UseNonceResync + + + + + + + 0 + This node specifies whether the DM client can use the nonce resynchronization protocol when authentication of a server notification fails. If nonce resynchronization is disabled and authentication of the server notification fails, the notification is dropped. Possible Values: false (default) : Nonce resynchronization is disabled. true : Nonce resynchronization is enabled. - - - - - - - - - - - text/plain - - - - - CRLCheck - - - - - - - - - - - - - - - - CRLCheck - - text/plain - - - - - DisableOnRoaming - - - - - - - - - - - - - - - - DisableOnRoaming - - text/plain - - - - - SSLCLIENTCERTSEARCHCRITERIA - - - - - - - - - - - - - - - - SSLCLIENTCERTSEARCHCRITERIA - - text/plain - - - - - InitiateSession - - - - - - When this node is added, a session is started with the MDM server. - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + 0 + The client does not try to authenticate the notification with the backup server nonce if authentication to the stored nonce fails. + + + 1 + The client initiates a DM session if the backup server nonce is received after authentication failed. + + + + + + CRLCheck + + + + + + + Allows connection to the DM server to check the Certificate Revocation List (CRL). Set to true to enable SSL revocation. + + + + + + + + + + CRLCheck + + + + + + 0 + False + + + 1 + True + + + + + + DisableOnRoaming + + + + + + + Determines whether the OMA DM client should be launched when roaming. + + + + + + + + + + DisableOnRoaming + + + + + + 0 + False + + + 1 + True + + + + + + SSLCLIENTCERTSEARCHCRITERIA + + + + + + + + + + + + + + + + + SSLCLIENTCERTSEARCHCRITERIA + + + + + + + + + InitiateSession + + + + + + When this node is added, a session is started with the MDM server. + + + + + + + + + + + + + + 10.0.15063 + 1.1 + + + + + + + - ``` -## Related topics - - -[DMAcc configuration service provider](dmacc-csp.md) - -  - -  - - - - - +## Related articles +[DMAcc configuration service provider reference](dmacc-csp.md)