finish kiosk

devices/hololens/TOC.md

@@ -4,6 +4,7 @@
 ## [Set up HoloLens](hololens-setup.md)
 ## [Unlock Windows Holographic for Business features](hololens-upgrade-enterprise.md) 
 ## [Enroll HoloLens in MDM](hololens-enroll-mdm.md)
+## [Manage updates to HoloLens](hololens-updates.md)
 ## [Set up HoloLens in kiosk mode](hololens-kiosk.md)
 ## [Configure HoloLens using a provisioning package](hololens-provisioning.md)
 ## [Install apps on HoloLens](hololens-install-apps.md)

devices/hololens/change-history-hololens.md

@@ -19,7 +19,10 @@ This topic lists new and updated topics in the [Microsoft HoloLens documentation
 
 The topics in this library have been updated for Windows 10 Holographic for Business, version 1803. The following new topics have been added:
 
-- >
+- [What's new in Microsoft HoloLens](hololens-whats-new.md)
+- [Manage updates to HoloLens](hololens-updates.md)
+
+
 ## February 2018
 
 New or changed topic | Description

devices/hololens/hololens-kiosk.md

@@ -18,7 +18,7 @@ When HoloLens is configured as a multi-app kiosk, only the allowed apps are avai
 
 Single-app kiosk mode starts the specified app when the user signs in, and restricts the user's ability to launch new apps or change the running app. When single-app kiosk mode is enabled for HoloLens, the bloom gesture and Cortana are disabled, and placed apps aren't shown in the user's surroundings. 
 
-Multi-app kiosks can run Universal Windows Platform (UWP) apps and Classic Wesktop applications (Win32). Single-app kiosks can run UWP apps.
+
 
 >[!WARNING]
 >The assigned access feature which enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all [the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#policies-set-by-multi-app-kiosk-configuration). A factory reset is needed to clear all the policies enforced via assigned access.
@@ -100,11 +100,9 @@ You will [create an XML file](#ppkg-kiosk) to define the kiosk configuration to
 10. In **Kiosk Mode**, select **Multi app kiosk**.
 11. Select **Add** to define a configuration, which specifies the apps that will run and the layout for the Start menu.
 12. Enter a friendly name for the configuration.
-13. Select an app type, either **Win32 App** for a classic desktop application or **UWP App** for a Universal Windows Platform app.
+13. Select **UWP App** for a Universal Windows Platform app, and enter the Application User Model ID for an installed app.
-  - For **Win32 App**, enter the fully qualified pathname of the executable, with respect to the device.
-  - For **UWP App**, enter the Application User Model ID for an installed app.
 14. Select whether to enable the taskbar.
-15. Browse to and select the Start layout XML file that you generated in step 1.
+15. Browse to and select [the Start layout XML file](#start-kiosk).
 16. Add one or more accounts. When the account signs in, only the apps defined in the configuration will be available.
 17. Select **OK**. You can add additional configurations or finish.
 18. Assign the profile to a device group to configure the devices in that group as kiosks.
@@ -133,6 +131,61 @@ Process:
 2. Add XML file to provisioning package(#add-xml)
 3. Apply provisioning package to device(#apply-ppkg)
 
+<span id="create-xml-file"/>
+### Create a kiosk configuration XML file
+
+Follow [the instructions for creating a kiosk configuration XML file for desktop](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configure-a-kiosk-using-a-provisioning-package), with the following exceptions:
+
+- Do not include Classic Windows applications (Win32) since they aren't supported on HoloLens.
+- Use the [placeholder Start XML](#start-kiosk) for HoloLens.
+- Use [group accounts](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#config-for-group-account) rather than individual accounts.
+
+<span id="add-xml"/>
+### Add the kiosk configuration XML file to a provisioning package
+
+1. Open [Windows Configuration Designer](https://www.microsoft.com/store/apps/9nblggh4tx22).
+2. Choose **Advanced provisioning**.
+3. Name your project, and click **Next**.
+4. Choose **Windows 10 Holographic** and click **Next**.
+5. Select **Finish**. The workspace for your package opens.
+6. Expand **Runtime settings** &gt; **AssignedAccess** &gt; **MultiAppAssignedAccessSettings**.
+7. In the center pane, click **Browse** to locate and select the kiosk configuration XML file that you created.
+
+  ![Screenshot of the MultiAppAssignedAccessSettings field in Windows Configuration Designer](images/multiappassignedaccesssettings.png)
+
+8. (**Optional**: If you want to apply the provisioning package after device initial setup and there is an admin user already available on the kiosk device, skip this step.) Create an admin user account in **Runtime settings** &gt; **Accounts** &gt; **Users**. Provide a **UserName** and **Password**, and select **UserGroup** as **Administrators**. With this account, you can view the provisioning status and logs if needed.   
+8. (**Optional**: If you already have a non-admin account on the kiosk device, skip this step.) Create a local standard user account in **Runtime settings** &gt; **Accounts** &gt; **Users**. Make sure the **UserName** is the same as the account that you specify in the configuration XML. Select **UserGroup** as **Standard Users**.
+8.  On the **File** menu, select **Save.**
+9.  On the **Export** menu, select **Provisioning package**.
+10. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.**
+
+11. On the **Provisioning package security** page, do not select **Enable package encryption** or provisioning will fail on HoloLens. You can choose to enable package signing.
+
+      -   **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Browse** and choosing the certificate you want to use to sign the package.
+
+12. Click **Next** to specify the output location where you want the provisioning package to go when it's built. By default, Windows Configuration Designer uses the project folder as the output location. Optionally, you can click **Browse** to change the default output location.
+
+13. Click **Next**.
+
+14. Click **Build** to start building the package. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status.
+
+    
+
+<span id="apply-ppkg"/>
+### Apply the provisioning package to HoloLens
+
+1. Connect HoloLens via USB to a PC and start the device, but do not continue past the **Fit** page of OOBE (the first page with the blue box).
+
+3. HoloLens will show up as a device in File Explorer on the PC.
+
+4. In File Explorer, drag and drop the provisioning package (.ppkg) onto the device storage.
+
+5. Briefly press and release the **Volume Down** and **Power** buttons simultaneously again while on the **fit** page.
+
+6. The device will ask you if you trust the package and would like to apply it. Confirm that you trust the package.
+
+7. You will see whether the package was applied successfully or not. If it failed, you can fix your package and try again. If it succeeded, proceed with OOBE.
+
 
 <span id="portal-kiosk"/>
 ## Set up kiosk mode using the Windows Device Portal (Windows 10, version 1607 and version 1803) 

devices/hololens/hololens-provisioning.md

@@ -20,14 +20,9 @@ Some of the HoloLens configurations that you can apply in a provisioning package
 - Set up a Wi-Fi connection
 - Apply certificates to the device
 
-To install Windows Configuration Designer and create provisioning packages, you must [install the Windows Assessment and Deployment Kit (ADK) for Windows 10](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) or install [Windows Configuration Designer](https://www.microsoft.com/store/apps/9nblggh4tx22) from the Microsoft Store.
+To install Windows Configuration Designer and create provisioning packages, you must install [Windows Configuration Designer](https://www.microsoft.com/store/apps/9nblggh4tx22) from the Microsoft Store or [install the Windows Assessment and Deployment Kit (ADK) for Windows 10](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). If you install Windows Configurations Designer from the Windows ADK, select **Configuration Designer** from the **Select the features you want to install** dialog box.
 
-When you run ADKsetup.exe for Windows 10, version 1607, select **Configuration Designer** from the **Select the features you want to install** dialog box.
 
-![Choose Configuration Designer](images/adk-install.png)
-
-> [!NOTE]
-> In previous versions of the Windows 10 ADK, you had to install additional features for Windows Configuration Designer to run. Starting in version 1607, you can install Windows Configuration Designer without other ADK features.
 
 <span id="wizard" />
 ## Create a provisioning package for HoloLens using the HoloLens wizard

devices/hololens/hololens-updates.md

@@ -0,0 +1,36 @@
+---
+title: Manage updates to HoloLens (HoloLens)
+description: 
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.pagetype: hololens, devices
+ms.sitesec: library
+author: jdeckerms
+ms.localizationpriority: medium
+ms.date: 04/01/2018
+---
+
+# Manage updates to HoloLens
+
+Windows 10, version 1803, is the first feature update to Windows Holographic for Business since its release in Windows 10, version 1607. 
+
+WSUS is not directly supported by Intune since Intune is pushing WUFB. You would need to go to the Custom OMA-DM URI route to set those unsupported policies as @Alvin Chardon descirbes below. 
+
+Below is policies HL supports and the mechanism you need to use in Intune.
+•	Update/AllowAutoUpdate – directly supported in UI. Software Updates > Windows 10 Update Rings > Automatic update behavior
+•	Update/AllowUpdateService  - Custom OMA-DM URI 
+•	Update/RequireDeferUpgrade  -- directly supported in UI. Software Updates > Windows 10 Update Rings > Servicing channel
+•	Update/RequireUpdateApproval -- Custom OMA-DM URI
+•	Update/UpdateServiceUrl Custom OMA-DM URI
+
+MDM can defer the update directly from Windows Update by setting Servicing Channel to semi-annual (not targeted).
+
+Here is the general Intune documentation for Microsoft Update for Business:
+https://docs.microsoft.com/en-us/intune/windows-update-for-business-configure
+
+Here is the Holographic-specific section of that article naming what features are supported:
+https://docs.microsoft.com/en-us/intune/windows-update-for-business-configure#windows-holographic-for-business-support 
+
+For the settings Intune doesn’t offer UI, including WSUS, we recommended setting them through Custom OMA-DM Uris:
+https://docs.microsoft.com/en-us/intune/custom-settings-windows-holographic 
+