diff --git a/windows/client-management/mdm-known-issues.md b/windows/client-management/mdm-known-issues.md index 8c3dc27e89..63895b5917 100644 --- a/windows/client-management/mdm-known-issues.md +++ b/windows/client-management/mdm-known-issues.md @@ -68,7 +68,7 @@ EAP XML must be updated with relevant information for your environment. This tas - For Wi-Fi, look for the <EAPConfig> section of your current WLAN Profile XML (This detail is what you specify for the WLanXml node in the Wi-Fi CSP). Within these tags, you'll find the complete EAP configuration. Replace the section under <EAPConfig> with your updated XML and update your Wi-Fi profile. You might need to refer to your MDM's guidance on how to deploy a new Wi-Fi profile. - For VPN, EAP Configuration is a separate field in the MDM Configuration. Work with your MDM provider to identify and update the appropriate Field. -For information about EAP Settings, see . +For information about EAP Settings, see [Extensible Authentication Protocol (EAP) for network access](/windows-server/networking/technologies/extensible-authentication-protocol/network-access). For information about generating an EAP XML, see [EAP configuration](mdm/eap-configuration.md). @@ -225,7 +225,7 @@ Alternatively you can use the following procedure to create an EAP Configuration 1. Continue following the procedure in [EAP configuration](mdm/eap-configuration.md) from Step 9 to get an EAP TLS profile with appropriate filtering. > [!NOTE] -> You can also set all the other applicable EAP Properties through this UI as well. A guide to what these properties mean can be found in [Extensible Authentication Protocol (EAP) Settings for Network Access](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh945104(v=ws.11)). +> You can also set all the other applicable EAP Properties through this UI as well. A guide to what these properties mean can be found in [Extensible Authentication Protocol (EAP) for network access](/windows-server/networking/technologies/extensible-authentication-protocol/network-access). ## MDM client will immediately check in with the MDM server after client renews WNS channel URI diff --git a/windows/client-management/mdm/eap-configuration.md b/windows/client-management/mdm/eap-configuration.md index 9b4bb74c16..926d63ac80 100644 --- a/windows/client-management/mdm/eap-configuration.md +++ b/windows/client-management/mdm/eap-configuration.md @@ -145,7 +145,7 @@ EAP XML must be updated with relevant information for your environment. This tas - For Wi-Fi, look for the `` section of your current WLAN Profile XML. (This section is what you specify for the WLanXml node in the Wi-Fi CSP.) Within these tags, you'll find the complete EAP configuration. Replace the section under `` with your updated XML and update your Wi-Fi profile. You can refer to your MDM’s guidance on how to deploy a new Wi-Fi profile. - For VPN, EAP configuration is a separate field in the MDM configuration. Work with your MDM provider to identify and update the appropriate field. -For information about EAP settings, see . +For information about EAP settings, see [Extensible Authentication Protocol (EAP) for network access](/windows-server/networking/technologies/extensible-authentication-protocol/network-access). For information about generating an EAP XML, see the EAP configuration article. @@ -297,7 +297,7 @@ Alternatively, you can use the following procedure to create an EAP configuratio 1. Continue following the procedure in the EAP configuration article from step 9 to get an EAP TLS profile with appropriate filtering. > [!NOTE] -> You can also set all the other applicable EAP Properties through this UI as well. A guide for what these properties mean can be found in the [Extensible Authentication Protocol (EAP) Settings for Network Access](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh945104(v=ws.11)) article. +> You can also set all the other applicable EAP Properties through this UI as well. A guide for what these properties mean can be found in the [Extensible Authentication Protocol (EAP) for network access](/windows-server/networking/technologies/extensible-authentication-protocol/network-access) article. ## Related topics diff --git a/windows/configuration/cortana-at-work/cortana-at-work-feedback.md b/windows/configuration/cortana-at-work/cortana-at-work-feedback.md index 78ad0b03f2..ae511d78a9 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-feedback.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-feedback.md @@ -13,6 +13,8 @@ ms.technology: itpro-configure --- # Send feedback about Cortana back to Microsoft + +[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] To provide feedback on an individual request or response, select the item in the conversation history and then select **Give feedback**. The Feedback Hub application is launched, where you can provide more information to help diagnose reported issues. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-o365.md b/windows/configuration/cortana-at-work/cortana-at-work-o365.md index 399384fb32..8e06273c57 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-o365.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-o365.md @@ -16,6 +16,8 @@ ms.technology: itpro-configure # Set up and test Cortana in Windows 10, versions 1909 and earlier, with Microsoft 365 in your organization + +[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] ## What can you do with in Windows 10, versions 1909 and earlier? Your employees can use Cortana to help manage their day and be more productive by getting quick answers to common questions, setting reminders, adding tasks to their To-Do lists, and find out where their next meeting is. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-overview.md b/windows/configuration/cortana-at-work/cortana-at-work-overview.md index cd9bc813a9..02f381c39f 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-overview.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-overview.md @@ -14,7 +14,8 @@ ms.topic: article --- # Configure Cortana in Windows 10 and Windows 11 - + +[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] ## Who is Cortana? Cortana is a personal productivity assistant in Microsoft 365, helping your users achieve more with less effort and focus on what matters. The Cortana app in Windows 10 and Windows 11 helps users quickly get information across Microsoft 365, using typed or spoken queries to connect with people, check calendars, set reminders, add tasks, and more. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md b/windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md index 0071761fd5..fca7d43916 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md @@ -14,6 +14,8 @@ ms.topic: article --- # Use Group Policy and mobile device management (MDM) settings to configure Cortana in your organization + +[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] For specific info about how to set, manage, and use each of these MDM policies to configure Cortana in your enterprise, see the [Policy CSP](/windows/client-management/mdm/policy-configuration-service-provider). diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-1.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-1.md index 0cf1df4390..661a84faa2 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-1.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-1.md @@ -14,6 +14,8 @@ ms.topic: article --- # Test scenario 1 – Sign into Azure AD, enable the wake word, and try a voice query + +[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] >[!NOTE] >The wake word has been re-enabled in the latest version of Cortana in Windows. If you're on Windows 10, version 2004, be sure that you've updated to build 19041.329 or later to use the wake word with Cortana. For earlier builds, you can still click on the microphone button to use your voice with Cortana. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-2.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-2.md index 4ba46b4d36..99c60d8373 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-2.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-2.md @@ -13,6 +13,8 @@ ms.technology: itpro-configure --- # Test scenario 2 – Perform a Bing search with Cortana + +[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] 1. Select the **Cortana** icon in the taskbar. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-3.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-3.md index b2202a902d..3975696457 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-3.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-3.md @@ -13,6 +13,8 @@ ms.technology: itpro-configure --- # Test scenario 3 - Set a reminder + +[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] This scenario helps you set up, review, and edit a reminder. For example, you can remind yourself to send someone a link to a document after a meeting. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-4.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-4.md index fcad450ae3..8dcfcc91c7 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-4.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-4.md @@ -14,6 +14,9 @@ ms.technology: itpro-configure # Test scenario 4 - Use Cortana to find free time on your calendar for your upcoming meetings. + +[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] + This scenario helps you find out if a time slot is free on your calendar. 1. Select the **Cortana** icon in the taskbar. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md index 94c1edabe4..efac6821ae 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md @@ -1,6 +1,6 @@ --- -title: Use Cortana to send email to a co-worker (Windows) -description: A test scenario about how to use Cortana at work to send email to a co-worker. +title: Use Cortana to send email to a coworker (Windows) +description: A test scenario about how to use Cortana at work to send email to a coworker. ms.prod: windows-client ms.collection: tier3 author: aczechowski @@ -13,6 +13,8 @@ ms.technology: itpro-configure --- # Test scenario 5 - Test scenario 5 – Find out about a person + +[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] Cortana can help you quickly look up information about someone or the org chart. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md index 54a1064afb..8fdc30830e 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md @@ -13,6 +13,8 @@ ms.technology: itpro-configure --- # Test scenario 6 – Change your language and perform a quick search with Cortana + +[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] Cortana can help employees in regions outside the US search for quick answers like currency conversions, time zone conversions, or weather in their location. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-7.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-7.md index a69e0078ff..e60c202497 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-7.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-7.md @@ -13,6 +13,8 @@ ms.technology: itpro-configure --- # Test scenario 7 - Use Cortana and Windows Information Protection (WIP) to help protect your organization’s data on a device + +[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] >[!IMPORTANT] >The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios.md b/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios.md index 63c801e46b..6f2a30aa8b 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios.md @@ -14,6 +14,9 @@ ms.technology: itpro-configure # Cortana at work testing scenarios + +[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] + We've come up with a list of suggested testing scenarios that you can use to test Cortana in your organization. After you complete all the scenarios, you should be able to: - [Sign into Azure AD, enable the Cortana wake word, and try a voice query](cortana-at-work-scenario-1.md) diff --git a/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md b/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md index ec1abf4d96..c7b3eac2bc 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md @@ -13,6 +13,8 @@ ms.technology: itpro-configure --- # Set up and test custom voice commands in Cortana for your organization + +[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] >[!NOTE] >This content applies to Cortana in versions 1909 and earlier, but will not be available in future releases. diff --git a/windows/configuration/cortana-at-work/includes/cortana-deprecation.md b/windows/configuration/cortana-at-work/includes/cortana-deprecation.md new file mode 100644 index 0000000000..c5ad2bd22a --- /dev/null +++ b/windows/configuration/cortana-at-work/includes/cortana-deprecation.md @@ -0,0 +1,14 @@ +--- +author: mestew +ms.author: mstewart +manager: aaroncz +ms.technology: itpro-updates +ms.prod: windows-client +ms.topic: include +ms.date: 06/08/2023 +ms.localizationpriority: medium +--- + + +> [!Important] +> Cortana in Windows as a standalone app is [deprecated](/windows/whats-new/deprecated-features). This change only impacts Cortana in Windows, and your productivity assistant, Cortana, will continue to be available in Outlook mobile, Teams mobile, Microsoft Teams display, and Microsoft Teams rooms. diff --git a/windows/configuration/cortana-at-work/set-up-and-test-cortana-in-windows-10.md b/windows/configuration/cortana-at-work/set-up-and-test-cortana-in-windows-10.md index b089b30590..c280af5397 100644 --- a/windows/configuration/cortana-at-work/set-up-and-test-cortana-in-windows-10.md +++ b/windows/configuration/cortana-at-work/set-up-and-test-cortana-in-windows-10.md @@ -14,7 +14,8 @@ ms.topic: article --- # Set up and test Cortana in Windows 10, version 2004 and later - + +[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] ## Before you begin - If your enterprise had previously disabled Cortana for your employees using the **Computer Configuration\Administrative Templates\Windows Components\Search\Allow Cortana** Group Policy or the **Experience\AllowCortana** MDM setting but want to enable it now that Cortana is part of Microsoft 365, you'll need to re-enable it at least for Windows 10, version 2004 and later, or Windows 11. diff --git a/windows/configuration/cortana-at-work/test-scenario-1.md b/windows/configuration/cortana-at-work/test-scenario-1.md index 76496df719..81d3d89d7c 100644 --- a/windows/configuration/cortana-at-work/test-scenario-1.md +++ b/windows/configuration/cortana-at-work/test-scenario-1.md @@ -13,6 +13,8 @@ ms.technology: itpro-configure --- # Test scenario 1 – Sign in with your work or school account and use Cortana to manage the notebook + +[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] This scenario turns on Azure AD and lets your employee use Cortana to manage an entry in the notebook. diff --git a/windows/configuration/cortana-at-work/test-scenario-2.md b/windows/configuration/cortana-at-work/test-scenario-2.md index c6a2efd05f..df3d6c02ec 100644 --- a/windows/configuration/cortana-at-work/test-scenario-2.md +++ b/windows/configuration/cortana-at-work/test-scenario-2.md @@ -13,6 +13,8 @@ ms.technology: itpro-configure --- # Test scenario 2 – Perform a quick search with Cortana at work + +[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] >[!Important] >The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. diff --git a/windows/configuration/cortana-at-work/test-scenario-3.md b/windows/configuration/cortana-at-work/test-scenario-3.md index 468c4060cc..2c23f88711 100644 --- a/windows/configuration/cortana-at-work/test-scenario-3.md +++ b/windows/configuration/cortana-at-work/test-scenario-3.md @@ -13,6 +13,8 @@ ms.technology: itpro-configure --- # Test scenario 3 - Set a reminder for a specific location using Cortana at work + +[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] >[!Important] >The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. diff --git a/windows/configuration/cortana-at-work/test-scenario-4.md b/windows/configuration/cortana-at-work/test-scenario-4.md index d1e98c4409..14eb9842c3 100644 --- a/windows/configuration/cortana-at-work/test-scenario-4.md +++ b/windows/configuration/cortana-at-work/test-scenario-4.md @@ -13,6 +13,8 @@ ms.technology: itpro-configure --- # Test scenario 4 - Use Cortana to find your upcoming meetings at work + +[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] >[!Important] >The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. diff --git a/windows/configuration/cortana-at-work/test-scenario-5.md b/windows/configuration/cortana-at-work/test-scenario-5.md index fcb33530cc..18c3c99f7a 100644 --- a/windows/configuration/cortana-at-work/test-scenario-5.md +++ b/windows/configuration/cortana-at-work/test-scenario-5.md @@ -13,6 +13,8 @@ ms.technology: itpro-configure --- # Test scenario 5 - Use Cortana to send an email to co-worker + +[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] >[!Important] >The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. diff --git a/windows/configuration/cortana-at-work/test-scenario-6.md b/windows/configuration/cortana-at-work/test-scenario-6.md index 1090b25b3f..50e009cc49 100644 --- a/windows/configuration/cortana-at-work/test-scenario-6.md +++ b/windows/configuration/cortana-at-work/test-scenario-6.md @@ -13,6 +13,8 @@ ms.technology: itpro-configure --- # Test scenario 6 - Review a reminder suggested by Cortana based on what you’ve promised in email + +[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] >[!Important] >The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. For more info, see the [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) and the [Microsoft Services Agreement](https://www.microsoft.com/servicesagreement). diff --git a/windows/configuration/cortana-at-work/testing-scenarios-using-cortana-in-business-org.md b/windows/configuration/cortana-at-work/testing-scenarios-using-cortana-in-business-org.md index 5f71bbdcec..973e56ee5e 100644 --- a/windows/configuration/cortana-at-work/testing-scenarios-using-cortana-in-business-org.md +++ b/windows/configuration/cortana-at-work/testing-scenarios-using-cortana-in-business-org.md @@ -13,6 +13,8 @@ ms.technology: itpro-configure --- # Testing scenarios using Cortana in your business or organization + +[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] We've come up with a list of suggested testing scenarios that you can use to test Cortana in your organization. After you complete all the scenarios, you should be able to: diff --git a/windows/deployment/planning/windows-to-go-overview.md b/windows/deployment/planning/windows-to-go-overview.md index 29746b5180..4332f5785a 100644 --- a/windows/deployment/planning/windows-to-go-overview.md +++ b/windows/deployment/planning/windows-to-go-overview.md @@ -94,22 +94,6 @@ As of the date of publication, the following are the USB drives currently certif - IronKey Workspace W500 ([http://www.ironkey.com/windows-to-go-drives/ironkey-workspace-w500.html](https://www.kingston.com/support/technical/products?model=dtws)) - IronKey Workspace W300 ([http://www.ironkey.com/windows-to-go-drives/ironkey-workspace-w300.html](https://www.kingston.com/support/technical/products?model=dtws)) - Kingston DataTraveler Workspace for Windows To Go ([http://www.kingston.com/wtg/](https://go.microsoft.com/fwlink/p/?LinkId=618719)) -- Spyrus Portable Workplace ([http://www.spyruswtg.com/](https://go.microsoft.com/fwlink/p/?LinkId=618720)) - - We recommend that you run the Spyrus Deployment Suite for Windows To Go to provision the Spyrus Portable Workplace. - -- Spyrus Secure Portable Workplace ([http://www.spyruswtg.com/](https://go.microsoft.com/fwlink/p/?LinkId=618720)) - - > [!IMPORTANT] - > You must use the Spyrus Deployment Suite for Windows To Go to provision the Spyrus Secure Portable Workplace. For more information about the Spyrus Deployment Suite for Windows To Go, see [http://www.spyruswtg.com/](https://go.microsoft.com/fwlink/p/?LinkId=618720). - - -- Spyrus Worksafe ([http://www.spyruswtg.com/](https://go.microsoft.com/fwlink/p/?LinkId=618720)) - - > [!TIP] - > This device contains an embedded smart card. - - - Super Talent Express RC4 for Windows To Go @@ -168,4 +152,4 @@ In addition to the USB boot support in the BIOS, the Windows 10 image on your Wi [Prepare your organization for Windows To Go](prepare-your-organization-for-windows-to-go.md)
[Deployment considerations for Windows To Go](deployment-considerations-for-windows-to-go.md)
[Security and data protection considerations for Windows To Go](security-and-data-protection-considerations-for-windows-to-go.md)
-[Best practice recommendations for Windows To Go](best-practice-recommendations-for-windows-to-go.md) \ No newline at end of file +[Best practice recommendations for Windows To Go](best-practice-recommendations-for-windows-to-go.md) diff --git a/windows/deployment/update/check-release-health.md b/windows/deployment/update/check-release-health.md index 5504be6122..c77bd7cf97 100644 --- a/windows/deployment/update/check-release-health.md +++ b/windows/deployment/update/check-release-health.md @@ -1,7 +1,7 @@ --- title: How to check Windows release health description: Check the release health status of Microsoft 365 services before you call support to see if there's an active service interruption. -ms.date: 05/03/2023 +ms.date: 06/07/2023 ms.author: mstewart author: mestew manager: aaroncz @@ -19,28 +19,39 @@ If you're unable to sign in to the Microsoft 365 admin portal, check the [Micros To be informed about the latest updates and releases, follow [@WindowsUpdate](https://twitter.com/windowsupdate) on Twitter. +## Prerequisites + +Ensure the following prerequisites are met to display the Windows release health page in the Microsoft 365 admin center: + +- One of the following licenses: + - Windows 10/11 Enterprise E3 or E5 (included in Microsoft 365 F3, E3, or E5) + - Windows 10/11 Education A3 or A5 (included in Microsoft 365 A3 or A5) + +- Sign into the Microsoft 365 admin center using an [admin role](/microsoft-365/admin/add-users/about-admin-roles). + - Most roles containing the word `administrator` give you access to the Windows release health page such as [Global Administrator](/azure/active-directory/roles/permissions-reference#global-administrator), [Helpdesk Administrator](/azure/active-directory/roles/permissions-reference#helpdesk-administrator), and [Service Support Administrator](/azure/active-directory/roles/permissions-reference#service-support-administrator). For more information, see [Assign admin roles in the Microsoft 365 admin center](/microsoft-365/admin/add-users/assign-admin-roles). + +> [!NOTE] +> Currently, Windows release health isn't available for Government Community Cloud (GCC) tenants. + ## How to review Windows release health information -1. Go to the [Microsoft 365 admin center](https://admin.microsoft.com) and sign in with an administrator account. - - > [!NOTE] - > By default, the Windows release health page is available to individuals who have been assigned the global admin or service administrator role for their tenant. To allow Exchange, SharePoint, and Skype for Business admins to view the Windows release health page, you must first assign them to a Service admin role. For more information about roles that can view service health, see [About admin roles](/microsoft-365/admin/add-users/about-admin-roles#commonly-used-microsoft-365-admin-center-roles). +1. Go to the [Microsoft 365 admin center](https://admin.microsoft.com) and sign in with an admin account. -2. To view Windows release health in the Microsoft 365 Admin Center, go to **Health > Windows release health**. +1. To view Windows release health in the Microsoft 365 Admin Center, go to **Health > Windows release health**. -3. On the **Windows release health** page, you'll have access to known issue information for all supported versions of the Windows operating system. +1. On the **Windows release health** page, you have access to known issue information for all supported versions of the Windows operating system. The **All versions** tab (the default view) shows all Windows products with access to their posted known issues. - ![View of current issues in release health.](images/WRH-menu.png) + ![Screenshot of current issues in release health.](images/WRH-menu.png) - A known issue is an issue that has been identified in a Windows monthly update or feature update that impacts Windows devices. The **Active and recently resolved** column provides a link to the **Known issues** tab filtered to the version selected. Selecting the **Known issues** tab will show known issues that are active or resolved within the last 30 days. + A known issue is an issue that has been identified in a Windows monthly update or feature update that impacts Windows devices. The **Active and recently resolved** column provides a link to the **Known issues** tab filtered to the version selected. Selecting the **Known issues** tab shows known issues that are active or resolved within the last 30 days. - ![View of known issues in release health.](images/WRH-known-issues-20H2.png) + ![Screenshot of known issues in release health.](images/WRH-known-issues-20H2.png) The **History** tab shows the history of known issues that have been resolved for up to 6 months. - ![View of history issues in release health.](images/WRH-history-20H2.png) + ![Screenshot of history issues in release health.](images/WRH-history-20H2.png) The known issue summary provides the following information: @@ -56,7 +67,7 @@ To be informed about the latest updates and releases, follow [@WindowsUpdate](ht ## Sign up for email notifications -You have the option to sign up for email notifications about Windows known issues and informational updates. Notifications include changes in issue status, new workarounds, and issue resolutions. To subscribe to notifications: +You can sign up for email notifications about Windows known issues and informational updates. Notifications include changes in issue status, new workarounds, and issue resolutions. To subscribe to notifications: 1. Go to the [Windows release health page](https://admin.microsoft.com/Adminportal/Home?#/windowsreleasehealth). 1. Select **Preferences** > **Email**, then select **Send me email notifications about Windows release health**. @@ -78,20 +89,20 @@ In the **Windows release health** experience, every known issue is assigned as s |**Reported** | An issue has been brought to the attention of the Windows teams. At this stage, there's no confirmation that users are affected. | |**Investigating** | The issue is believed to affect users and efforts are underway to gather more information about the issue's scope, mitigation steps, and root cause. | |**Confirmed** | After close review, Microsoft has determined the issue is affecting Windows users, and progress is being made on mitigation steps and root cause. | -|**Mitigated** | A workaround is available and communicated to Windows customers for a known issue. A known issue will stay in this state until a KB article is released by Microsoft to resolve the known issue. | -|**Mitigated: External** | A workaround is available and communicated to Windows customers for a known issue that was caused by a software or driver from a third-party software or device manufacturer. A known issue will stay in this state until the issue is resolved by Microsoft or the third-party. | -|**Resolved** | A solution has been released by Microsoft and has been documented in a KB article that will resolve the known issue once it's deployed in the customer's environment. | -|**Resolved: External** | A solution has been released by a Microsoft or a third-party that will resolve the known issue once it's deployed in the customer's environment. | +|**Mitigated** | A workaround is available and communicated to Windows customers for a known issue. A known issue stays in this state until a KB article is released by Microsoft to resolve the known issue. | +|**Mitigated: External** | A workaround is available and communicated to Windows customers for a known issue caused by a software or driver from a third-party software or device manufacturer. A known issue stays in this state until the issue is resolved by Microsoft or the third-party. | +|**Resolved** | A solution was released by Microsoft and was documented in a KB article that resolves the known issue once it's deployed in the customer's environment. | +|**Resolved: External** | A solution was released by Microsoft or a third-party that resolves the known issue once it's deployed in the customer's environment. | ## Known issue history The Windows release health page lets you view the history of all status updates posted for a specific known issue. To view all past updates posted for a given issue, select **View history** on the issue detail page. -![Show link to view message history.](images/WRH-view-message-history-padded.png) +![Screenshot of the link to view message history.](images/WRH-view-message-history-padded.png) -A list of all status updates posted in the selected timeframe will be displayed, as shown below. You can expand any row to view the specific information provided in that status update. +A list of all status updates posted in the selected time frame is displayed. You can expand any row to view the specific information provided in that status update. -![View message history.](images/WRH-message-history-example-padded.png) +![Screenshot of the message history.](images/WRH-message-history-example-padded.png) ## Frequently asked questions @@ -104,14 +115,14 @@ A list of all status updates posted in the selected timeframe will be displayed, Windows release health doesn't monitor user environments or collect customer environment information. In Windows release health, all known issue content across all supported Windows versions is published to all subscribed customers. Future iterations of the solution may target content based on customer location, industry, or Windows version. - **Where do I find Windows release health?** - After logging into Microsoft 365 admin center, expand the left-hand menu using **…Show All**, select **Health** and you'll see **Windows release health**. + After logging into Microsoft 365 admin center, expand the left-hand menu using **…Show All**, select **Health** to display the **Windows release health** menu option. - **Is the Windows release health content published to Microsoft 365 admin center the same as the content on Windows release health on Microsoft Learn?** - No. While the content is similar, you may see more issues and more technical details published to Windows release health on Microsoft 365 admin center to better support the IT admin. For example, you’ll find details to help you diagnose issues in your environment, steps to mitigate issues, and root cause analysis. + No. While the content is similar, you may see more issues and more technical details published to Windows release health on Microsoft 365 admin center to better support the IT admin. For example, you'll find details to help you diagnose issues in your environment, steps to mitigate issues, and root cause analysis. - **How often will content be updated?** - In an effort to ensure Windows customers have important information as soon as possible, all major known issues will be shared with Windows customers on both Microsoft Learn and the Microsoft 365 admin center. We may also update the details available for Windows release health in the Microsoft 365 admin center when we have additional details on workarounds, root cause, or other information to help you plan for updates and handle issues in your environment. + To ensure Windows customers have important information as soon as possible, all major known issues are shared with Windows customers on both Microsoft Learn and the Microsoft 365 admin center. We may also update the details available for Windows release health in the Microsoft 365 admin center when we have additional details on workarounds, root cause, or other information to help you plan for updates and handle issues in your environment. - **Can I share this content publicly or with other Windows customers?** Windows release health is provided to you as a licensed Windows customer and isn't to be shared publicly. @@ -131,7 +142,7 @@ A list of all status updates posted in the selected timeframe will be displayed, Using the left-hand menu, go to Users, then select the Active Users tab and follow the prompts to add a new user, or assign an existing user, to the role of **Service Support admin**. - **Why can't I click to the KB article from the Known issues or History tabs?** - Within the issue description, you'll find links to the KB articles. In the Known issue and History tabs, the entire row is a clickable entry to the issue's Details pane. + Within the issue description, you'll find links to the KB articles. In the known issue and history tabs, the entire row is a clickable entry to the issue's Details pane. - **Microsoft 365 admin center has a mobile app but I don't see Windows release health under the Health menu. Is this an open issue?** We're working to build the Windows release health experience on mobile devices in a future release. @@ -142,7 +153,7 @@ A list of all status updates posted in the selected timeframe will be displayed, Seek assistance through Premier support, the [Microsoft Support website](https://support.microsoft.com), or connect with your normal channels for Windows support. - **When reaching out to Support, they asked me for an advisory ID. What is this and where can it?** - The advisory ID can be found in the upper left-hand corner of the known issue Details pane. To find it, select the known issue you're seeking help on, select the **Details** pane, and you'll find the ID under the issue title. It will be the letters `WI` followed by a number, similar to `WI123456`. + The advisory ID can be found in the upper left-hand corner of the known issue Details pane. To find it, select the known issue you're seeking help on, select the **Details** pane, and you'll find the ID under the issue title. The ID is the letters `WI` followed by a number, similar to `WI123456`. - **How can I learn more about expanding my use of Microsoft 365 admin center?** For more information, see the [Microsoft 365 admin center documentation](/microsoft-365/admin/admin-overview/about-the-admin-center). diff --git a/windows/deployment/update/media/33771278-update-deployment-status-table.png b/windows/deployment/update/media/33771278-update-deployment-status-table.png deleted file mode 100644 index 858e340f73..0000000000 Binary files a/windows/deployment/update/media/33771278-update-deployment-status-table.png and /dev/null differ diff --git a/windows/deployment/update/wufb-reports-prerequisites.md b/windows/deployment/update/wufb-reports-prerequisites.md index f9951294d8..a76dd15fb0 100644 --- a/windows/deployment/update/wufb-reports-prerequisites.md +++ b/windows/deployment/update/wufb-reports-prerequisites.md @@ -6,7 +6,7 @@ ms.prod: windows-client author: mestew ms.author: mstewart ms.topic: article -ms.date: 04/26/2023 +ms.date: 06/09/2023 ms.technology: itpro-updates --- @@ -62,7 +62,12 @@ Device names don't appear in Windows Update for Business reports unless you indi - CSP: System/[AllowDeviceNameInDiagnosticData](/windows/client-management/mdm/policy-csp-system#system-allowdevicenameindiagnosticdata) - Group Policy: **Allow device name to be sent in Windows diagnostic data** under **Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds** - Microsoft is committed to providing you with effective controls over your data and ongoing transparency into our data handling practices. For more information about data handling and privacy for Windows diagnostic data, see [Configure Windows diagnostic data in your organization](/windows/privacy/configure-windows-diagnostic-data-in-your-organization) and [Changes to Windows diagnostic data collection](/windows/privacy/changes-to-windows-diagnostic-data-collection#services-that-rely-on-enhanced-diagnostic-data). + +> [!TIP] +> Windows Update for Business reports uses [services configuration](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#bkmk-svccfg), also called OneSettings. Disabling the services configuration can cause some of the client data to be incorrect or missing in reports. For more information, see the [DisableOneSettingsDownloads](/windows/client-management/mdm/policy-csp-system#disableonesettingsdownloads) policy settings. + + +Microsoft is committed to providing you with effective controls over your data and ongoing transparency into our data handling practices. For more information about data handling and privacy for Windows diagnostic data, see [Configure Windows diagnostic data in your organization](/windows/privacy/configure-windows-diagnostic-data-in-your-organization) and [Changes to Windows diagnostic data collection](/windows/privacy/changes-to-windows-diagnostic-data-collection#services-that-rely-on-enhanced-diagnostic-data). ## Data transmission requirements diff --git a/windows/deployment/update/wufb-reports-schema-ucclientupdatestatus.md b/windows/deployment/update/wufb-reports-schema-ucclientupdatestatus.md index 34cab456db..1c71d9d355 100644 --- a/windows/deployment/update/wufb-reports-schema-ucclientupdatestatus.md +++ b/windows/deployment/update/wufb-reports-schema-ucclientupdatestatus.md @@ -6,7 +6,7 @@ ms.prod: windows-client author: mestew ms.author: mstewart ms.topic: reference -ms.date: 04/24/2023 +ms.date: 06/05/2023 ms.technology: itpro-updates --- diff --git a/windows/deployment/update/wufb-reports-workbook.md b/windows/deployment/update/wufb-reports-workbook.md index 9756777253..cd185eb07c 100644 --- a/windows/deployment/update/wufb-reports-workbook.md +++ b/windows/deployment/update/wufb-reports-workbook.md @@ -6,7 +6,7 @@ ms.prod: windows-client author: mestew ms.author: mstewart ms.topic: article -ms.date: 04/26/2023 +ms.date: 06/12/2023 ms.technology: itpro-updates --- @@ -79,17 +79,16 @@ Below the tiles, the **Quality updates** tab is subdivided into **Update status* The **Update status** group for quality updates contains the following items: -- **Update states for all security releases**: Chart containing the number of devices in a specific state, such as installing, for security updates. +- **Update states for all security releases**: The update states for the last 3 security updates are used to populate this chart. The total number of update states is approximately 3 times the number of devices that have reported update data to Windows Update for Business reports in the past 30 days. - **Update alerts for all security releases**: Chart containing the count of active errors and warnings for security updates. -:::image type="content" source="media/33771278-update-deployment-status-table.png" alt-text="Screenshot of the charts and table in the workbook's quality updates tab" lightbox="media/33771278-update-deployment-status-table.png"::: The **Update deployment status** table displays the quality updates for each operating system version that were released within the last 60 days. For each update, drill-in further by selecting a value from the following columns: | Column name | Description | Drill-in description | |---|---|---| |**Alerts**| Number of different error codes encountered by devices for the update. | Selecting this number lists the alert name for each error code and a count of devices with the error. Select the device count to display a list of devices that have an active alert for the error code. -| **KB Number** | KB number for the update | Selecting the KB number will open the support information webpage for the update.| +| **KB Number** | KB number for the update | Selecting the KB number opens the support information webpage for the update.| | **Total devices** | Number of devices that have been offered the update, or are installing, have installed, or canceled the update. | Selecting the device count opens a device list table. This table is limited to the first 250 rows. Select `...` to export the full list, or display the query in [Log Analytics](/azure/azure-monitor/logs/log-analytics-tutorial). | ### Device status group for quality updates @@ -120,7 +119,7 @@ The **Update status** group for feature updates contains the following items: - **Safeguard holds**: Chart containing count of devices per operating system version that are under a safeguard hold for a feature update - **Update alerts**: Chart containing the count of active errors and warnings for feature updates. -**Update deployment status** table for feature updates displays the installation status by targeted operating system version. For each operating system version targeted the following columns are available: +**Update deployment status** table for feature updates displays the installation status by targeted operating system version. For each operating system version targeted, the following columns are available: | Column name | Description | Drill-in description | |---|---|---| diff --git a/windows/deployment/update/wufb-wsus.md b/windows/deployment/update/wufb-wsus.md index 3196b89771..c6bd179c95 100644 --- a/windows/deployment/update/wufb-wsus.md +++ b/windows/deployment/update/wufb-wsus.md @@ -46,7 +46,7 @@ To help you better understand the scan source policy, see the default scan behav - If you configure only the WSUS server policy: - On Windows 10: All of your updates will come from WSUS. - - On Windows 11: All of your updates will still come from Windows Update unless you configure the specify scan source policy. + - On Windows 11: All of your updates will still come from WSUS unless you configure the specify scan source policy. - If you configure a WSUS server and deferral policies: All of your updates will come from Windows Update unless you specify the scan source policy. - If you configure a WSUS server and the scan source policy: All of your updates will come from the source chosen in the scan source policy. diff --git a/windows/deployment/wds-boot-support.md b/windows/deployment/wds-boot-support.md index 6849160ab4..5c34ff5222 100644 --- a/windows/deployment/wds-boot-support.md +++ b/windows/deployment/wds-boot-support.md @@ -40,6 +40,10 @@ The table below provides support details for specific deployment scenarios. Boot Alternatives to WDS, such as [Microsoft Configuration Manager](/mem/configmgr/) and [Microsoft Deployment Toolkit](/mem/configmgr/mdt/) (MDT) provide a better, more flexible, and feature-rich experience for deploying Windows images. +> [!NOTE] +> +> [Microsoft Deployment Toolkit](/mem/configmgr/mdt/) (MDT) only supports deployment of Windows 10. It doesn't support deployment of Windows 11. For more information, see [Supported platforms](/mem/configmgr/mdt/release-notes#supported-platforms). + ## Not affected WDS PXE boot isn't affected by this change. You can still use WDS to PXE boot devices with custom boot images, but you can't use **boot.wim** as the boot image and run Windows Setup in WDS mode. diff --git a/windows/deployment/windows-autopatch/deploy/windows-autopatch-admin-contacts.md b/windows/deployment/windows-autopatch/deploy/windows-autopatch-admin-contacts.md index 4a3c6c4c86..5a5b518816 100644 --- a/windows/deployment/windows-autopatch/deploy/windows-autopatch-admin-contacts.md +++ b/windows/deployment/windows-autopatch/deploy/windows-autopatch-admin-contacts.md @@ -10,6 +10,8 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: hathind +ms.collection: + - tier2 --- # Add and verify admin contacts diff --git a/windows/deployment/windows-autopatch/deploy/windows-autopatch-device-registration-overview.md b/windows/deployment/windows-autopatch/deploy/windows-autopatch-device-registration-overview.md index b1f8d211c8..ef153dd2bf 100644 --- a/windows/deployment/windows-autopatch/deploy/windows-autopatch-device-registration-overview.md +++ b/windows/deployment/windows-autopatch/deploy/windows-autopatch-device-registration-overview.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: andredm7 +ms.collection: + - highpri + - tier1 --- # Device registration overview diff --git a/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-manage-autopatch-groups.md b/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-manage-autopatch-groups.md index c059889d51..d4c14da227 100644 --- a/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-manage-autopatch-groups.md +++ b/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-manage-autopatch-groups.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: andredm7 +ms.collection: + - highpri + - tier1 --- # Manage Windows Autopatch groups (public preview) diff --git a/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-overview.md b/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-overview.md index 730fc16ec4..15829f199b 100644 --- a/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-overview.md +++ b/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-overview.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: andredm7 +ms.collection: + - highpri + - tier1 --- # Windows Autopatch groups overview (public preview) @@ -17,7 +20,7 @@ ms.reviewer: andredm7 > [!IMPORTANT] > Windows Autopatch groups is in **public preview**. This feature is being actively developed and might not be complete. You can test and use these features in production environments and provide feedback.

The Windows Autopatch group experience only applies if you’ve opted-in to use Windows Autopatch groups.


**To opt-in to use Windows Autopatch groups:**
  1. Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and select **Devices** from the left navigation menu.
  2. Under **Windows Autopatch**, select **Release Management**, then select **Autopatch groups (preview)**.
  3. Review the **[Microsoft Privacy Statement](../overview/windows-autopatch-privacy.md)** and the **[Autopatch groups Public Preview Addendum](../references/windows-autopatch-groups-public-preview-addendum.md)**. If you agree, select the **I have reviewed and agree to the Autopatch groups Public Preview Addendum** checkbox. Then, select **Use preview** to test out Windows Autopatch groups and its bundled feature set. If the **Use preview** option is greyed out, ensure you meet all the [Autopatch group prerequisites](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#autopatch-groups-prerequisites).
-As organizations move to a managed-service model where Microsoft manages update processes on their behalf, they’re challenged with having the right representation of their organizational structures followed by their own deployment cadence. Windows Autopatch groups helps organizations manage updates in a way that makes sense for their businesses with no extra cost or unplanned disruptions. +As organizations move to a managed-service model where Microsoft manages update processes on their behalf, they’re challenged with having the right representation of their organizational structures followed by their own deployment cadence. Windows Autopatch groups help organizations manage updates in a way that makes sense for their businesses with no extra cost or unplanned disruptions. ## What are Windows Autopatch groups? @@ -64,7 +67,7 @@ The Default Autopatch group uses Windows Autopatch’s default update management The Default Autopatch group is intended to serve organizations that are looking to: - Enroll into the service -- Align to Windows Autopatch’s default update management process without requiring additional customizations. +- Align to Windows Autopatch’s default update management process without requiring more customizations. The Default Autopatch group **can’t** be deleted or renamed. However, you can customize its deployment ring composition to add and/or remove deployment rings, and you can also customize the update deployment cadences for each deployment ring within it. @@ -160,7 +163,7 @@ Autopatch groups creates two different layers. Each layer contains its own deplo The service-based deployment ring set is exclusively used to keep Windows Autopatch updated with both service and device-level configuration policies, apps and APIs needed for core functions of the service. -The following are the Azure AD assigned groups that represent the service-based deployment rings. These groups cannot be deleted or renamed: +The following are the Azure AD assigned groups that represent the service-based deployment rings. These groups can't be deleted or renamed: - Modern Workplace Devices-Windows Autopatch-Test - Modern Workplace Devices-Windows Autopatch-First @@ -174,7 +177,7 @@ The following are the Azure AD assigned groups that represent the service-based The software-based deployment ring set is exclusively used with software update management policies, such as the Windows update ring and feature update policies, in the Default Windows Autopatch group. -The following are the Azure AD assigned groups that represent the software updates-based deployment rings. These groups cannot be deleted or renamed: +The following are the Azure AD assigned groups that represent the software updates-based deployment rings. These groups can't be deleted or renamed: - Windows Autopatch - Test - Windows Autopatch – Ring1 @@ -203,7 +206,7 @@ The following are three common uses for using Autopatch groups. | Scenario | Solution | | ----- | ----- | -| You’re working as the IT admin at Contoso Ltd. And manage several Microsoft and non-Microsoft cloud services. You don’t have extra time to spend setting up and managing several Autopatch groups.

Your organization currently operates its update management by using five deployment rings, but there’s an opportunity to have flexible deployment cadences if it’s pre-communicated to your end-users.

| If you don’t have thousands of devices to manage, use the Default Autopatch group for your organization. You can edit the Default Autopatch group to include additional deployment rings and/or slightly modify some of its default deployment cadences.

The Default Autopatch group is pre-configured and doesn’t require extra configurations when registering devices with the Windows Autopatch service.

The following is a visual representation of a gradual rollout for the Default Autopatch group pre-configured and fully managed by the Windows Autopatch service.

| +| You’re working as the IT admin at Contoso Ltd. And manage several Microsoft and non-Microsoft cloud services. You don’t have extra time to spend setting up and managing several Autopatch groups.

Your organization currently operates its update management by using five deployment rings, but there’s an opportunity to have flexible deployment cadences if it’s precommunicated to your end-users.

| If you don’t have thousands of devices to manage, use the Default Autopatch group for your organization. You can edit the Default Autopatch group to include additional deployment rings and/or slightly modify some of its default deployment cadences.

The Default Autopatch group is preconfigured and doesn’t require extra configurations when registering devices with the Windows Autopatch service.

The following is a visual representation of a gradual rollout for the Default Autopatch group preconfigured and fully managed by the Windows Autopatch service.

| :::image type="content" source="../media/autopatch-groups-default-autopatch-group.png" alt-text="Default Autopatch group" lightbox="../media/autopatch-groups-default-autopatch-group.png"::: @@ -211,7 +214,7 @@ The following are three common uses for using Autopatch groups. | Scenario | Solution | | ----- | ----- | -| You’re working as the IT admin at Contoso Ltd. Your organization needs to plan a gradual rollout of software updates within specific critical business units or departments to help mitigate the risk of end-user disruption. | You can create a Custom Autopatch group for each of your business units, for example, the finance department and breakdown the deployment ring composition per the different user personas or based on how critical certain user groups can be for the department and subsequently for the business.

The following is a visual representation of a gradual rollout for Contoso’s Finance department.

| +| You’re working as the IT admin at Contoso Ltd. Your organization needs to plan a gradual rollout of software updates within specific critical business units or departments to help mitigate the risk of end-user disruption. | You can create a Custom Autopatch group for each of your business units. For example, you can create a Custom Autopatch group for the finance department and breakdown the deployment ring composition per the different user personas or based on how critical certain user groups can be for the department and then for the business.

The following is a visual representation of a gradual rollout for Contoso’s Finance department.

| :::image type="content" source="../media/autopatch-groups-finance-department-example.png" alt-text="Finance department example" lightbox="../media/autopatch-groups-finance-department-example.png"::: @@ -245,7 +248,7 @@ Autopatch groups works with the following software update workloads: ### Maximum number of Autopatch groups -Windows Autopatch will support up to 50 Autopatch groups in your tenant. You can create up to 49 [Custom Autopatch groups](#about-custom-autopatch-groups) in addition to the [Default Autopatch group](#about-the-default-autopatch-group). Each Autopatch group supports up to 15 deployment rings. +Windows Autopatch supports up to 50 Autopatch groups in your tenant. You can create up to 49 [Custom Autopatch groups](#about-custom-autopatch-groups) in addition to the [Default Autopatch group](#about-the-default-autopatch-group). Each Autopatch group supports up to 15 deployment rings. > [!TIP] > If you reach the maximum number of Autopatch groups supported (50), and try to create more Custom Autopatch groups, the "**Create**" option in the Autopatch groups blade will be greyed out. diff --git a/windows/deployment/windows-autopatch/deploy/windows-autopatch-post-reg-readiness-checks.md b/windows/deployment/windows-autopatch/deploy/windows-autopatch-post-reg-readiness-checks.md index 076f04ca7b..eb2f5d26d5 100644 --- a/windows/deployment/windows-autopatch/deploy/windows-autopatch-post-reg-readiness-checks.md +++ b/windows/deployment/windows-autopatch/deploy/windows-autopatch-post-reg-readiness-checks.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: andredm7 +ms.collection: + - highpri + - tier1 --- # Post-device registration readiness checks (public preview) diff --git a/windows/deployment/windows-autopatch/deploy/windows-autopatch-register-devices.md b/windows/deployment/windows-autopatch/deploy/windows-autopatch-register-devices.md index 55ddc49938..3b79bc86cb 100644 --- a/windows/deployment/windows-autopatch/deploy/windows-autopatch-register-devices.md +++ b/windows/deployment/windows-autopatch/deploy/windows-autopatch-register-devices.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: andredm7 +ms.collection: + - highpri + - tier1 --- # Register your devices diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-deregister-devices.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-deregister-devices.md index 1792c44913..fa0d5b2cae 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-deregister-devices.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-deregister-devices.md @@ -10,6 +10,8 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: andredm7 +ms.collection: + - tier2 --- # Deregister a device diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-device-alerts.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-device-alerts.md index fe0551604d..edfc041070 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-device-alerts.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-device-alerts.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: adnich +ms.collection: + - highpri + - tier1 --- # Device alerts (public preview) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-edge.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-edge.md index c45d4d9c97..03e04c49d8 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-edge.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-edge.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: hathind +ms.collection: + - highpri + - tier1 --- # Microsoft Edge diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-manage-windows-feature-update-release.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-manage-windows-feature-update-release.md index 8323fdbc22..c472f2178a 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-manage-windows-feature-update-release.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-manage-windows-feature-update-release.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: andredm7 +ms.collection: + - highpri + - tier1 --- # Manage Windows feature update releases: Windows Autopatch groups experience (public preview) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-update-management.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-update-management.md index e6730c53fb..2e4435991e 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-update-management.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-update-management.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: andredm7 +ms.collection: + - highpri + - tier1 --- # Software update management: Windows Autopatch groups experience (public preview) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-overview.md index c3b733b603..698bdc24c9 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-overview.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: andredm7 +ms.collection: + - highpri + - tier1 --- # Windows feature updates overview: Autopatch groups experience (public preview) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-status-report.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-status-report.md index fc177682b7..17cb7aa33c 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-status-report.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-status-report.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: andredm7 +ms.collection: + - highpri + - tier1 --- # Feature update status report (public preview) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-summary-dashboard.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-summary-dashboard.md index 63c6483b4d..95c7c23f50 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-summary-dashboard.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-summary-dashboard.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: andredm7 +ms.collection: + - highpri + - tier1 --- # Windows feature update summary dashboard (public preview) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-trending-report.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-trending-report.md index d6c6955600..d7be7a1540 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-trending-report.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-trending-report.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: andredm7 +ms.collection: + - highpri + - tier1 --- # Feature update trending report (public preview) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md index 8f10b41042..78da3612ba 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md @@ -10,9 +10,12 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: adnich +ms.collection: + - highpri + - tier1 --- -# Windows quality and feature update reports overview: Windows Autopatch groups experience (public preview) +# Windows quality and feature update reports overview: Windows Autopatch groups experience (public preview) > [!IMPORTANT] > Windows Autopatch groups is in **public preview**. This feature is being actively developed and might not be complete. You can test and use these features in production environments and provide feedback.

The Windows Autopatch group experience only applies if you’ve opted-in to use Windows Autopatch groups.


**To opt-in to use Windows Autopatch groups:**
  1. Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and select **Devices** from the left navigation menu.
  2. Under **Windows Autopatch**, select **Release Management**, then select **Autopatch groups (preview)**.
  3. Review the **[Microsoft Privacy Statement](../overview/windows-autopatch-privacy.md)** and the **[Autopatch groups Public Preview Addendum](../references/windows-autopatch-groups-public-preview-addendum.md)**. If you agree, select the **I have reviewed and agree to the Autopatch groups Public Preview Addendum** checkbox. Then, select **Use preview** to test out Windows Autopatch groups and its bundled feature set. If the **Use preview** option is greyed out, ensure you meet all the [Autopatch group prerequisites](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#autopatch-groups-prerequisites).
diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-communications.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-communications.md index cd1653f964..de3076eac4 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-communications.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-communications.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: hathind +ms.collection: + - highpri + - tier1 --- # Windows quality update communications: Windows Autopatch groups experience (public preview) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-end-user-exp.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-end-user-exp.md index 25705531f4..b62341e010 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-end-user-exp.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-end-user-exp.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: adnich +ms.collection: + - highpri + - tier1 --- # Windows quality update end user experience: Windows Autopatch groups experience (public preview) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-overview.md index 559e317784..49540bdcf0 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-overview.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: andredm7 +ms.collection: + - highpri + - tier1 --- # Windows quality updates: Windows Autopatch groups experience (public preview) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-signals.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-signals.md index 556a292eb3..db5749bf16 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-signals.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-signals.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: hathind +ms.collection: + - highpri + - tier1 --- # Windows quality update signals: Windows Autopatch groups experience (public preview) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-status-report.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-status-report.md index 4cd9aa18af..95503c7a43 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-status-report.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-status-report.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: adnich +ms.collection: + - highpri + - tier1 --- # Quality update status report (public preview) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-summary-dashboard.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-summary-dashboard.md index 31ca5e6fac..0b114fc081 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-summary-dashboard.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-summary-dashboard.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: adnich +ms.collection: + - highpri + - tier1 --- # Windows quality update summary dashboard (public preview) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-trending-report.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-trending-report.md index 935bb616af..263cf79726 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-trending-report.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-trending-report.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: adnich +ms.collection: + - highpri + - tier1 --- # Quality update trending report (public preview) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-update.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-update.md index 7d03bd8c1e..0158ab6b84 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-update.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-update.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: rekhanr +ms.collection: + - highpri + - tier1 --- # Customize Windows Update settings: Autopatch groups experience (public preview) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-microsoft-365-apps-enterprise.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-microsoft-365-apps-enterprise.md index 43d2a3e596..3fc4df2cbb 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-microsoft-365-apps-enterprise.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-microsoft-365-apps-enterprise.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: hathind +ms.collection: + - highpri + - tier1 --- # Microsoft 365 Apps for enterprise diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-policy-health-and-remediation.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-policy-health-and-remediation.md index 8e4b4794f4..6e004039fb 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-policy-health-and-remediation.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-policy-health-and-remediation.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: rekhanr +ms.collection: + - highpri + - tier1 --- # Policy health and remediation (public preview) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-support-request.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-support-request.md index 29e95ec21f..690e61a507 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-support-request.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-support-request.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: hathind +ms.collection: + - highpri + - tier1 --- # Submit a support request diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-teams.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-teams.md index b348eca592..5c0649bc8e 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-teams.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-teams.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: hathind +ms.collection: + - highpri + - tier1 --- # Microsoft Teams diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-unenroll-tenant.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-unenroll-tenant.md index 8a69ef3f78..1269f66d0f 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-unenroll-tenant.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-unenroll-tenant.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: hathind +ms.collection: + - highpri + - tier1 --- # Unenroll your tenant diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-update-management.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-update-management.md index 3c850cf312..ab0e071954 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-update-management.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-update-management.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: andredm7 +ms.collection: + - highpri + - tier1 --- # Software update management diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-end-user-exp.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-end-user-exp.md index cdbcde747d..8d7c6c6f7f 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-end-user-exp.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-end-user-exp.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: hathind +ms.collection: + - highpri + - tier1 --- # Windows feature update end user experience diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md index 95b3391bd5..1ffb5c25f5 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: andredm7 +ms.collection: + - highpri + - tier1 --- # Windows feature updates diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-all-devices-historical-report.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-all-devices-historical-report.md index f48428da15..4ed33aeb7b 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-all-devices-historical-report.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-all-devices-historical-report.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: adnich +ms.collection: + - highpri + - tier1 --- # All devices report—historical diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-all-devices-report.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-all-devices-report.md index a89b5943b8..0b3850461e 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-all-devices-report.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-all-devices-report.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: adnich +ms.collection: + - highpri + - tier1 --- # All devices report diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-communications.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-communications.md index f715f1bba8..a78cbd870b 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-communications.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-communications.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: hathind +ms.collection: + - highpri + - tier1 --- # Windows quality update communications diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-eligible-devices-historical-report.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-eligible-devices-historical-report.md index f3d6012c50..e0b0cbe8a7 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-eligible-devices-historical-report.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-eligible-devices-historical-report.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: adnich +ms.collection: + - highpri + - tier1 --- # Eligible devices report—historical diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-end-user-exp.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-end-user-exp.md index 1a345f2942..ed6b572591 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-end-user-exp.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-end-user-exp.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: hathind +ms.collection: + - highpri + - tier1 --- # Windows quality update end user experience diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-ineligible-devices-historical-report.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-ineligible-devices-historical-report.md index 330088a5e0..57d6dc58ab 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-ineligible-devices-historical-report.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-ineligible-devices-historical-report.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: adnich +ms.collection: + - highpri + - tier1 --- # Ineligible devices report—historical diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md index f12b686427..da8c85bcff 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: andredm7 +ms.collection: + - highpri + - tier1 --- # Windows quality updates diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-reports-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-reports-overview.md index c3ea51727d..bf724acb41 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-reports-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-reports-overview.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: adnich +ms.collection: + - highpri + - tier1 --- # Windows quality update reports diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-signals.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-signals.md index bd21b2a994..7f42913f96 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-signals.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-signals.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: hathind +ms.collection: + - highpri + - tier1 --- # Windows quality update signals diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-summary-dashboard.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-summary-dashboard.md index 95dd437451..8d1587ce8e 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-summary-dashboard.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-summary-dashboard.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: adnich +ms.collection: + - highpri + - tier1 --- # Summary dashboard diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-update.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-update.md index 50453deea1..e7272739f3 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-update.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-update.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: rekhanr +ms.collection: + - highpri + - tier1 --- # Customize Windows Update settings (public preview) diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml b/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml index 7eaead607a..49693cb754 100644 --- a/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml +++ b/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml @@ -34,7 +34,7 @@ sections: Windows Autopatch doesn't support local (on-premise) domain join. Windows Autopatch supports [Hybrid AD join](/azure/active-directory/devices/concept-azure-ad-join-hybrid) or pure [Azure AD join](/azure/active-directory/devices/concept-azure-ad-join-hybrid). - question: Will Windows Autopatch be available for state and local government customers? answer: | - Windows Autopatch is available for all Windows E3 customers using Azure commercial cloud. However, Autopatch isn't currently supported for government cloud (GCC) customers. + Windows Autopatch is available for all Windows E3 customers using Azure commercial cloud. However, Autopatch isn't currently supported for government cloud (GCC) customers. Although Windows 365 Enterprise is in the Azure Commercial cloud, when Windows 365 Enterprise is used with a GCC customer tenant, Autopatch is not suppported. - question: What if I enrolled into Windows Autopatch using the promo code? Will I still have access to the service? answer: | Yes. For those who used the promo code to access Windows Autopatch during public preview, you'll continue to have access to Windows Autopatch even when the promo code expires. There's no additional action you have to take to continue using Windows Autopatch. diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-overview.md b/windows/deployment/windows-autopatch/overview/windows-autopatch-overview.md index c515617ae7..64554cdd1f 100644 --- a/windows/deployment/windows-autopatch/overview/windows-autopatch-overview.md +++ b/windows/deployment/windows-autopatch/overview/windows-autopatch-overview.md @@ -11,7 +11,7 @@ ms.author: tiaraquan manager: dougeby ms.collection: - highpri - - tier2 + - tier1 ms.reviewer: hathind --- diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-privacy.md b/windows/deployment/windows-autopatch/overview/windows-autopatch-privacy.md index a04a060c4c..0ce2010fe7 100644 --- a/windows/deployment/windows-autopatch/overview/windows-autopatch-privacy.md +++ b/windows/deployment/windows-autopatch/overview/windows-autopatch-privacy.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: hathind +ms.collection: + - highpri + - tier1 --- # Privacy diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-roles-responsibilities.md b/windows/deployment/windows-autopatch/overview/windows-autopatch-roles-responsibilities.md index 3525a20488..e32bf9efd7 100644 --- a/windows/deployment/windows-autopatch/overview/windows-autopatch-roles-responsibilities.md +++ b/windows/deployment/windows-autopatch/overview/windows-autopatch-roles-responsibilities.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: hathind +ms.collection: + - highpri + - tier1 --- # Roles and responsibilities diff --git a/windows/deployment/windows-autopatch/prepare/windows-autopatch-configure-network.md b/windows/deployment/windows-autopatch/prepare/windows-autopatch-configure-network.md index e223d515a4..3813ee70ef 100644 --- a/windows/deployment/windows-autopatch/prepare/windows-autopatch-configure-network.md +++ b/windows/deployment/windows-autopatch/prepare/windows-autopatch-configure-network.md @@ -10,6 +10,8 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: hathind +ms.collection: + - tier2 --- # Configure your network diff --git a/windows/deployment/windows-autopatch/prepare/windows-autopatch-enroll-tenant.md b/windows/deployment/windows-autopatch/prepare/windows-autopatch-enroll-tenant.md index 4ca771cece..afe28158bc 100644 --- a/windows/deployment/windows-autopatch/prepare/windows-autopatch-enroll-tenant.md +++ b/windows/deployment/windows-autopatch/prepare/windows-autopatch-enroll-tenant.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: hathind +ms.collection: + - highpri + - tier1 --- # Enroll your tenant @@ -30,7 +33,7 @@ To start using the Windows Autopatch service, ensure you meet the [Windows Autop > [!IMPORTANT] > The online Readiness assessment tool helps you check your readiness to enroll in Windows Autopatch for the first time. Once you enroll, you'll no longer be able to access the tool again. -The Readiness assessment tool checks the settings in [Microsoft Intune](#microsoft-intune-settings) and [Azure Active Directory](#azure-active-directory-settings) (Azure AD) to ensure they'll work with Windows Autopatch. We aren't, however, checking the workloads in Configuration Manager necessary for Windows Autopatch. For more information about workload prerequisites, see [Configuration Manager co-management requirements](../prepare/windows-autopatch-prerequisites.md#configuration-manager-co-management-requirements). +The Readiness assessment tool checks the settings in [Microsoft Intune](#microsoft-intune-settings) and [Azure Active Directory](#azure-active-directory-settings) (Azure AD) to ensure the settings work with Windows Autopatch. We aren't, however, checking the workloads in Configuration Manager necessary for Windows Autopatch. For more information about workload prerequisites, see [Configuration Manager co-management requirements](../prepare/windows-autopatch-prerequisites.md#configuration-manager-co-management-requirements). **To access and run the Readiness assessment tool:** @@ -64,13 +67,13 @@ The following are the Azure Active Directory settings: ### Check results -For each check, the tool will report one of four possible results: +For each check, the tool reports one of four possible results: | Result | Meaning | | ----- | ----- | | Ready | No action is required before completing enrollment. | | Advisory | Follow the steps in the tool or this article for the best experience with enrollment and for users.

You can complete enrollment, but you must fix these issues before you deploy your first device. | -| Not ready | You must fix these issues before enrollment. You won’t be able to enroll into Windows Autopatch if you don't fix these issues. Follow the steps in the tool or this article to resolve them. | +| Not ready | You must fix these issues before enrollment. You can't enroll into Windows Autopatch if you don't fix these issues. Follow the steps in the tool or this article to resolve them. | | Error | The Azure Active Directory (AD) role you're using doesn't have sufficient permissions to run this check. | ## Step 3: Fix issues with your tenant @@ -86,11 +89,11 @@ Once the Readiness assessment tool provides you with a "Ready" result, you're re **To enroll your tenant:** -Within the Readiness assessment tool, you'll now see the **Enroll** button. By selecting **Enroll**, you'll kick off the enrollment of your tenant to the Windows Autopatch service. During the enrollment workflow, you'll see the following: +Within the Readiness assessment tool, you can see the **Enroll** button. By selecting **Enroll**, you start the enrollment process of your tenant into the Windows Autopatch service. During the enrollment workflow, you see the following: - Consent workflow to manage your tenant. - Provide Windows Autopatch with IT admin contacts. -- Setup of the Windows Autopatch service on your tenant. This step is where we'll create the policies, groups and accounts necessary to run the service. +- Setup of the Windows Autopatch service on your tenant. This step is where we create the policies, groups and accounts necessary to run the service. Once these actions are complete, you've now successfully enrolled your tenant. @@ -101,7 +104,7 @@ Once these actions are complete, you've now successfully enrolled your tenant. You can choose to delete the data we collect directly within the Readiness assessment tool. -Windows Autopatch retains the data associated with these checks for 12 months after the last time you ran a check in your Azure Active Directory organization (tenant). After 12 months, we retain the data in a de-identified form. +Windows Autopatch retains the data associated with these checks for 12 months after the last time you ran a check in your Azure Active Directory organization (tenant). After 12 months, we retain the data in a deidentified form. > [!NOTE] > Windows Autopatch will only delete the results we collect within the Readiness assessment tool; Autopatch won't delete any other tenant-level data. diff --git a/windows/deployment/windows-autopatch/prepare/windows-autopatch-enrollment-support-request.md b/windows/deployment/windows-autopatch/prepare/windows-autopatch-enrollment-support-request.md index c36d207090..6588ea5a13 100644 --- a/windows/deployment/windows-autopatch/prepare/windows-autopatch-enrollment-support-request.md +++ b/windows/deployment/windows-autopatch/prepare/windows-autopatch-enrollment-support-request.md @@ -10,6 +10,8 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: hathind +ms.collection: + - tier2 --- # Submit a tenant enrollment support request diff --git a/windows/deployment/windows-autopatch/prepare/windows-autopatch-fix-issues.md b/windows/deployment/windows-autopatch/prepare/windows-autopatch-fix-issues.md index 413d997112..39f30591e9 100644 --- a/windows/deployment/windows-autopatch/prepare/windows-autopatch-fix-issues.md +++ b/windows/deployment/windows-autopatch/prepare/windows-autopatch-fix-issues.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: hathind +ms.collection: + - highpri + - tier1 --- # Fix issues found by the Readiness assessment tool @@ -21,13 +24,13 @@ Seeing issues with your tenant? This article details how to remediate issues fou ## Check results -For each check, the tool will report one of four possible results: +For each check, the tool reports one of four possible results: | Result | Meaning | | ----- | ----- | | Ready | No action is required before completing enrollment. | | Advisory | Follow the steps in the tool or this article for the best experience with enrollment and for users.

You can complete enrollment, but you must fix these issues before you deploy your first device. | -| Not ready | You must fix these issues before enrollment. You won’t be able to enroll into Windows Autopatch if you don't fix these issues. Follow the steps in the tool or this article to resolve them. | +| Not ready | You must fix these issues before enrollment. You can't enroll into Windows Autopatch if you don't fix these issues. Follow the steps in the tool or this article to resolve them. | | Error | The Azure Active Directory (AD) role you're using doesn't have sufficient permission to run this check or your tenant isn't properly licensed for Microsoft Intune. | > [!NOTE] @@ -43,7 +46,7 @@ Your "Update rings for Windows 10 or later" policy in Intune must not target any | Result | Meaning | | ----- | ----- | -| Advisory | You have an "update ring" policy that targets all devices, all users, or both. Windows Autopatch will also create our own update ring policies during enrollment. To avoid conflicts with Windows Autopatch devices, we'll exclude our devices group from your existing update ring policies that target all devices, all users, or both. You must consent to this change when you go to enroll your tenant.

| +| Advisory | You have an "update ring" policy that targets all devices, all users, or both. Windows Autopatch creates our own update ring policies during enrollment. To avoid conflicts with Windows Autopatch devices, we exclude our devices group from your existing update ring policies that target all devices, all users, or both. You must consent to this change when you go to enroll your tenant.

| ## Azure Active Directory settings diff --git a/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md b/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md index 1808dd285c..90e7324a39 100644 --- a/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md +++ b/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: hathind +ms.collection: + - highpri + - tier1 --- # Prerequisites diff --git a/windows/deployment/windows-autopatch/references/windows-autopatch-changes-to-tenant.md b/windows/deployment/windows-autopatch/references/windows-autopatch-changes-to-tenant.md index a1fd2c87e2..458dcd3ff1 100644 --- a/windows/deployment/windows-autopatch/references/windows-autopatch-changes-to-tenant.md +++ b/windows/deployment/windows-autopatch/references/windows-autopatch-changes-to-tenant.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: hathind +ms.collection: + - highpri + - tier1 --- # Changes made at tenant enrollment diff --git a/windows/deployment/windows-autopatch/references/windows-autopatch-groups-public-preview-addendum.md b/windows/deployment/windows-autopatch/references/windows-autopatch-groups-public-preview-addendum.md index 29795eceb9..ed57ff6eee 100644 --- a/windows/deployment/windows-autopatch/references/windows-autopatch-groups-public-preview-addendum.md +++ b/windows/deployment/windows-autopatch/references/windows-autopatch-groups-public-preview-addendum.md @@ -10,6 +10,9 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: andredm7 +ms.collection: + - highpri + - tier1 --- # Windows Autopatch groups Public Preview Addendum diff --git a/windows/deployment/windows-autopatch/references/windows-autopatch-microsoft-365-policies.md b/windows/deployment/windows-autopatch/references/windows-autopatch-microsoft-365-policies.md index e8e54695c8..79d1bbc912 100644 --- a/windows/deployment/windows-autopatch/references/windows-autopatch-microsoft-365-policies.md +++ b/windows/deployment/windows-autopatch/references/windows-autopatch-microsoft-365-policies.md @@ -10,13 +10,15 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: hathind +ms.collection: + - tier2 --- # Microsoft 365 Apps for enterprise update policies ## Conflicting and unsupported policies -Deploying any of the following policies to a managed device will make that device ineligible for management since the device will prevent us from delivering the service as designed. +Deploying any of the following policies to a managed device makes that device ineligible for management since the device prevents us from delivering the service as designed. ### Update policies diff --git a/windows/deployment/windows-autopatch/references/windows-autopatch-windows-update-unsupported-policies.md b/windows/deployment/windows-autopatch/references/windows-autopatch-windows-update-unsupported-policies.md index 01ddeb4f2e..9ece385c03 100644 --- a/windows/deployment/windows-autopatch/references/windows-autopatch-windows-update-unsupported-policies.md +++ b/windows/deployment/windows-autopatch/references/windows-autopatch-windows-update-unsupported-policies.md @@ -10,13 +10,15 @@ author: tiaraquan ms.author: tiaraquan manager: dougeby ms.reviewer: adnich +ms.collection: + - tier2 --- # Windows update policies ## Deployment rings for Windows 10 and later -The following policies contain settings which apply to both Windows quality and feature updates. After onboarding there will be four of these policies in your tenant with the following naming convention: +The following policies contain settings that apply to both Windows quality and feature updates. After onboarding there will be four of these policies in your tenant with the following naming convention: **Modern Workplace Update Policy [ring name] – [Windows Autopatch]** @@ -44,7 +46,7 @@ The following policies contain settings which apply to both Windows quality and | Deadline for Windows feature updates | 5 | 5 | 5 | 5 | | Deadline for Windows quality updates | 0 | 2 | 2 | 5 | | Grace period | 0 | 2 | 2 | 2 | -| Auto-restart before deadline | Yes | Yes | Yes | Yes | +| Auto restart before deadline | Yes | Yes | Yes | Yes | ### Windows 10 and later assignments @@ -59,7 +61,7 @@ The service deploys policies using Microsoft Intune to control how Windows featu ### Windows feature updates for Windows 10 and later -These policies control the minimum target version of Windows which a device is meant to accept. Throughout the rest of the article, you will see these policies referred to as DSS policies. After onboarding there will be four of these policies in your tenant with the following naming convention: +These policies control the minimum target version of Windows that a device is meant to accept. Throughout the rest of the article, these policies are referred to as DSS policies. After onboarding, there will be four of these policies in your tenant with the following naming convention: **Modern Workplace DSS Policy [ring name]** @@ -79,7 +81,7 @@ These policies control the minimum target version of Windows which a device is m #### Windows 11 testing -To allow customers to test Windows 11 in their environment, there's a separate DSS policy which enables you to test Windows 11 before broadly adopting within your environment. +To allow customers to test Windows 11 in their environment, there's a separate DSS policy that enables you to test Windows 11 before broadly adopting within your environment. ##### Windows 11 deployment setting @@ -97,11 +99,11 @@ To allow customers to test Windows 11 in their environment, there's a separate D ## Conflicting and unsupported policies -Deploying any of the following policies to a Windows Autopatch device will make that device ineligible for management since the device will prevent us from delivering the service as designed. +Deploying any of the following policies to a Windows Autopatch device makes that device ineligible for management since the device prevents us from delivering the service as designed. ### Update policies -Window Autopatch deploys mobile device management (MDM) policies to configure devices and requires a specific configuration. If any policies from the [Update Policy CSP](/windows/client-management/mdm/policy-csp-update) are deployed to devices that aren't on the permitted list, those devices will be excluded from management. +Window Autopatch deploys mobile device management (MDM) policies to configure devices and requires a specific configuration. If any policies from the [Update Policy CSP](/windows/client-management/mdm/policy-csp-update) are deployed to devices that aren't on the permitted list, those devices are excluded from management. | Allowed policy | Policy CSP | Description | | ----- | ----- | ----- | @@ -111,7 +113,7 @@ Window Autopatch deploys mobile device management (MDM) policies to configure de ### Group policy and other policy managers -Group policy as well as other policy managers can take precedence over mobile device management (MDM) policies. For Windows quality updates, if any policies or configurations are detected which modify the following hives in the registry, the device could become ineligible for management: +Group policy and other policy managers can take precedence over mobile device management (MDM) policies. For Windows quality updates, if any policies or configurations are detected which modify the following hives in the registry, the device could become ineligible for management: - `HKLM\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\PolicyState` - `HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate` diff --git a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md index b4fb65849a..5c1516e429 100644 --- a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md +++ b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md @@ -1,7 +1,7 @@ --- title: What's new 2023 description: This article lists the 2023 feature releases and any corresponding Message center post numbers. -ms.date: 05/15/2023 +ms.date: 06/12/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: whats-new @@ -51,6 +51,12 @@ Minor corrections such as typos, style, or formatting issues aren't listed. | [Policy health and remediation](../operate/windows-autopatch-policy-health-and-remediation.md) | Add new Policy health and remediation feature. This feature is in public preview | | [Windows Autopatch groups public preview addendum](../references/windows-autopatch-groups-public-preview-addendum.md) | Added addendum for the Windows Autopatch groups public preview | +## May service release + +| Message center post number | Description | +| ----- | ----- | +| [MC559247](https://admin.microsoft.com/adminportal/home#/MessageCenter) | May 2023 Windows Autopatch baseline configuration update | + ## April 2023 ### April feature releases or updates @@ -59,7 +65,7 @@ Minor corrections such as typos, style, or formatting issues aren't listed. | ----- | ----- | | [Changes made at tenant enrollment](../references/windows-autopatch-changes-to-tenant.md) | Updated the [Deployment rings for Windows 10 and later](../references/windows-autopatch-changes-to-tenant.md#deployment-rings-for-windows-10-and-later) section | -### April 2023 service release +### April service release | Message center post number | Description | | ----- | ----- | diff --git a/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-configure-using-wsb-file.md b/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-configure-using-wsb-file.md index a0d3dc4bea..888bca39ce 100644 --- a/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-configure-using-wsb-file.md +++ b/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-configure-using-wsb-file.md @@ -156,14 +156,16 @@ Supported values: ### Protected client -Applies more security settings to the sandbox Remote Desktop client, decreasing its attack surface. +When Protected Client mode is enabled, Sandbox adds a new layer of security boundary by running inside an [AppContainer Isolation](/windows/win32/secauthz/appcontainer-isolation) execution environment. + +AppContainer Isolation provides Credential, Device, File, Network, Process, and Window isolation. `value` Supported values: -- *Enable*: Runs Windows sandbox in Protected Client mode. If this value is set, the sandbox runs with extra security mitigations enabled. -- *Disable*: Runs the sandbox in standard mode without extra security mitigations. +- *Enable*: Runs Windows sandbox in Protected Client mode. If this value is set, the Sandbox runs in AppContainer Isolation. +- *Disable*: Runs the Sandbox in the standard mode without extra security mitigations. - *Default*: This value is the default value for Protected Client mode. Currently, this default value denotes that the sandbox doesn't run in Protected Client mode. > [!NOTE] diff --git a/windows/security/threat-protection/windows-defender-application-control/AppIdTagging/design-create-appid-tagging-policies.md b/windows/security/threat-protection/windows-defender-application-control/AppIdTagging/design-create-appid-tagging-policies.md index 9bce0c01fd..0ed35d4d57 100644 --- a/windows/security/threat-protection/windows-defender-application-control/AppIdTagging/design-create-appid-tagging-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/AppIdTagging/design-create-appid-tagging-policies.md @@ -35,9 +35,14 @@ You can use the Windows Defender Application Control (WDAC) Wizard and the Power 1. Create a new base policy using the templates: - Start with the Policy Creator task and select Multiple Policy Format and Base Policy. Select the Base Template to use for the policy. The example below shows beginning with the [Default Windows Mode](../wdac-wizard-create-base-policy.md#template-base-policies) template and build on top of these rules. + Start with the Policy Creator task and select Multiple Policy Format and Base Policy. Select the Base Template to use for the policy. The following example shows beginning with the [Default Windows Mode](../wdac-wizard-create-base-policy.md#template-base-policies) template and build on top of these rules. ![Configuring the policy base and template.](../images/appid-wdac-wizard-1.png) + + > [!NOTE] + > If your AppId Tagging Policy does build off the base templates or does not allow Windows in-box processes, you will notice significant performance regressions, especially during boot. For this reason, it is strongly recommended to build off the base templates. + For more information on the issue, see the [AppId Tagging Known Issue](../operations/known-issues.md#slow-boot-and-performance-with-custom-policies). + 2. Set the following rule-options using the Wizard toggles: @@ -45,7 +50,7 @@ You can use the Windows Defender Application Control (WDAC) Wizard and the Power 3. Create custom rules: - Selecting the `+ Custom Rules` button will open the Custom Rules panel. The Wizard supports five types of file rules: + Selecting the `+ Custom Rules` button opens the Custom Rules panel. The Wizard supports five types of file rules: - Publisher rules: Create a rule based off the signing certificate hierarchy. Additionally, the original filename and version can be combined with the signing certificate for added security. - Path rules: Create a rule based off the path to a file or a parent folder path. Path rules support wildcards. @@ -58,16 +63,16 @@ You can use the Windows Defender Application Control (WDAC) Wizard and the Power 4. Convert to AppId Tagging Policy: - After the Wizard builds the policy file, open the file in a text editor and remove the entire "Value=131" SigningScenario text block. The only remaining signing scenario should be "Value=12" which is the usermode application section. Next, open PowerShell in an elevated prompt and run the following command. Replace the AppIdTagging Key-Value pair for your scenario: + After the Wizard builds the policy file, open the file in a text editor and remove the entire "Value=131" SigningScenario text block. The only remaining signing scenario should be "Value=12" which is the user mode application section. Next, open PowerShell in an elevated prompt and run the following command. Replace the AppIdTagging Key-Value pair for your scenario: ```powershell Set-CIPolicyIdInfo -ResetPolicyID -FilePath .\AppIdPolicy.xml -AppIdTaggingPolicy -AppIdTaggingKey "MyKey" -AppIdTaggingValue "MyValue" ``` - The policyID GUID will be returned by PowerShell if successful. + The policyID GUID is returned by the PowerShell command if successful. ## Create the policy using PowerShell -Using this method, you'll create an AppId Tagging policy directly using the WDAC PowerShell commands. These PowerShell commands are only available on the supported platforms listed in [AppId Tagging Guide](./windows-defender-application-control-appid-tagging-guide.md). In an elevate PowerShell instance: +Using this method, you create an AppId Tagging policy directly using the WDAC PowerShell commands. These PowerShell commands are only available on the supported platforms listed in [AppId Tagging Guide](./windows-defender-application-control-appid-tagging-guide.md). In an elevate PowerShell instance: 1. Create an AppId rule for the policy based on a combination of the signing certificate chain and version of the application. In the example below, the level has been set to SignedVersion. Any of the [WDAC File Rule Levels](../select-types-of-rules-to-create.md#table-2-windows-defender-application-control-policy---file-rule-levels) can be used in AppId rules: @@ -87,14 +92,14 @@ Using this method, you'll create an AppId Tagging policy directly using the WDAC Set-RuleOption -Option 18 .\AppIdPolicy.xml # (Optional) Disable FilePath Rule Protection ``` - If you're using filepath rules, you'll likely want to set option 18. Otherwise, there's no need. + If you're using filepath rules, you may want to set option 18. Otherwise, there's no need. 4. Set the name and ID on the policy, which is helpful for future debugging: ```powershell Set-CIPolicyIdInfo -ResetPolicyId -PolicyName "MyPolicyName" -PolicyId "MyPolicyId"" -AppIdTaggingPolicy -FilePath ".\AppIdPolicy.xml" ``` - The policyID GUID will be returned by PowerShell if successful. + The policyID GUID is returned by the PowerShell command if successful. ## Deploy for Local Testing diff --git a/windows/security/threat-protection/windows-defender-application-control/images/known-issue-appid-dll-rule-xml.png b/windows/security/threat-protection/windows-defender-application-control/images/known-issue-appid-dll-rule-xml.png new file mode 100644 index 0000000000..817c745bd8 Binary files /dev/null and b/windows/security/threat-protection/windows-defender-application-control/images/known-issue-appid-dll-rule-xml.png differ diff --git a/windows/security/threat-protection/windows-defender-application-control/images/known-issue-appid-dll-rule.png b/windows/security/threat-protection/windows-defender-application-control/images/known-issue-appid-dll-rule.png new file mode 100644 index 0000000000..66a137086a Binary files /dev/null and b/windows/security/threat-protection/windows-defender-application-control/images/known-issue-appid-dll-rule.png differ diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md index e8331a7fcf..3b7f22c1df 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md @@ -8,7 +8,7 @@ author: jsuther1974 ms.reviewer: jgeurten ms.author: vinpa manager: aaroncz -ms.date: 11/04/2022 +ms.date: 06/14/2023 ms.topic: reference --- @@ -25,7 +25,7 @@ ms.topic: reference Members of the security community* continuously collaborate with Microsoft to help protect customers. With the help of their valuable reports, Microsoft has identified a list of valid applications that an attacker could also potentially use to bypass WDAC. -Unless your use scenarios explicitly require them, Microsoft recommends that you block the following applications. These applications or files can be used by an attacker to circumvent application allow policies, including WDAC: +Unless your use scenarios explicitly require them, Microsoft recommends that you block the following applications. An attacker can use these applications or files to circumvent application allow policies, including WDAC: - addinprocess.exe - addinprocess32.exe @@ -72,7 +72,7 @@ Unless your use scenarios explicitly require them, Microsoft recommends that you 1 A vulnerability in bginfo.exe was fixed in version 4.22. If you use BGInfo, for security, make sure to download and run the latest version of [BGInfo](/sysinternals/downloads/bginfo). BGInfo versions earlier than 4.22 are still vulnerable and should be blocked. -2 If you're using your reference system in a development context and use msbuild.exe to build managed applications, we recommend that you allow msbuild.exe in your code integrity policies. However, if your reference system is an end-user device that isn't being used in a development context, we recommend that you block msbuild.exe. +2 If you're using your reference system in a development context and use msbuild.exe to build managed applications, we recommend that you allow msbuild.exe in your code integrity policies. Otherwise, we recommend that you block msbuild.exe. * Microsoft recognizes the efforts of people in the security community who help us protect customers through responsible vulnerability disclosure, and extends thanks to the following people: @@ -99,9 +99,9 @@ Unless your use scenarios explicitly require them, Microsoft recommends that you > [!NOTE] > This application list will be updated with the latest vendor information as application vulnerabilities are resolved and new issues are discovered. -Certain software applications may allow other code to run by design. Such applications should be blocked by your WDAC policy. In addition, when an application version is upgraded to fix a security vulnerability or potential WDAC bypass, you should add *deny* rules to your application control policies for that application’s previous, less secure versions. +Certain software applications may allow other code to run by design. Unless these applications are business critical, you should block them in your WDAC policy. In addition, when an application version is upgraded to fix a security vulnerability or potential WDAC bypass, add *deny* rules to your application control policies for that application’s previous, less secure versions. -Microsoft recommends that you install the latest security updates. For example, updates help resolve several issues in PowerShell modules that allowed an attacker to bypass WDAC. These modules can't be blocked by name or version, and therefore must be blocked by their corresponding hashes. +Microsoft recommends that you install the latest security updates. For example, updates help resolve several issues in PowerShell modules that allowed an attacker to bypass WDAC. These modules can be blocked by their corresponding hashes. As of October 2017, system.management.automation.dll is updated to revoke earlier versions by hash values, instead of version rules. @@ -111,14 +111,14 @@ If you wish to use this blocklist policy on Windows Server 2016, locate the deny - msxml6.dll - jscript9.dll -The blocklist policy below includes "Allow all" rules for both kernel and user mode that make it safe to deploy as a standalone WDAC policy. On Windows versions 1903 and above, Microsoft recommends converting this policy to multiple policy format using the *Set-CiPolicyIdInfo* cmdlet with the *-ResetPolicyId* switch. Then, you can deploy it as a Base policy side-by-side with any other policies in your environment. To instead add these rules to an existing Base policy, you can merge the policy below using the *Merge-CIPolicy* cmdlet. If merging into an existing policy that includes an explicit allowlist, you should first remove the two "Allow all" rules and their corresponding FileRuleRefs from the sample policy below. +The blocklist policy that follows includes "Allow all" rules for both kernel and user mode that make it safe to deploy as a standalone WDAC policy. On Windows versions 1903 and above, Microsoft recommends converting this policy to multiple policy format using the *Set-CiPolicyIdInfo* cmdlet with the *-ResetPolicyId* switch. Then, you can deploy it as a Base policy side-by-side with any other policies in your environment. To instead add these rules to an existing Base policy, you can merge the policy that follows using the *Merge-CIPolicy* cmdlet. If merging into an existing policy that includes an explicit allowlist, you should first remove the two "Allow all" rules and their corresponding FileRuleRefs from the blocklist policy. **WDAC policy XML**: ```xml - 10.1.0.0 + 10.1.0.2 {A244370E-44C9-4C06-B551-F6016E563076} {2E07F7E4-194C-4D20-B7C9-6F44A6C5A234} @@ -159,6 +159,14 @@ The blocklist policy below includes "Allow all" rules for both kernel and user m + + + + + + + + @@ -1500,6 +1508,14 @@ The blocklist policy below includes "Allow all" rules for both kernel and user m + + + + + + + + @@ -1507,6 +1523,18 @@ The blocklist policy below includes "Allow all" rules for both kernel and user m 0 + + + + Microsoft Windows Recommended User Mode BlockList + + + + + 10.1.0.2 + + + ``` diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md index 4e14b5c0f4..232ca50f2f 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md @@ -100,7 +100,7 @@ To check that the policy was successfully applied on your computer: ```xml - 10.0.25873.0 + 10.0.25880.0 {2E07F7E4-194C-4D20-B7C9-6F44A6C5A234} @@ -221,10 +221,10 @@ To check that the policy was successfully applied on your computer: - - - - + + + + @@ -377,6 +377,12 @@ To check that the policy was successfully applied on your computer: + + + + + + @@ -541,6 +547,28 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + + + + + + + + + + + @@ -583,6 +611,56 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -690,18 +768,18 @@ To check that the policy was successfully applied on your computer: - - - - - - - - - - - - + + + + + + + + + + + + @@ -980,31 +1058,38 @@ To check that the policy was successfully applied on your computer: - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -1031,16 +1116,48 @@ To check that the policy was successfully applied on your computer: - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -1062,6 +1179,7 @@ To check that the policy was successfully applied on your computer: + @@ -1070,11 +1188,14 @@ To check that the policy was successfully applied on your computer: + + + @@ -1088,11 +1209,13 @@ To check that the policy was successfully applied on your computer: + + @@ -1101,10 +1224,12 @@ To check that the policy was successfully applied on your computer: + + @@ -1128,6 +1253,10 @@ To check that the policy was successfully applied on your computer: + + + + @@ -1136,6 +1265,7 @@ To check that the policy was successfully applied on your computer: + @@ -1149,6 +1279,9 @@ To check that the policy was successfully applied on your computer: + + + @@ -1166,7 +1299,7 @@ To check that the policy was successfully applied on your computer: - + @@ -1177,6 +1310,8 @@ To check that the policy was successfully applied on your computer: + + @@ -1198,6 +1333,9 @@ To check that the policy was successfully applied on your computer: + + + @@ -1254,12 +1392,14 @@ To check that the policy was successfully applied on your computer: + + @@ -1268,10 +1408,13 @@ To check that the policy was successfully applied on your computer: + + + @@ -1279,10 +1422,12 @@ To check that the policy was successfully applied on your computer: + + @@ -1302,6 +1447,10 @@ To check that the policy was successfully applied on your computer: + + + + @@ -1363,6 +1512,7 @@ To check that the policy was successfully applied on your computer: + @@ -1619,13 +1769,34 @@ To check that the policy was successfully applied on your computer: - + + + + + + + + + + + + + + + + + + + + + - + + @@ -1635,8 +1806,8 @@ To check that the policy was successfully applied on your computer: - + @@ -1748,6 +1919,16 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + @@ -1828,6 +2009,18 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + @@ -1847,6 +2040,10 @@ To check that the policy was successfully applied on your computer: + + + + @@ -1905,6 +2102,7 @@ To check that the policy was successfully applied on your computer: + @@ -1912,8 +2110,10 @@ To check that the policy was successfully applied on your computer: + + @@ -1929,7 +2129,6 @@ To check that the policy was successfully applied on your computer: - @@ -1962,6 +2161,9 @@ To check that the policy was successfully applied on your computer: + + + @@ -2217,6 +2419,12 @@ To check that the policy was successfully applied on your computer: + + + + + + @@ -2369,6 +2577,28 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + + + + + + + + + + + @@ -2423,6 +2653,56 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -2531,18 +2811,18 @@ To check that the policy was successfully applied on your computer: - - - - - - - - - - - - + + + + + + + + + + + + @@ -2829,31 +3109,38 @@ To check that the policy was successfully applied on your computer: - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -2876,6 +3163,14 @@ To check that the policy was successfully applied on your computer: + + + + + + + + @@ -2886,6 +3181,30 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + + + + + + + + + + + + + @@ -2918,7 +3237,7 @@ To check that the policy was successfully applied on your computer: - 10.0.25873.0 + 10.0.25880.0 diff --git a/windows/security/threat-protection/windows-defender-application-control/operations/known-issues.md b/windows/security/threat-protection/windows-defender-application-control/operations/known-issues.md index a9c0d42e86..f6616e3bf0 100644 --- a/windows/security/threat-protection/windows-defender-application-control/operations/known-issues.md +++ b/windows/security/threat-protection/windows-defender-application-control/operations/known-issues.md @@ -95,3 +95,19 @@ As a workaround, download the MSI file and run it locally: ```console msiexec –i c:\temp\Windows10_Version_1511_ADMX.msi ``` +### Slow boot and performance with custom policies + +WDAC will evaluate all running processes, including inbox Windows processes. If policies don't build off the WDAC templates or don't trust the Windows signers, you'll see slower boot times, degraded performance and possibly boot issues. For these reasons, it's strongly recommended to build off the [WDAC base templates](../example-wdac-base-policies.md). + +#### AppId Tagging policy considerations + +If the AppId Tagging Policy wasn't built off the WDAC base templates or doesn't allow the Windows in-box signers, you'll notice a significant increase in boot times (~2 minutes). + +If you can't allowlist the Windows signers, or build off the WDAC base templates, it is strongly recommended to add the following rule to your policies to improve the performance: + +:::image type="content" source="../images/known-issue-appid-dll-rule.png" alt-text="Allow all dlls in the policy."::: + +:::image type="content" source="../images/known-issue-appid-dll-rule-xml.png" alt-text="Allow all dll files in the xml policy."::: + + +Since AppId Tagging policies evaluate but can't tag dll files, this rule will short circuit dll evaluation and improve evaluation performance. \ No newline at end of file diff --git a/windows/whats-new/deprecated-features.md b/windows/whats-new/deprecated-features.md index 073c3bf2f2..75692f13ab 100644 --- a/windows/whats-new/deprecated-features.md +++ b/windows/whats-new/deprecated-features.md @@ -1,7 +1,7 @@ --- title: Deprecated features in the Windows client description: Review the list of features that Microsoft is no longer developing in Windows 10 and Windows 11. -ms.date: 12/05/2022 +ms.date: 06/08/2023 ms.prod: windows-client ms.technology: itpro-fundamentals ms.localizationpriority: medium @@ -36,6 +36,7 @@ The features in this article are no longer being actively developed, and might b |Feature | Details and mitigation | Deprecation announced | | ----------- | --------------------- | ---- | +| Cortana in Windows | Cortana in Windows as a standalone app is deprecated. This change only impacts Cortana in Windows, and your productivity assistant, Cortana, will continue to be available in Outlook mobile, Teams mobile, Microsoft Teams display, and Microsoft Teams rooms. | June 2023 | | Microsoft Support Diagnostic Tool (MSDT) | [MSDT](/windows-server/administration/windows-commands/msdt) is deprecated and will be removed in a future release of Windows. MSDT is used to gather diagnostic data for analysis by support professionals. For more information, see [Resources for deprecated features](deprecated-features-resources.md) | January 2023 | | Universal Windows Platform (UWP) Applications for 32-bit Arm | This change is applicable only to devices with an Arm processor, for example Snapdragon processors from Qualcomm. If you have a PC built with a processor from Intel or AMD, this content is not applicable. If you are not sure which type of processor you have, check **Settings** > **System** > **About**.

Support for 32-bit Arm versions of applications will be removed in a future release of Windows 11. After this change, for the small number of applications affected, app features might be different and you might notice a difference in performance. For more technical details about this change, see [Update app architecture from Arm32 to Arm64](/windows/arm/arm32-to-arm64). | January 2023 | | Update Compliance | [Update Compliance](/windows/deployment/update/update-compliance-monitor), a cloud-based service for the Windows client, is no longer being developed. This service has been replaced with [Windows Update for Business reports](/windows/deployment/update/wufb-reports-overview), which provides reporting on client compliance with Microsoft updates from the Azure portal. | November 2022|