mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-13 05:47:23 +00:00
Merge pull request #8313 from MicrosoftDocs/release-windows-2305
[Hold May24 10AM] Release windows 2305
This commit is contained in:
Meghan Stewart
GitHub
commit
b64d68e8ca
@ -1,7 +1,7 @@
|
|||||||
---
|
---
|
||||||
title: Configure federated sign-in for Windows devices
|
title: Configure federated sign-in for Windows devices
|
||||||
description: Description of federated sign-in feature for the Education SKUs of Windows 11 and how to configure it via Intune or provisioning packages.
|
description: Description of federated sign-in feature for the Education SKUs of Windows 11 and how to configure it via Intune or provisioning packages.
|
||||||
ms.date: 04/24/2023
|
ms.date: 05/01/2023
|
||||||
ms.topic: how-to
|
ms.topic: how-to
|
||||||
appliesto:
|
appliesto:
|
||||||
- ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 11</a>
|
- ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 11</a>
|
||||||
@ -35,36 +35,45 @@ To implement federated sign-in, the following prerequisites must be met:
|
|||||||
|
|
||||||
- For a step-by-step guide on how to configure **Google Workspace** as an identity provider for Azure AD, see [Configure federation between Google Workspace and Azure AD](configure-aad-google-trust.md)
|
- For a step-by-step guide on how to configure **Google Workspace** as an identity provider for Azure AD, see [Configure federation between Google Workspace and Azure AD](configure-aad-google-trust.md)
|
||||||
- For a step-by-step guide on how to configure **Clever** as an identity provider for Azure AD, see [Setup guide for Badges into Windows and Azure AD][EXT-1]
|
- For a step-by-step guide on how to configure **Clever** as an identity provider for Azure AD, see [Setup guide for Badges into Windows and Azure AD][EXT-1]
|
||||||
1. Individual IdP accounts created: each user will require an account defined in the third-party IdP platform
|
1. Individual IdP accounts created: each user requires an account defined in the third-party IdP platform
|
||||||
1. Individual Azure AD accounts created: each user will require a matching account defined in Azure AD. These accounts are commonly created through automated solutions, for example:
|
1. Individual Azure AD accounts created: each user requires a matching account defined in Azure AD. These accounts are commonly created through automated solutions, for example:
|
||||||
- [School Data Sync (SDS)][SDS-1]
|
- [School Data Sync (SDS)][SDS-1]
|
||||||
- [Azure AD Connect sync][AZ-3] for environment with on-premises AD DS
|
- [Azure AD Connect sync][AZ-3] for environment with on-premises AD DS
|
||||||
- PowerShell scripts that call the [Microsoft Graph API][GRAPH-1]
|
- PowerShell scripts that call the [Microsoft Graph API][GRAPH-1]
|
||||||
- provisioning tools offered by the IdP
|
- provisioning tools offered by the IdP
|
||||||
|
|
||||||
For more information about identity matching, see [Identity matching in Azure AD](#identity-matching-in-azure-ad).
|
For more information about identity matching, see [Identity matching in Azure AD](#identity-matching-in-azure-ad).
|
||||||
1. Licenses assigned to the Azure AD user accounts. It's recommended to assign licenses to a dynamic group: when new users are provisioned in Azure AD, the licenses are automatically assigned. For more information, see [Assign licenses to users by group membership in Azure Active Directory][AZ-2]
|
1. Licenses assigned to the Azure AD user accounts. It's recommended to assign licenses to a dynamic group: when new users are provisioned in Azure AD, the licenses are automatically assigned. For more information, see [Assign licenses to users by group membership in Azure Active Directory][AZ-2]
|
||||||
1. Enable federated sign-in on the Windows devices
|
1. Enable federated sign-in on the Windows devices
|
||||||
|
|
||||||
To use federated sign-in, the devices must have Internet access. This feature won't work without it, as the authentication is done over the Internet.
|
To use federated sign-in, the devices must have Internet access. This feature doesn't work without it, as the authentication is done over the Internet.
|
||||||
|
|
||||||
> [!IMPORTANT]
|
> [!IMPORTANT]
|
||||||
> WS-Fed is the only supported federated protocol to join a device to Azure AD. If you have a SAML 2.0 IdP, it's recommended to complete the Azure AD join process using one of the following methods:
|
> WS-Fed is the only supported federated protocol to join a device to Azure AD. If you have a SAML 2.0 IdP, it's recommended to complete the Azure AD join process using one of the following methods:
|
||||||
> - provisioning packages (PPKG)
|
> - Provisioning packages (PPKG)
|
||||||
> - Windows Autopilot self-deploying mode
|
> - Windows Autopilot self-deploying mode
|
||||||
|
|
||||||
[!INCLUDE [federated-sign-in](../../includes/licensing/federated-sign-in.md)]
|
[!INCLUDE [federated-sign-in](../../includes/licensing/federated-sign-in.md)]
|
||||||
|
|
||||||
## System requirements
|
Federated sign-in for student assigned (1:1) devices is supported on the following Windows editions and versions:
|
||||||
|
|
||||||
Federated sign-in is supported on the following Windows editions and versions:
|
|
||||||
|
|
||||||
- Windows 11 SE, version 22H2 and later
|
- Windows 11 SE, version 22H2 and later
|
||||||
- Windows 11 Pro Edu/Education, version 22H2 with [KB5022913][KB-1]
|
- Windows 11 Pro Edu/Education, version 22H2 with [KB5022913][KB-1]
|
||||||
|
|
||||||
|
Federated sign-in for shared devices is supported starting in Windows 11 SE/Pro Edu/Education, version 22H2 with [KB5026446][KB-2].
|
||||||
|
|
||||||
## Configure federated sign-in
|
## Configure federated sign-in
|
||||||
|
|
||||||
To use web sign-in with a federated identity provider, your devices must be configured with different policies. Follow the instructions below to configure your devices using either Microsoft Intune or a provisioning package (PPKG).
|
You can configure federated sign-in for student assigned (1:1) devices or student shared devices:
|
||||||
|
|
||||||
|
- When federated sign-in is configured for **student assigned (1:1) devices**, the first user who signs in to the device with a federated identity becomes the *primary user*. The primary user is always displayed in the bottom left corner of the sign-in screen
|
||||||
|
- When federated sign-in is configured for **student shared devices**, there's no primary user. The sign-in screen displays, by default, the last user who signed in to the device
|
||||||
|
|
||||||
|
The configuration is different for each scenario, and is described in the following sections.
|
||||||
|
|
||||||
|
### Configure federated sign-in for student assigned (1:1) devices
|
||||||
|
|
||||||
|
To use web sign-in with a federated identity provider, your devices must be configured with different policies. Review the following instructions to configure your devices using either Microsoft Intune or a provisioning package (PPKG).
|
||||||
|
|
||||||
#### [:::image type="icon" source="images/icons/intune.svg"::: **Intune**](#tab/intune)
|
#### [:::image type="icon" source="images/icons/intune.svg"::: **Intune**](#tab/intune)
|
||||||
|
|
||||||
@ -74,9 +83,9 @@ To configure federated sign-in using Microsoft Intune, [create a custom profile]
|
|||||||
|
|
||||||
| Setting |
|
| Setting |
|
||||||
|--------|
|
|--------|
|
||||||
|
| <li> OMA-URI: **`./Vendor/MSFT/Policy/Config/Education/IsEducationEnvironment`** </li><li>Data type: **Integer** </li><li>Value: **1**</li>|
|
||||||
| <li> OMA-URI: **`./Vendor/MSFT/Policy/Config/FederatedAuthentication/EnableWebSignInForPrimaryUser`** </li><li>Data type: **Integer** </li><li>Value: **1**</li>|
|
| <li> OMA-URI: **`./Vendor/MSFT/Policy/Config/FederatedAuthentication/EnableWebSignInForPrimaryUser`** </li><li>Data type: **Integer** </li><li>Value: **1**</li>|
|
||||||
| <li> OMA-URI: **`./Vendor/MSFT/Policy/Config/Authentication/ConfigureWebSignInAllowedUrls`** </li><li>Data type: **String** </li><li>Value: Semicolon separated list of domains, for example: **`samlidp.clever.com;clever.com;mobile-redirector.clever.com`**</li>|
|
| <li> OMA-URI: **`./Vendor/MSFT/Policy/Config/Authentication/ConfigureWebSignInAllowedUrls`** </li><li>Data type: **String** </li><li>Value: Semicolon separated list of domains, for example: **`samlidp.clever.com;clever.com;mobile-redirector.clever.com`**</li>|
|
||||||
| <li> OMA-URI: **`./Vendor/MSFT/Policy/Config/Education/IsEducationEnvironment`** </li><li>Data type: **Integer** </li><li>Value: **1**</li>|
|
|
||||||
| <li> OMA-URI: **`./Vendor/MSFT/Policy/Config/Authentication/ConfigureWebCamAccessDomainNames`** </li><li>Data type: **String** </li><li>Value: This setting is optional, and it should be configured if you need to use the webcam during the sign-in process. Specify the list of domains that are allowed to use the webcam during the sign-in process, separated by a semicolon. For example: **`clever.com`**</li>|
|
| <li> OMA-URI: **`./Vendor/MSFT/Policy/Config/Authentication/ConfigureWebCamAccessDomainNames`** </li><li>Data type: **String** </li><li>Value: This setting is optional, and it should be configured if you need to use the webcam during the sign-in process. Specify the list of domains that are allowed to use the webcam during the sign-in process, separated by a semicolon. For example: **`clever.com`**</li>|
|
||||||
|
|
||||||
:::image type="content" source="images/federated-sign-in-settings-intune.png" alt-text="Custom policy showing the settings to be configured to enable federated sign-in" lightbox="images/federated-sign-in-settings-intune.png" border="true":::
|
:::image type="content" source="images/federated-sign-in-settings-intune.png" alt-text="Custom policy showing the settings to be configured to enable federated sign-in" lightbox="images/federated-sign-in-settings-intune.png" border="true":::
|
||||||
@ -90,14 +99,54 @@ To configure federated sign-in using a provisioning package, use the following s
|
|||||||
|
|
||||||
| Setting |
|
| Setting |
|
||||||
|--------|
|
|--------|
|
||||||
|
| <li> Path: **`Education/IsEducationEnvironment`** </li><li>Value: **Enabled**</li>|
|
||||||
| <li> Path: **`FederatedAuthentication/EnableWebSignInForPrimaryUser`** </li><li>Value: **Enabled**</li>|
|
| <li> Path: **`FederatedAuthentication/EnableWebSignInForPrimaryUser`** </li><li>Value: **Enabled**</li>|
|
||||||
| <li> Path: **`Policies/Authentication/ConfigureWebSignInAllowedUrls`** </li><li>Value: Semicolon separated list of domains, for example: **`samlidp.clever.com;clever.com;mobile-redirector.clever.com`**</li>|
|
| <li> Path: **`Policies/Authentication/ConfigureWebSignInAllowedUrls`** </li><li>Value: Semicolon separated list of domains, for example: **`samlidp.clever.com;clever.com;mobile-redirector.clever.com`**</li>|
|
||||||
| <li> Path: **`Policies/Education/IsEducationEnvironment`** </li><li>Value: **Enabled**</li>|
|
|
||||||
| <li> Path: **`Policies/Authentication/ConfigureWebCamAccessDomainNames`** </li><li>Value: This setting is optional, and it should be configured if you need to use the webcam during the sign-in process. Specify the list of domains that are allowed to use the webcam during the sign-in process, separated by a semicolon. For example: **`clever.com`**</li>|
|
| <li> Path: **`Policies/Authentication/ConfigureWebCamAccessDomainNames`** </li><li>Value: This setting is optional, and it should be configured if you need to use the webcam during the sign-in process. Specify the list of domains that are allowed to use the webcam during the sign-in process, separated by a semicolon. For example: **`clever.com`**</li>|
|
||||||
|
|
||||||
:::image type="content" source="images/federated-sign-in-settings-ppkg.png" alt-text="Custom policy showing the settings to be configured to enable federated sign-in" lightbox="images/federated-sign-in-settings-ppkg.png" border="true":::
|
:::image type="content" source="images/federated-sign-in-settings-ppkg.png" alt-text="Custom policy showing the settings to be configured to enable federated sign-in" lightbox="images/federated-sign-in-settings-ppkg.png" border="true":::
|
||||||
|
|
||||||
Apply the provisioning package to the devices that require federated sign-in.
|
Apply the provisioning package to the single-user devices that require federated sign-in.
|
||||||
|
|
||||||
|
> [!IMPORTANT]
|
||||||
|
> There was an issue affecting Windows 11, version 22H2 when using provisioning packages during OOBE. The issue was fixed with the KB5020044 update. If you plan to configure federated sign-in with a provisioning package during OOBE, ensure that the devices have the update installed. For more information, see [KB5020044][KB-1].
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
### Configure federated sign-in for student shared devices
|
||||||
|
|
||||||
|
To use web sign-in with a federated identity provider, your devices must be configured with different policies. Review the following instructions to configure your shared devices using either Microsoft Intune or a provisioning package (PPKG).
|
||||||
|
|
||||||
|
#### [:::image type="icon" source="images/icons/intune.svg"::: **Intune**](#tab/intune)
|
||||||
|
|
||||||
|
To configure federated sign-in using Microsoft Intune, [create a custom profile][MEM-1] with the following settings:
|
||||||
|
|
||||||
|
[!INCLUDE [intune-custom-settings-1](includes/intune-custom-settings-1.md)]
|
||||||
|
|
||||||
|
| Setting |
|
||||||
|
|--------|
|
||||||
|
| <li> OMA-URI: **`./Vendor/MSFT/Policy/Config/Education/IsEducationEnvironment`** </li><li>Data type: **Integer** </li><li>Value: **1**</li>|
|
||||||
|
| <li> OMA-URI: **`./Vendor/MSFT/SharedPC/EnableSharedPCModeWithOneDriveSync`** </li><li>Data type: **Boolean** </li><li>Value: **True**</li>|
|
||||||
|
| <li> OMA-URI: **`./Vendor/MSFT/Policy/Config/Authentication/EnableWebSignIn`** </li><li>Data type: **Integer** </li><li>Value: **1**</li>|
|
||||||
|
| <li> OMA-URI: **`./Vendor/MSFT/Policy/Config/Authentication/ConfigureWebSignInAllowedUrls`** </li><li>Data type: **String** </li><li>Value: Semicolon separated list of domains, for example: **`samlidp.clever.com;clever.com;mobile-redirector.clever.com`**</li>|
|
||||||
|
| <li> OMA-URI: **`./Vendor/MSFT/Policy/Config/Authentication/ConfigureWebCamAccessDomainNames`** </li><li>Data type: **String** </li><li>Value: This setting is optional, and it should be configured if you need to use the webcam during the sign-in process. Specify the list of domains that are allowed to use the webcam during the sign-in process, separated by a semicolon. For example: **`clever.com`**</li>|
|
||||||
|
|
||||||
|
[!INCLUDE [intune-custom-settings-2](includes/intune-custom-settings-2.md)]
|
||||||
|
[!INCLUDE [intune-custom-settings-info](includes/intune-custom-settings-info.md)]
|
||||||
|
|
||||||
|
#### [:::image type="icon" source="images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg)
|
||||||
|
|
||||||
|
To configure federated sign-in using a provisioning package, use the following settings:
|
||||||
|
|
||||||
|
| Setting |
|
||||||
|
|--------|
|
||||||
|
| <li> Path: **`Education/IsEducationEnvironment`** </li><li>Value: **Enabled**</li>|
|
||||||
|
| <li> Path: **`SharedPC/EnableSharedPCModeWithOneDriveSync`** </li><li>Value: **True**</li>|
|
||||||
|
| <li> Path: **`Policies/Authentication/EnableWebSignIn`** </li><li>Value: **Enabled**</li>|
|
||||||
|
| <li> Path: **`Policies/Authentication/ConfigureWebSignInAllowedUrls`** </li><li>Value: Semicolon separated list of domains, for example: **`samlidp.clever.com;clever.com;mobile-redirector.clever.com`**</li>|
|
||||||
|
| <li> Path: **`Policies/Authentication/ConfigureWebCamAccessDomainNames`** </li><li>Value: This setting is optional, and it should be configured if you need to use the webcam during the sign-in process. Specify the list of domains that are allowed to use the webcam during the sign-in process, separated by a semicolon. For example: **`clever.com`**</li>|
|
||||||
|
|
||||||
|
Apply the provisioning package to the shared devices that require federated sign-in.
|
||||||
|
|
||||||
> [!IMPORTANT]
|
> [!IMPORTANT]
|
||||||
> There was an issue affecting Windows 11, version 22H2 when using provisioning packages during OOBE. The issue was fixed with the KB5020044 update. If you plan to configure federated sign-in with a provisioning package during OOBE, ensure that the devices have the update installed. For more information, see [KB5020044][KB-1].
|
> There was an issue affecting Windows 11, version 22H2 when using provisioning packages during OOBE. The issue was fixed with the KB5020044 update. If you plan to configure federated sign-in with a provisioning package during OOBE, ensure that the devices have the update installed. For more information, see [KB5020044][KB-1].
|
||||||
@ -108,20 +157,41 @@ Apply the provisioning package to the devices that require federated sign-in.
|
|||||||
|
|
||||||
Once the devices are configured, a new sign-in experience becomes available.
|
Once the devices are configured, a new sign-in experience becomes available.
|
||||||
|
|
||||||
As the end users enter their username, they'll be redirected to the identity provider sign-in page. Once users are authenticated by the IdP, they'll be signed-in. In the following animation, you can see how the first sign-in process works:
|
As users enter their username, they're redirected to the identity provider sign-in page. Once the Idp authenticates the users, they're signed-in. In the following animation, you can observe how the first sign-in process works for a student assigned (1:1) device:
|
||||||
|
|
||||||
:::image type="content" source="./images/win-11-se-federated-sign-in.gif" alt-text="Windows 11 SE sign-in using federated sign-in through Clever and QR code badge." border="false":::
|
:::image type="content" source="./images/win-11-se-federated-sign-in.gif" alt-text="Windows 11 SE sign-in using federated sign-in through Clever and QR code badge, in a student assigned (1:1) device." border="false":::
|
||||||
|
|
||||||
> [!IMPORTANT]
|
> [!IMPORTANT]
|
||||||
> Once the policy is enabled, the first user to sign-in to the device will also set the disambiguation page to the identity provider domain on the device. This means that the device will be defaulting to that IdP. The user can exit the federated sign-in flow by pressing <kbd>Ctrl</kbd>+<kbd>Alt</kbd>+<kbd>Delete</kbd> to get back to the standard Windows sign-in screen.
|
> For student assigned (1:1) devices, once the policy is enabled, the first user who sign-in to the device will also set the disambiguation page to the identity provider domain on the device. This means that the device will be defaulting to that IdP. The user can exit the federated sign-in flow by pressing <kbd>Ctrl</kbd>+<kbd>Alt</kbd>+<kbd>Delete</kbd> to get back to the standard Windows sign-in screen.
|
||||||
|
> The behavior is different for student shared devices, where the disambiguation page is always shown, unless preferred Azure AD tenant name is configured.
|
||||||
|
|
||||||
## Important considerations
|
## Important considerations
|
||||||
|
|
||||||
Federated sign-in doesn't work on devices that have the following settings enabled:
|
### Known issues affecting student assigned (1:1) devices
|
||||||
|
|
||||||
- **EnableSharedPCMode**, which is part of the [SharedPC CSP][WIN-1]
|
Federated sign-in for student assigned (1:1) devices doesn't work with the following settings enabled:
|
||||||
|
|
||||||
|
- **EnableSharedPCMode** or **EnableSharedPCModeWithOneDriveSync**, which are part of the [SharedPC CSP][WIN-1]
|
||||||
- **Interactive logon: do not display last signed in**, which is a security policy part of the [Policy CSP][WIN-2]
|
- **Interactive logon: do not display last signed in**, which is a security policy part of the [Policy CSP][WIN-2]
|
||||||
- **Take a Test**, since it uses the security policy above
|
- **Take a Test** in kiosk mode, since it uses the security policy above
|
||||||
|
|
||||||
|
### Known issues affecting student shared devices
|
||||||
|
|
||||||
|
The following issues are known to affect student shared devices:
|
||||||
|
|
||||||
|
- Non-federated users can't sign-in to the devices, including local accounts
|
||||||
|
- **Take a Test** in kiosk mode, since it uses a local guest account to sign in
|
||||||
|
|
||||||
|
### Account management
|
||||||
|
|
||||||
|
For student shared devices, it's recommended to configure the account management policies to automatically delete the user profiles after a certain period of inactivity or disk levels. For more information, see [Set up a shared or guest Windows device][WIN-3].
|
||||||
|
|
||||||
|
### Preferred Azure AD tenant name
|
||||||
|
|
||||||
|
To improve the user experience, you can configure the *preferred Azure AD tenant name* feature.\
|
||||||
|
When using preferred AAD tenant name, the users bypass the disambiguation page and are redirected to the identity provider sign-in page. This configuration can be especially useful for student shared devices, where the disambiguation page is always shown.
|
||||||
|
|
||||||
|
For more information about preferred tenant name, see [Authentication CSP - PreferredAadTenantDomainName][WIN-4].
|
||||||
|
|
||||||
### Identity matching in Azure AD
|
### Identity matching in Azure AD
|
||||||
|
|
||||||
@ -131,7 +201,7 @@ After the token sent by the IdP is validated, Azure AD searches for a matching u
|
|||||||
> [!NOTE]
|
> [!NOTE]
|
||||||
> The ImmutableId is a string value that **must be unique** for each user in the tenant, and it shouldn't change over time. For example, the ImmutableId could be the student ID or SIS ID. The ImmutableId value should be based on the federation setup and configuration with your IdP, so confirm with your IdP before setting it.
|
> The ImmutableId is a string value that **must be unique** for each user in the tenant, and it shouldn't change over time. For example, the ImmutableId could be the student ID or SIS ID. The ImmutableId value should be based on the federation setup and configuration with your IdP, so confirm with your IdP before setting it.
|
||||||
|
|
||||||
If the matching object is found, the user is signed-in. If not, the user is presented with an error message. The following picture shows that a user with the ImmutableId *260051* can't be found:
|
If the matching object is found, the user is signed-in. Otherwise, the user is presented with an error message. The following picture shows that a user with the ImmutableId *260051* can't be found:
|
||||||
|
|
||||||
:::image type="content" source="images/federation/user-match-lookup-failure.png" alt-text="Azure AD sign-in error: a user with a matching ImmutableId can't be found in the tenant." lightbox="images/federation/user-match-lookup-failure.png":::
|
:::image type="content" source="images/federation/user-match-lookup-failure.png" alt-text="Azure AD sign-in error: a user with a matching ImmutableId can't be found in the tenant." lightbox="images/federation/user-match-lookup-failure.png":::
|
||||||
|
|
||||||
@ -182,6 +252,9 @@ Update-MgUser -UserId alton@example.onmicrosoft.com -UserPrincipalName alton@exa
|
|||||||
[SDS-1]: /schooldatasync
|
[SDS-1]: /schooldatasync
|
||||||
|
|
||||||
[KB-1]: https://support.microsoft.com/kb/5022913
|
[KB-1]: https://support.microsoft.com/kb/5022913
|
||||||
|
[KB-2]: https://support.microsoft.com/kb/5026446
|
||||||
|
|
||||||
[WIN-1]: /windows/client-management/mdm/sharedpc-csp
|
[WIN-1]: /windows/client-management/mdm/sharedpc-csp
|
||||||
[WIN-2]: /windows/client-management/mdm/policy-csp-localpoliciessecurityoptions#localpoliciessecurityoptions-interactivelogon-donotdisplaylastsignedin
|
[WIN-2]: /windows/client-management/mdm/policy-csp-localpoliciessecurityoptions#localpoliciessecurityoptions-interactivelogon-donotdisplaylastsignedin
|
||||||
|
[WIN-3]: /windows/configuration/set-up-shared-or-guest-pc
|
||||||
|
[WIN-4]: /windows/client-management/mdm/policy-csp-authentication#preferredaadtenantdomainname
|
||||||
@ -72,6 +72,8 @@ In **Windows 10, version 1803** the Configuration node introduces single app kio
|
|||||||
|
|
||||||
In **Windows 10, version 1909**, Microsoft Edge kiosk mode support was added. This allows Microsoft Edge to be the specified kiosk application. For details about configuring Microsoft Edge kiosk mode, see [Configure a Windows 10 kiosk that runs Microsoft Edge](/DeployEdge/microsoft-edge-configure-kiosk-mode). Windows 10, version 1909 also allows for configuration of the breakout sequence. The breakout sequence specifies the keyboard shortcut that returns a kiosk session to the lock screen. The breakout sequence is defined with the format modifiers + keys. An example breakout sequence would look something like `shift+alt+a`, where `shift` and `alt` are the modifiers and `a` is the key.
|
In **Windows 10, version 1909**, Microsoft Edge kiosk mode support was added. This allows Microsoft Edge to be the specified kiosk application. For details about configuring Microsoft Edge kiosk mode, see [Configure a Windows 10 kiosk that runs Microsoft Edge](/DeployEdge/microsoft-edge-configure-kiosk-mode). Windows 10, version 1909 also allows for configuration of the breakout sequence. The breakout sequence specifies the keyboard shortcut that returns a kiosk session to the lock screen. The breakout sequence is defined with the format modifiers + keys. An example breakout sequence would look something like `shift+alt+a`, where `shift` and `alt` are the modifiers and `a` is the key.
|
||||||
|
|
||||||
|
In **Windows 11, version 22H2 with [KB5026446](https://support.microsoft.com/kb/5026446)**, AssignedAccessConfiguration schema was updated to add StartPins and TaskbarLayout nodes to support pinning apps to the Start Menu and Taskbar respectively.
|
||||||
|
|
||||||
- For more information about setting up a multi-app kiosk, see [Create a Windows 10 kiosk that runs multiple apps](/windows/configuration/lock-down-windows-10-to-specific-apps).
|
- For more information about setting up a multi-app kiosk, see [Create a Windows 10 kiosk that runs multiple apps](/windows/configuration/lock-down-windows-10-to-specific-apps).
|
||||||
- For more information on the schema, see [AssignedAccessConfiguration XSD](#assignedaccessconfiguration-xsd).
|
- For more information on the schema, see [AssignedAccessConfiguration XSD](#assignedaccessconfiguration-xsd).
|
||||||
- For examples, see [AssignedAccessConfiguration examples](#assignedaccessconfiguration-examples).
|
- For examples, see [AssignedAccessConfiguration examples](#assignedaccessconfiguration-examples).
|
||||||
@ -175,7 +177,7 @@ This node supports Add, Delete, Replace and Get methods. When there's no configu
|
|||||||
|
|
||||||
> [!IMPORTANT]
|
> [!IMPORTANT]
|
||||||
>
|
>
|
||||||
> - In Windows 10, version 1803, the Configuration node introduces single app kiosk profile to replace KioskModeApp CSP node. KioskModeApp node will be deprecated soon, so you should use the single app kiosk profile in config xml for Configuration node to configure public-facing single app Kiosk.
|
> - In Windows 10, version 1803, the Configuration node introduced single app kiosk profile to replace KioskModeApp CSP node. KioskModeApp node will be deprecated soon, so you should use the single app kiosk profile in configuration xml for Configuration node to configure public-facing single app Kiosk.
|
||||||
> - Additionally, starting in Windows 10, version 1803, the KioskModeApp node becomes No-Op if Configuration node is configured on the device. Add/Replace/Delete commands on KioskModeApp node always returns SUCCESS to the MDM server if Configuration node is set, but the data of KioskModeApp will not take any effect on the device. Get command on KioskModeApp will return the configured JSON string even it's not effective.
|
> - Additionally, starting in Windows 10, version 1803, the KioskModeApp node becomes No-Op if Configuration node is configured on the device. Add/Replace/Delete commands on KioskModeApp node always returns SUCCESS to the MDM server if Configuration node is set, but the data of KioskModeApp will not take any effect on the device. Get command on KioskModeApp will return the configured JSON string even it's not effective.
|
||||||
> - You can't set both KioskModeApp and ShellLauncher at the same time on the device.
|
> - You can't set both KioskModeApp and ShellLauncher at the same time on the device.
|
||||||
<!-- Device-KioskModeApp-Editable-End -->
|
<!-- Device-KioskModeApp-Editable-End -->
|
||||||
@ -1043,6 +1045,7 @@ By default, the StatusConfiguration node doesn't exist, and it implies this feat
|
|||||||
xmlns:rs5="http://schemas.microsoft.com/AssignedAccess/201810/config"
|
xmlns:rs5="http://schemas.microsoft.com/AssignedAccess/201810/config"
|
||||||
xmlns:v3="http://schemas.microsoft.com/AssignedAccess/2020/config"
|
xmlns:v3="http://schemas.microsoft.com/AssignedAccess/2020/config"
|
||||||
xmlns:v4="http://schemas.microsoft.com/AssignedAccess/2021/config"
|
xmlns:v4="http://schemas.microsoft.com/AssignedAccess/2021/config"
|
||||||
|
xmlns:v5="http://schemas.microsoft.com/AssignedAccess/2022/config"
|
||||||
targetNamespace="http://schemas.microsoft.com/AssignedAccess/2017/config"
|
targetNamespace="http://schemas.microsoft.com/AssignedAccess/2017/config"
|
||||||
>
|
>
|
||||||
|
|
||||||
@ -1072,7 +1075,9 @@ By default, the StatusConfiguration node doesn't exist, and it implies this feat
|
|||||||
<xs:element name="AllAppsList" type="allappslist_t" minOccurs="1" maxOccurs="1"/>
|
<xs:element name="AllAppsList" type="allappslist_t" minOccurs="1" maxOccurs="1"/>
|
||||||
<xs:element ref="rs5:FileExplorerNamespaceRestrictions" minOccurs="0" maxOccurs="1"/>
|
<xs:element ref="rs5:FileExplorerNamespaceRestrictions" minOccurs="0" maxOccurs="1"/>
|
||||||
<xs:element name="StartLayout" type="xs:string" minOccurs="0" maxOccurs="1"/>
|
<xs:element name="StartLayout" type="xs:string" minOccurs="0" maxOccurs="1"/>
|
||||||
|
<xs:element ref="v5:StartPins" minOccurs="0" maxOccurs="1"/>
|
||||||
<xs:element name="Taskbar" type="taskbar_t" minOccurs="1" maxOccurs="1"/>
|
<xs:element name="Taskbar" type="taskbar_t" minOccurs="1" maxOccurs="1"/>
|
||||||
|
<xs:element ref="v5:TaskbarLayout" minOccurs="0" maxOccurs="1"/>
|
||||||
</xs:sequence>
|
</xs:sequence>
|
||||||
<xs:sequence minOccurs="1" maxOccurs="1">
|
<xs:sequence minOccurs="1" maxOccurs="1">
|
||||||
<xs:element name="KioskModeApp" type="kioskmodeapp_t" minOccurs="1" maxOccurs="1">
|
<xs:element name="KioskModeApp" type="kioskmodeapp_t" minOccurs="1" maxOccurs="1">
|
||||||
@ -1229,7 +1234,7 @@ By default, the StatusConfiguration node doesn't exist, and it implies this feat
|
|||||||
</xs:schema>);
|
</xs:schema>);
|
||||||
```
|
```
|
||||||
|
|
||||||
- Schema for features introduced in Windows 10, version 1909 which added support for Microsoft Edge kiosk mode and breakout key sequence customization.
|
- Schema for features introduced in Windows 10, version 1809 which added support for Microsoft Edge kiosk mode and breakout key sequence customization.
|
||||||
|
|
||||||
```xml
|
```xml
|
||||||
<?xml version="1.0" encoding="utf-8"?>
|
<?xml version="1.0" encoding="utf-8"?>
|
||||||
@ -1351,6 +1356,101 @@ By default, the StatusConfiguration node doesn't exist, and it implies this feat
|
|||||||
> </AssignedAccessConfiguration>
|
> </AssignedAccessConfiguration>
|
||||||
> ```
|
> ```
|
||||||
|
|
||||||
|
- Example XML configuration for a multi-app kiosk for Windows 11, version 22H2 with [KB5026446](https://support.microsoft.com/kb/5026446).
|
||||||
|
|
||||||
|
> [!NOTE]
|
||||||
|
> This example demonstrates the use of StartPins and TaskbarLayout elements. For more information, see [Set up a multi-app kiosk on Windows 11 devices](/windows/configuration/lock-down-windows-11-to-specific-apps).
|
||||||
|
>
|
||||||
|
> - StartPins element is used to pin apps to the Start menu and uses the [pinnedList JSON](/windows/configuration/customize-start-menu-layout-windows-11#get-the-pinnedlist-json) format.
|
||||||
|
> - TaskbarLayout element is used to pin apps to the taskbar and uses the [TaskbarLayoutModification XML](/windows/configuration/customize-taskbar-windows-11#create-the-xml-file) format.
|
||||||
|
|
||||||
|
```xml
|
||||||
|
<?xml version="1.0" encoding="utf-8" ?>
|
||||||
|
<AssignedAccessConfiguration xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config"
|
||||||
|
xmlns:v2="http://schemas.microsoft.com/AssignedAccess/201810/config"
|
||||||
|
xmlns:v3="http://schemas.microsoft.com/AssignedAccess/2020/config"
|
||||||
|
xmlns:v5="http://schemas.microsoft.com/AssignedAccess/2022/config">
|
||||||
|
<Profiles>
|
||||||
|
<Profile Id="{5B328104-BD89-4863-AB27-4ED6EE355485}">
|
||||||
|
<AllAppsList>
|
||||||
|
<AllowedApps>
|
||||||
|
<App AppUserModelId="Microsoft.BingWeather_8wekyb3d8bbwe!App" />
|
||||||
|
<App AppUserModelId="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!BCHost" />
|
||||||
|
<App AppUserModelId="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!ContentProcess" />
|
||||||
|
<App AppUserModelId="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!F12" />
|
||||||
|
<App AppUserModelId="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge" />
|
||||||
|
<App AppUserModelId="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!PdfReader" />
|
||||||
|
<App DesktopAppPath="%SystemRoot%\system32\notepad.exe" />
|
||||||
|
<App DesktopAppPath="%SystemRoot%\system32\control.exe" />
|
||||||
|
<App DesktopAppPath="%SystemRoot%\system32\cmd.exe" />
|
||||||
|
<App DesktopAppPath="%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe" />
|
||||||
|
<App DesktopAppPath="%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge_proxy.exe" />
|
||||||
|
<App AppUserModelId="Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe!App" />
|
||||||
|
<App DesktopAppPath="%ProgramFiles(x86)%\Microsoft\Edge\Application\103.0.1264.62\identity_helper.exe" />
|
||||||
|
</AllowedApps>
|
||||||
|
</AllAppsList>
|
||||||
|
<v2:FileExplorerNamespaceRestrictions>
|
||||||
|
<v3:NoRestriction />
|
||||||
|
</v2:FileExplorerNamespaceRestrictions>
|
||||||
|
<StartLayout>
|
||||||
|
<![CDATA[<LayoutModificationTemplate xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout"
|
||||||
|
xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout" Version="1"
|
||||||
|
xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification">
|
||||||
|
<LayoutOptions StartTileGroupCellWidth="6" />
|
||||||
|
<DefaultLayoutOverride>
|
||||||
|
<StartLayoutCollection>
|
||||||
|
<defaultlayout:StartLayout GroupCellWidth="6">
|
||||||
|
<start:Group Name="Life at a glance">
|
||||||
|
<start:Tile Size="2x2" Column="0" Row="0" AppUserModelID="Microsoft.BingWeather_8wekyb3d8bbwe!App" />
|
||||||
|
<start:Tile Size="4x2" Column="0" Row="4" AppUserModelID="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge" />
|
||||||
|
<start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%AppData%\Microsoft\Windows\Start Menu\Programs\Accessories\notepad.lnk" />
|
||||||
|
<start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%SystemRoot%\system32\cmd.exe" />
|
||||||
|
<start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%SystemRoot%\system32\control.exe" />
|
||||||
|
</start:Group>
|
||||||
|
</defaultlayout:StartLayout>
|
||||||
|
</StartLayoutCollection>
|
||||||
|
</DefaultLayoutOverride>
|
||||||
|
</LayoutModificationTemplate>]]>
|
||||||
|
</StartLayout>
|
||||||
|
<v5:StartPins>
|
||||||
|
<![CDATA[{
|
||||||
|
"pinnedList": [
|
||||||
|
{ "desktopAppId": "MSEdge" },
|
||||||
|
{ "desktopAppId": "Microsoft.Office.WINWORD.EXE.15" },
|
||||||
|
{ "packagedAppId": "Microsoft.WindowsStore_8wekyb3d8bbwe!App" },
|
||||||
|
{ "packagedAppId": "Microsoft.WindowsNotepad_8wekyb3d8bbwe!App" },
|
||||||
|
{ "desktopAppLink": "%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\File Explorer.lnk" },
|
||||||
|
{ "desktopAppLink": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Edge.lnk" }
|
||||||
|
]
|
||||||
|
}]]>
|
||||||
|
</v5:StartPins>
|
||||||
|
<Taskbar ShowTaskbar="true"/>
|
||||||
|
<v5:TaskbarLayout>
|
||||||
|
<![CDATA[<LayoutModificationTemplate xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification"
|
||||||
|
xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout"
|
||||||
|
xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout"
|
||||||
|
xmlns:taskbar="http://schemas.microsoft.com/Start/2014/TaskbarLayout" Version="1">
|
||||||
|
<CustomTaskbarLayoutCollection PinListPlacement="Replace">
|
||||||
|
<defaultlayout:TaskbarLayout>
|
||||||
|
<taskbar:TaskbarPinList>
|
||||||
|
<taskbar:DesktopApp DesktopApplicationID="Microsoft.Windows.Explorer" />
|
||||||
|
<taskbar:DesktopApp DesktopApplicationLinkPath="%APPDATA%\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk" />
|
||||||
|
</taskbar:TaskbarPinList>
|
||||||
|
</defaultlayout:TaskbarLayout>
|
||||||
|
</CustomTaskbarLayoutCollection>
|
||||||
|
</LayoutModificationTemplate>]]>
|
||||||
|
</v5:TaskbarLayout>
|
||||||
|
</Profile>
|
||||||
|
</Profiles>
|
||||||
|
<Configs>
|
||||||
|
<Config>
|
||||||
|
<Account>MultiAppKioskUser</Account>
|
||||||
|
<DefaultProfile Id="{5B328104-BD89-4863-AB27-4ED6EE355485}"/>
|
||||||
|
</Config>
|
||||||
|
</Configs>
|
||||||
|
</AssignedAccessConfiguration>
|
||||||
|
```
|
||||||
|
|
||||||
- Example XML configuration for a multi-app kiosk for Windows 10.
|
- Example XML configuration for a multi-app kiosk for Windows 10.
|
||||||
|
|
||||||
```xml
|
```xml
|
||||||
|
|||||||
@ -66,8 +66,10 @@
|
|||||||
href: setup-digital-signage.md
|
href: setup-digital-signage.md
|
||||||
- name: Set up a single-app kiosk
|
- name: Set up a single-app kiosk
|
||||||
href: kiosk-single-app.md
|
href: kiosk-single-app.md
|
||||||
- name: Set up a multi-app kiosk
|
- name: Set up a multi-app kiosk for Windows 10
|
||||||
href: lock-down-windows-10-to-specific-apps.md
|
href: lock-down-windows-10-to-specific-apps.md
|
||||||
|
- name: Set up a multi-app kiosk for Windows 11
|
||||||
|
href: lock-down-windows-11-to-specific-apps.md
|
||||||
- name: Kiosk reference information
|
- name: Kiosk reference information
|
||||||
items:
|
items:
|
||||||
- name: More kiosk methods and reference information
|
- name: More kiosk methods and reference information
|
||||||
|
|||||||
383
windows/configuration/lock-down-windows-11-to-specific-apps.md
Normal file
383
windows/configuration/lock-down-windows-11-to-specific-apps.md
Normal file
@ -0,0 +1,383 @@
|
|||||||
|
---
|
||||||
|
title: Set up a multi-app kiosk on Windows 11
|
||||||
|
description: Learn how to configure a kiosk device running Windows 11 so that users can only run a few specific apps.
|
||||||
|
ms.prod: windows-client
|
||||||
|
ms.technology: itpro-configure
|
||||||
|
author: lizgt2000
|
||||||
|
ms.author: lizlong
|
||||||
|
ms.date: 05/12/2023
|
||||||
|
manager: aaroncz
|
||||||
|
ms.reviewer: sybruckm
|
||||||
|
ms.localizationpriority: medium
|
||||||
|
ms.topic: how-to
|
||||||
|
---
|
||||||
|
# Set up a multi-app kiosk on Windows 11 devices
|
||||||
|
|
||||||
|
**Applies to**
|
||||||
|
|
||||||
|
- Windows 11 Pro, Enterprise, and Education
|
||||||
|
|
||||||
|
> [!NOTE]
|
||||||
|
> The use of multiple monitors isn't supported for multi-app kiosk mode.
|
||||||
|
|
||||||
|
An assigned access multi-app kiosk runs one or more apps from the desktop. People using the kiosk see a customized Start that shows only the apps that are allowed. With this approach, you can configure a locked-down experience for different account types. A multi-app kiosk is appropriate for devices that are shared by multiple people. Here's a guide on how to set up a multi-app kiosk.
|
||||||
|
|
||||||
|
> [!WARNING]
|
||||||
|
> The assigned access feature is intended for corporate-owned fixed-purpose devices, like kiosks. When the multi-app assigned access configuration is applied on the device, [certain policies](kiosk-policies.md) are enforced system-wide, and will impact other users on the device. Deleting the kiosk configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all the enforced policies (such as Start layout). A factory reset is needed to clear all the policies enforced via assigned access.
|
||||||
|
|
||||||
|
> [!TIP]
|
||||||
|
> Be sure to check the [configuration recommendations](kiosk-prepare.md) before you set up your kiosk.
|
||||||
|
|
||||||
|
## Configure a Multi-App Kiosk
|
||||||
|
|
||||||
|
See the table below for the different methods to configure a multi-app kiosk in Windows 11.
|
||||||
|
|
||||||
|
|Configuration Method|Availability|
|
||||||
|
|--------------------|------------|
|
||||||
|
|[MDM WMI Bridge Provider](#configure-a-kiosk-using-wmi-bridge) | Available May 2023|
|
||||||
|
|Intune|Coming soon|
|
||||||
|
|Provisioning Package Using Windows Configuration Designer| Coming soon|
|
||||||
|
|
||||||
|
> [!NOTE]
|
||||||
|
> For WMI Bridge/PowerShell and Provisioning package methods, you will need to create your own multi-app kiosk XML file as specified below.
|
||||||
|
|
||||||
|
## Create the XML file
|
||||||
|
|
||||||
|
Let's start by looking at the basic structure of the XML file.
|
||||||
|
|
||||||
|
- A configuration xml can define multiple *profiles*. Each profile has a unique **Id** and defines a set of applications that are allowed to run, whether the taskbar is visible, and can include a custom Start layout.
|
||||||
|
|
||||||
|
- A configuration xml can have multiple *config* sections. Each config section associates a non-admin user account to a default profile **Id**.
|
||||||
|
|
||||||
|
- Multiple config sections can be associated to the same profile.
|
||||||
|
|
||||||
|
- A profile has no effect if it's not associated to a config section.
|
||||||
|
|
||||||
|
You can start your file by pasting the following XML into an XML editor, and saving the file as *filename*.xml. Each section of this XML is explained in this article.
|
||||||
|
|
||||||
|
> [!NOTE]
|
||||||
|
> If you want to write a configuration file to be applied to both Windows 10 and Windows 11 devices, follow the [Windows 10 instructions](lock-down-windows-10-to-specific-apps.md) to add the StartLayout tag to your XML file, just above the StartPins tag. Windows will automatically ignore the sections that don't apply to the version running.
|
||||||
|
|
||||||
|
```xml
|
||||||
|
<?xml version="1.0" encoding="utf-8" ?>
|
||||||
|
<AssignedAccessConfiguration
|
||||||
|
xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config" xmlns:win11="http://schemas.microsoft.com/AssignedAccess/2022/config">
|
||||||
|
<Profiles>
|
||||||
|
<Profile Id="">
|
||||||
|
<AllAppsList>
|
||||||
|
<AllowedApps/>
|
||||||
|
</AllAppsList>
|
||||||
|
<win11:StartPins/>
|
||||||
|
<Taskbar/>
|
||||||
|
</Profile>
|
||||||
|
</Profiles>
|
||||||
|
<Configs>
|
||||||
|
<Config>
|
||||||
|
<Account/>
|
||||||
|
<DefaultProfile Id=""/>
|
||||||
|
</Config>
|
||||||
|
</Configs>
|
||||||
|
</AssignedAccessConfiguration>
|
||||||
|
```
|
||||||
|
#### Profile
|
||||||
|
|
||||||
|
There are two types of profiles that you can specify in the XML:
|
||||||
|
|
||||||
|
- **Lockdown profile**: Users assigned a lockdown profile will see the desktop in tablet mode with the specific apps on the Start screen.
|
||||||
|
- **Kiosk profile**: Starting with Windows 10 version 1803, this profile replaces the KioskModeApp node of the [AssignedAccess CSP](/windows/client-management/mdm/assignedaccess-csp). Users assigned a kiosk profile won't see the desktop, but only the kiosk app running in full-screen mode.
|
||||||
|
|
||||||
|
A lockdown profile section in the XML has the following entries:
|
||||||
|
|
||||||
|
- [**Id**](#id)
|
||||||
|
|
||||||
|
- [**AllowedApps**](#allowedapps)
|
||||||
|
|
||||||
|
- [**StartPins**](#startpins)
|
||||||
|
|
||||||
|
- [**Taskbar**](#taskbar)
|
||||||
|
|
||||||
|
A kiosk profile in the XML has the following entries:
|
||||||
|
|
||||||
|
- [**Id**](#id)
|
||||||
|
|
||||||
|
- [**KioskModeApp**](#kioskmodeapp)
|
||||||
|
|
||||||
|
##### Id
|
||||||
|
|
||||||
|
The profile **Id** is a GUID attribute to uniquely identify the profile. You can create a GUID using a GUID generator. The GUID just needs to be unique within this XML file.
|
||||||
|
|
||||||
|
```xml
|
||||||
|
<Profiles>
|
||||||
|
<Profile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}">…</Profile>
|
||||||
|
</Profiles>
|
||||||
|
```
|
||||||
|
|
||||||
|
##### AllowedApps
|
||||||
|
|
||||||
|
**AllowedApps** is a list of applications that are allowed to run. Apps can be Universal Windows Platform (UWP) apps or Windows desktop applications. Starting with Windows 10 version 1809, you can configure a single app in the **AllowedApps** list to run automatically when the assigned access user account signs in.
|
||||||
|
|
||||||
|
- For UWP apps, you need to provide the App User Model ID (AUMID). [Learn how to get the AUMID](./find-the-application-user-model-id-of-an-installed-app.md), or [get the AUMID from the Start Layout XML](#create-the-xml-file).
|
||||||
|
- For desktop apps, you need to specify the full path of the executable, which can contain one or more system environment variables in the form of `%variableName%`. For example, `%systemroot%` or `%windir%`.
|
||||||
|
- If an app has a dependency on another app, both must be included in the allowed apps list. For example, Internet Explorer 64-bit has a dependency on Internet Explorer 32-bit, so you must allow both `"C:\Program Files\internet explorer\iexplore.exe"` and `"C:\Program Files (x86)\Internet Explorer\iexplore.exe"`.
|
||||||
|
- To configure a single app to launch automatically when the user signs in, include `rs5:AutoLaunch="true"` after the AUMID or path. You can also include arguments to be passed to the app. For an example, see [the AllowedApps sample XML](#apps-sample).
|
||||||
|
|
||||||
|
When the multi-app kiosk configuration is applied to a device, AppLocker rules will be generated to allow the apps that are listed in the configuration. Here are the predefined assigned access AppLocker rules for **UWP apps**:
|
||||||
|
|
||||||
|
1. Default rule is to allow all users to launch the signed package apps.
|
||||||
|
2. The package app blocklist is generated at runtime when the assigned access user signs in. Based on the installed/provisioned package apps available for the user account, assigned access generates the blocklist. This list will exclude the default allowed inbox package apps, which are critical for the system to function. It then excludes the allowed packages that enterprises defined in the assigned access configuration. If there are multiple apps within the same package, all these apps will be excluded. This blocklist will be used to prevent the user from accessing the apps that are currently available for the user but not in the allowed list.
|
||||||
|
|
||||||
|
> [!NOTE]
|
||||||
|
> You can't manage AppLocker rules that are generated by the multi-app kiosk configuration in [MMC snap-ins](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh994629(v=ws.11)#BKMK_Using_Snapins). Avoid creating AppLocker rules that conflict with AppLocker rules that are generated by the multi-app kiosk configuration.
|
||||||
|
> Multi-app kiosk mode doesn't block the enterprise or the users from installing UWP apps. When a new UWP app is installed during the current assigned access user session, this app will not be in the deny list. When the user signs out and signs in again, the app will be included in the blocklist. If this is an enterprise-deployed line-of-business app and you want to allow it to run, update the assigned access configuration to include it in the allowed app list.
|
||||||
|
|
||||||
|
Here are the predefined assigned access AppLocker rules for **desktop apps**:
|
||||||
|
|
||||||
|
1. Default rule is to allow all users to launch the desktop programs signed with Microsoft Certificate in order for the system to boot and function. The rule also allows the admin user group to launch all desktop programs.
|
||||||
|
2. There's a predefined inbox desktop app blocklist for the assigned access user account, and this blocklist is adjusted based on the desktop app allowlist that you defined in the multi-app configuration.
|
||||||
|
3. Enterprise-defined allowed desktop apps are added in the AppLocker allowlist.
|
||||||
|
|
||||||
|
The following example allows Photos, Weather, Calculator, Paint, and Notepad apps to run on the device, with Notepad configured to automatically launch and create a file called `123.text` when the user signs in.
|
||||||
|
|
||||||
|
<span id="apps-sample" />
|
||||||
|
|
||||||
|
```xml
|
||||||
|
<AllAppsList>
|
||||||
|
<AllowedApps>
|
||||||
|
<App AppUserModelId="Microsoft.Windows.Photos_8wekyb3d8bbwe!App" />
|
||||||
|
<App AppUserModelId="Microsoft.BingWeather_8wekyb3d8bbwe!App" />
|
||||||
|
<App AppUserModelId="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App" />
|
||||||
|
<App DesktopAppPath="%windir%\system32\mspaint.exe" />
|
||||||
|
<App DesktopAppPath="C:\Windows\System32\notepad.exe" rs5:AutoLaunch="true" rs5:AutoLaunchArguments="123.txt">
|
||||||
|
</AllowedApps>
|
||||||
|
</AllAppsList>
|
||||||
|
```
|
||||||
|
|
||||||
|
##### StartPins
|
||||||
|
|
||||||
|
After you define the list of allowed applications, you can customize the Start layout for your kiosk experience. The easiest way to create a customized Start layout to apply to other Windows client devices is to set up the Start screen on a test device and then export the layout. Once you've decided, you can get the JSON needed for your kiosk configuration by following the steps to [Get the pinnedList JSON](customize-and-export-start-layout.md). If you opt to do this using the PowerShell command, make sure that the system you run the command on has the same file structure as the device on which you will apply the kiosk (the path to the allowed apps must be the same). At the end of this step, you should have a JSON pinnedList that looks something like the below.
|
||||||
|
|
||||||
|
Add your pinnedList JSON into the StartPins tag in your XML file.
|
||||||
|
|
||||||
|
```xml
|
||||||
|
<win11:StartPins>
|
||||||
|
<![CDATA[
|
||||||
|
{ "pinnedList":[
|
||||||
|
{"packagedAppId":"Microsoft.WindowsCalculator_8wekyb3d8bbwe!App"},
|
||||||
|
{"packagedAppId":"Microsoft.Windows.Photos_8wekyb3d8bbwe!App"},
|
||||||
|
{"packagedAppId":"Microsoft.BingWeather_8wekyb3d8bbwe!App"},
|
||||||
|
{"desktopAppLink":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\StartMenu\\Programs\\Accessories\\Paint.lnk"},
|
||||||
|
{"desktopAppLink":"%APPDATA%\\Microsoft\\Windows\\StartMenu\\Programs\\Accessories\\Notepad.lnk"}
|
||||||
|
] }
|
||||||
|
]]>
|
||||||
|
</win11:StartPins>
|
||||||
|
```
|
||||||
|
|
||||||
|
> [!NOTE]
|
||||||
|
> If an app isn't installed for the user, but is included in the Start layout XML, the app isn't shown on the Start screen.
|
||||||
|
|
||||||
|
##### Taskbar
|
||||||
|
|
||||||
|
Define whether you want to have the taskbar present in the kiosk device. For tablet-based or touch-enabled all-in-one kiosks, when you don't attach a keyboard and mouse, you can hide the taskbar as part of the multi-app experience if you want.
|
||||||
|
|
||||||
|
The following example exposes the taskbar to the end user:
|
||||||
|
|
||||||
|
```xml
|
||||||
|
<Taskbar ShowTaskbar="true"/>
|
||||||
|
```
|
||||||
|
|
||||||
|
The following example hides the taskbar:
|
||||||
|
|
||||||
|
```xml
|
||||||
|
<Taskbar ShowTaskbar="false"/>
|
||||||
|
```
|
||||||
|
|
||||||
|
> [!NOTE]
|
||||||
|
> This is different from the **Automatically hide the taskbar** option in tablet mode, which shows the taskbar when swiping up from or moving the mouse pointer down to the bottom of the screen. Setting **ShowTaskbar** as **false** will always keep the taskbar hidden.
|
||||||
|
|
||||||
|
##### KioskModeApp
|
||||||
|
|
||||||
|
**KioskModeApp** is used for a [kiosk profile](#profile) only. Enter the AUMID for a single app. You can only specify one kiosk profile in the XML.
|
||||||
|
|
||||||
|
```xml
|
||||||
|
<KioskModeApp AppUserModelId="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App"/>
|
||||||
|
```
|
||||||
|
|
||||||
|
> [!IMPORTANT]
|
||||||
|
> The kiosk profile is designed for public-facing kiosk devices. We recommend that you use a local, non-administrator account. If the device is connected to your company network, using a domain or Azure Active Directory account could potentially compromise confidential information.
|
||||||
|
|
||||||
|
#### Configs
|
||||||
|
|
||||||
|
Under **Configs**, define which user account will be associated with the profile. When this user account signs in on the device, the associated assigned access profile will be enforced. This behavior includes the allowed apps, Start layout, taskbar configuration, and other local group policies or mobile device management (MDM) policies set as part of the multi-app experience.
|
||||||
|
|
||||||
|
The full multi-app assigned access experience can only work for non-admin users. It's not supported to associate an admin user with the assigned access profile. Making this configuration in the XML file will result in unexpected or unsupported experiences when this admin user signs in.
|
||||||
|
|
||||||
|
You can assign:
|
||||||
|
|
||||||
|
- [A local standard user account that signs in automatically](#config-for-autologon-account) (Applies to Windows 10, version 1803 only)
|
||||||
|
- [An individual account, which can be local, domain, or Azure Active Directory (Azure AD)](#config-for-individual-accounts)
|
||||||
|
- [A group account, which can be local, Active Directory (domain), or Azure AD](#config-for-group-accounts) (Applies to Windows 10, version 1803 only).
|
||||||
|
|
||||||
|
> [!NOTE]
|
||||||
|
> Configs that specify group accounts cannot use a kiosk profile, only a lockdown profile. If a group is configured to a kiosk profile, the CSP will reject the request.
|
||||||
|
|
||||||
|
##### Config for AutoLogon Account
|
||||||
|
|
||||||
|
When you use `<AutoLogonAccount>` and the configuration is applied to a device, the specified account (managed by Assigned Access) is created on the device as a local standard user account. The specified account is signed in automatically after restart.
|
||||||
|
|
||||||
|
The following example shows how to specify an account to sign in automatically.
|
||||||
|
|
||||||
|
```xml
|
||||||
|
<Configs>
|
||||||
|
<Config>
|
||||||
|
<AutoLogonAccount/>
|
||||||
|
<DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"/>
|
||||||
|
</Config>
|
||||||
|
</Configs>
|
||||||
|
```
|
||||||
|
|
||||||
|
Starting with Windows 10 version 1809, you can configure the display name that will be shown when the user signs in. The following example shows how to create an AutoLogon Account that shows the name "Hello World".
|
||||||
|
|
||||||
|
```xml
|
||||||
|
<Configs>
|
||||||
|
<Config>
|
||||||
|
<AutoLogonAccount rs5:DisplayName="Hello World"/>
|
||||||
|
<DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"/>
|
||||||
|
</Config>
|
||||||
|
</Configs>
|
||||||
|
```
|
||||||
|
|
||||||
|
On domain-joined devices, local user accounts aren't shown on the sign-in screen by default. To show the **AutoLogonAccount** on the sign-in screen, enable the following Group Policy setting: **Computer Configuration > Administrative Templates > System > Logon > Enumerate local users on domain-joined computers**. (The corresponding MDM policy setting is [WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers in the Policy CSP](/windows/client-management/mdm/policy-csp-windowslogon#windowslogon-enumeratelocalusersondomainjoinedcomputers).)
|
||||||
|
|
||||||
|
>[!IMPORTANT]
|
||||||
|
>When Exchange Active Sync (EAS) password restrictions are active on the device, the autologon feature does not work. This behavior is by design. For more informations, see [How to turn on automatic logon in Windows](/troubleshoot/windows-server/user-profiles-and-logon/turn-on-automatic-logon).
|
||||||
|
|
||||||
|
##### Config for individual accounts
|
||||||
|
|
||||||
|
Individual accounts are specified using `<Account>`.
|
||||||
|
|
||||||
|
- Local account can be entered as `machinename\account` or `.\account` or just `account`.
|
||||||
|
- Domain account should be entered as `domain\account`.
|
||||||
|
- Azure AD account must be specified in this format: `AzureAD\{email address}`. **AzureAD** must be provided _as is_, and consider it's a fixed domain name. Then follow with the Azure AD email address. For example, `AzureAD\someone@contoso.onmicrosoft.com`
|
||||||
|
|
||||||
|
> [!WARNING]
|
||||||
|
> Assigned access can be configured via WMI or CSP to run its applications under a domain user or service account, rather than a local account. However, use of domain user or service accounts introduces risks that an attacker subverting the assigned access application might gain access to sensitive domain resources that have been inadvertently left accessible to any domain account. We recommend that customers proceed with caution when using domain accounts with assigned access, and consider the domain resources potentially exposed by the decision to do so.
|
||||||
|
|
||||||
|
Before applying the multi-app configuration, make sure the specified user account is available on the device, otherwise it will fail.
|
||||||
|
|
||||||
|
> [!NOTE]
|
||||||
|
> For both domain and Azure AD accounts, it's not required that target account is explicitly added to the device. As long as the device is AD-joined or Azure AD-joined, the account can be discovered in the domain forest or tenant that the device is joined to. For local accounts, it is required that the account exist before you configure the account for assigned access.
|
||||||
|
|
||||||
|
```xml
|
||||||
|
<Configs>
|
||||||
|
<Config>
|
||||||
|
<Account>MultiAppKioskUser</Account>
|
||||||
|
<DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"/>
|
||||||
|
</Config>
|
||||||
|
</Configs>
|
||||||
|
```
|
||||||
|
|
||||||
|
##### Config for group accounts
|
||||||
|
|
||||||
|
Group accounts are specified using `<UserGroup>`. Nested groups aren't supported. For example, if user A is member of Group 1, Group 1 is member of Group 2, and Group 2 is used in `<Config/>`, user A won't have the kiosk experience.
|
||||||
|
|
||||||
|
- Local group: Specify the group type as **LocalGroup** and put the group name in Name attribute. Any Azure AD accounts that are added to the local group won't have the kiosk settings applied.
|
||||||
|
|
||||||
|
```xml
|
||||||
|
<Config>
|
||||||
|
<UserGroup Type="LocalGroup" Name="mygroup" />
|
||||||
|
<DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"/>
|
||||||
|
</Config>
|
||||||
|
```
|
||||||
|
|
||||||
|
- Domain group: Both security and distribution groups are supported. Specify the group type as <strong>ActiveDirectoryGroup</strong>. Use the domain name as the prefix in the name attribute.
|
||||||
|
|
||||||
|
```xml
|
||||||
|
<Config>
|
||||||
|
<UserGroup Type="ActiveDirectoryGroup" Name="mydomain\mygroup" />
|
||||||
|
<DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"/>
|
||||||
|
</Config>
|
||||||
|
```
|
||||||
|
|
||||||
|
- Azure AD group: Use the group object ID from the Azure portal to uniquely identify the group in the Name attribute. You can find the object ID on the overview page for the group in **Users and groups** > **All groups**. Specify the group type as **AzureActiveDirectoryGroup**. The kiosk device must have internet connectivity when users that belong to the group sign-in.
|
||||||
|
|
||||||
|
```xml
|
||||||
|
<Config>
|
||||||
|
<UserGroup Type="AzureActiveDirectoryGroup" Name="a8d36e43-4180-4ac5-a627-fb8149bba1ac" />
|
||||||
|
<DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"/>
|
||||||
|
</Config>
|
||||||
|
```
|
||||||
|
|
||||||
|
> [!NOTE]
|
||||||
|
> If an Azure AD group is configured with a lockdown profile on a device, a user in the Azure AD group must change their password (after the account has been created with default password on the portal) before they can sign in to this device. If the user uses the default password to sign in to the device, the user will be immediately signed out.
|
||||||
|
|
||||||
|
<span id="add-xml" />
|
||||||
|
|
||||||
|
## Configure a kiosk using WMI Bridge
|
||||||
|
|
||||||
|
Environments that use [Windows Management Instrumentation (WMI)](/windows/win32/wmisdk/wmi-start-page) can use the [MDM Bridge WMI Provider](/windows/win32/dmwmibridgeprov/mdm-bridge-wmi-provider-portal) to configure the MDM_AssignedAccess class.
|
||||||
|
|
||||||
|
Here's an example of how to set AssignedAccess configuration:
|
||||||
|
|
||||||
|
1. Download the [psexec tool](/sysinternals/downloads/psexec).
|
||||||
|
2. Run `psexec.exe -i -s cmd.exe`.
|
||||||
|
3. In the command prompt launched by psexec.exe, enter `powershell.exe` to open PowerShell.
|
||||||
|
4. Run the following script replacing the placeholder "your XML here, with the [XML](#create-the-xml-file) you created above.
|
||||||
|
|
||||||
|
```xml
|
||||||
|
$nameSpaceName="root\cimv2\mdm\dmmap"
|
||||||
|
$className="MDM_AssignedAccess"
|
||||||
|
$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className
|
||||||
|
Add-Type -AssemblyName System.Web
|
||||||
|
$obj.Configuration = [System.Web.HttpUtility]::HtmlEncode(@"
|
||||||
|
|
||||||
|
<your XML here>
|
||||||
|
|
||||||
|
"@)
|
||||||
|
|
||||||
|
Set-CimInstance -CimInstance $obj
|
||||||
|
```
|
||||||
|
## Sample Assigned Access XML
|
||||||
|
|
||||||
|
Compare the below to your XML file to check for correct formatting.
|
||||||
|
|
||||||
|
```xml
|
||||||
|
<?xml version="1.0" encoding="utf-8" ?>
|
||||||
|
<AssignedAccessConfiguration
|
||||||
|
xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config" xmlns:win11="http://schemas.microsoft.com/AssignedAccess/2022/config">
|
||||||
|
<Profiles>
|
||||||
|
<Profile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}">
|
||||||
|
<AllAppsList>
|
||||||
|
<AllowedApps>
|
||||||
|
<App AppUserModelId="Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic" />
|
||||||
|
<App AppUserModelId="Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo" />
|
||||||
|
<App AppUserModelId="Microsoft.Windows.Photos_8wekyb3d8bbwe!App" />
|
||||||
|
<App AppUserModelId="Microsoft.BingWeather_8wekyb3d8bbwe!App" />
|
||||||
|
<App AppUserModelId="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App" />
|
||||||
|
<App DesktopAppPath="%windir%\system32\mspaint.exe" />
|
||||||
|
<App DesktopAppPath="C:\Windows\System32\notepad.exe" />
|
||||||
|
</AllowedApps>
|
||||||
|
</AllAppsList>
|
||||||
|
<win11:StartPins>
|
||||||
|
<![CDATA[
|
||||||
|
{ "pinnedList":[
|
||||||
|
{"packagedAppId":"Microsoft.WindowsCalculator_8wekyb3d8bbwe!App"},
|
||||||
|
{"packagedAppId":"Microsoft.Windows.Photos_8wekyb3d8bbwe!App"},
|
||||||
|
{"packagedAppId":"Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic"},
|
||||||
|
{"packagedAppId":"Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo"},
|
||||||
|
{"packagedAppId":"Microsoft.BingWeather_8wekyb3d8bbwe!App"},
|
||||||
|
{"desktopAppLink":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\StartMenu\\Programs\\Accessories\\Paint.lnk"},
|
||||||
|
{"desktopAppLink":"%APPDATA%\\Microsoft\\Windows\\StartMenu\\Programs\\Accessories\\Notepad.lnk"}
|
||||||
|
] }
|
||||||
|
]]>
|
||||||
|
</win11:StartPins>
|
||||||
|
<Taskbar ShowTaskbar="true"/>
|
||||||
|
</Profile>
|
||||||
|
</Profiles>
|
||||||
|
<Configs>
|
||||||
|
<Config>
|
||||||
|
<Account>MultiAppKioskUser</Account>
|
||||||
|
<DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"/>
|
||||||
|
</Config>
|
||||||
|
</Configs>
|
||||||
|
</AssignedAccessConfiguration>
|
||||||
|
```
|
||||||
@ -207,7 +207,7 @@ sections:
|
|||||||
questions:
|
questions:
|
||||||
- question: Can I use an external Windows Hello compatible camera when my computer has a built-in Windows Hello compatible camera?
|
- question: Can I use an external Windows Hello compatible camera when my computer has a built-in Windows Hello compatible camera?
|
||||||
answer: |
|
answer: |
|
||||||
Yes. Starting with Windows 10, version 21H1 an external Windows Hello compatible camera can be used if a device already supports an internal Windows Hello camera. When both cameras are present, the external camera is used for face authentication. For more information, see [IT tools to support Windows 10, version 21H1](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/it-tools-to-support-windows-10-version-21h1/ba-p/2365103). However, using external Hello cameras and accessories is restricted if ESS is enabled, please see [Windows Hello Enhanced Sign-in Security](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security#pluggableperipheral-biometric-sensors).
|
Yes, you can use an external Windows Hello compatible camera if a device has an internal Windows Hello camera. When both cameras are present, the external camera is used for face authentication. For more information, see [IT tools to support Windows 10, version 21H1](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/it-tools-to-support-windows-10-version-21h1/ba-p/2365103). If ESS is enabled, see [Windows Hello Enhanced Sign-in Security](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security).
|
||||||
- question: Can I use an external Windows Hello compatible camera or other Windows Hello compatible accessory when my laptop lid is closed or docked?
|
- question: Can I use an external Windows Hello compatible camera or other Windows Hello compatible accessory when my laptop lid is closed or docked?
|
||||||
answer: |
|
answer: |
|
||||||
Some laptops and tablets with keyboards that close may not use an external Windows Hello compatible camera or other Windows Hello compatible accessory when the computer is docked with the lid closed. The issue has been addressed in Windows 11, version 22H2.
|
Some laptops and tablets with keyboards that close may not use an external Windows Hello compatible camera or other Windows Hello compatible accessory when the computer is docked with the lid closed. The issue has been addressed in Windows 11, version 22H2.
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user