From d2955fe82fb7c463a3cbaa1702cf0d586fcad5f4 Mon Sep 17 00:00:00 2001
From: Andrea Barr <81656118+AndreaLBarr@users.noreply.github.com>
Date: Tue, 15 Jun 2021 17:03:49 -0700
Subject: [PATCH 1/2] Added a question and answer

Added question and answer to lines 40-49 as requested by Radia Soulmani .
---
 .../faq-md-app-guard.yml                          | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.yml b/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.yml
index cb0bff0dc0..10ada92e34 100644
--- a/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.yml
+++ b/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.yml
@@ -36,7 +36,18 @@ sections:
           `HKLM\software\Microsoft\Hvsi\SpecRequiredMemoryInGB` (Default is 8 GB.)
           
           `HKLM\software\Microsoft\Hvsi\SpecRequiredFreeDiskSpaceInGB` (Default is 5 GB.)
-          
+       
+      - question: |
+          My network configuration uses a proxy and I’m running into a “Cannot resolve External URLs from MDAG Browser: Error: err_connection_refused”. How do I resolve that?
+        answer: |
+         The manual or PAC server must be a hostname (not IP) that is neutral on the site-list. Additionally, if the PAC script returns a proxy, it must meet those same requirements.
+         
+         To make sure the FQDNs (Fully Qualified Domain Names) for the “PAC file” and the “proxy servers the PAC file redirects to” are added as Neutral Resources in the Network Isolation policies used by Application Guard, you can:
+        
+         - Verify this by going to edge://application-guard-internals/#utilities and entering the FQDN for the pac/proxy in the “check url trust” field and verifying that it says “Neutral”.
+         - It needs to be a FQDN…just a simple IP address will not work.
+         - Optionally, if possible, the IP addresses associated with the server hosting the above should be removed from the Enterprise IP Ranges in the Network Isolation policies used by Application Guard.
+
       - question: |
           Can employees download documents from the Application Guard Edge session onto host devices?
         answer: |
@@ -232,4 +243,4 @@ additionalContent: |
 
   ## See also
   
-  [Configure Microsoft Defender Application Guard policy settings](./configure-md-app-guard.md)
\ No newline at end of file
+  [Configure Microsoft Defender Application Guard policy settings](./configure-md-app-guard.md)

From aef7333ad599c711065ba4a41c54fc8def5733aa Mon Sep 17 00:00:00 2001
From: Denise Vangel-MSFT <deniseb@microsoft.com>
Date: Wed, 16 Jun 2021 11:26:46 -0700
Subject: [PATCH 2/2] Update faq-md-app-guard.yml

---
 .../microsoft-defender-application-guard/faq-md-app-guard.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.yml b/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.yml
index 10ada92e34..03baa2d537 100644
--- a/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.yml
+++ b/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.yml
@@ -9,7 +9,7 @@ metadata:
   ms.localizationpriority: medium
   author: denisebmsft
   ms.author: deniseb
-  ms.date: 05/12/2021
+  ms.date: 06/16/2021
   ms.reviewer:
   manager: dansimp
   ms.custom: asr
@@ -45,7 +45,7 @@ sections:
          To make sure the FQDNs (Fully Qualified Domain Names) for the “PAC file” and the “proxy servers the PAC file redirects to” are added as Neutral Resources in the Network Isolation policies used by Application Guard, you can:
         
          - Verify this by going to edge://application-guard-internals/#utilities and entering the FQDN for the pac/proxy in the “check url trust” field and verifying that it says “Neutral”.
-         - It needs to be a FQDN…just a simple IP address will not work.
+         - It must be a FQDN. A simple IP address will not work.
          - Optionally, if possible, the IP addresses associated with the server hosting the above should be removed from the Enterprise IP Ranges in the Network Isolation policies used by Application Guard.
 
       - question: |