diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index b3c6da87b5..c74bbd6838 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -1029,6 +1029,10 @@ For details about Microsoft mobile device management protocols for Windows 10 s
  • Authentication/AllowFidoDeviceSignon
  • Browser/LockdownFavorites
  • Browser/ProvisionFavorites
    • +
  • Cellular/LetAppsAccessCellularData
    • +
  • Cellular/LetAppsAccessCellularData_ForceAllowTheseApps
    • +
  • Cellular/LetAppsAccessCellularData_ForceDenyTheseApps
    • +
  • Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps
  • CredentialProviders/DisableAutomaticReDeploymentCredentials
  • DeviceGuard/EnableVirtualizationBasedSecurity
  • DeviceGuard/RequirePlatformSecurityFeatures
    • @@ -1081,6 +1085,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s
  • Education/PrinterNames
  • Search/AllowCloudSearch
  • Security/ClearTPMIfNotReady
    • +
  • Start/HidePeopleBar
  • Storage/AllowDiskHealthModelUpdates
  • System/LimitEnhancedDiagnosticDataWindowsAnalytics
  • Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork
    • @@ -1377,6 +1382,44 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware ## Change history in MDM documentation +### November 2017 + + ++++ + + + + + + + + + + + +
    New or updated topicDescription
    [Policy CSP](policy-configuration-service-provider.md)

    Added the following policies for Windows 10, version 1709:

    +
      +
    • Authentication/AllowFidoDeviceSignon
      • +
    • Cellular/LetAppsAccessCellularData
      • +
    • Cellular/LetAppsAccessCellularData_ForceAllowTheseApps
      • +
    • Cellular/LetAppsAccessCellularData_ForceDenyTheseApps
      • +
    • Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps
      • +
    • Start/HidePeopleBar
      • +
    • Storage/EnhancedStorageDevices
      • +
    • Update/ManagePreviewBuilds
      • +
    • WirelessDisplay/AllowMdnsAdvertisement
      • +
    • WirelessDisplay/AllowMdnsDiscovery
      • +
    +

    Added missing policies from previous releases:

    +
      +
    • Connectivity/DisallowNetworkConnectivityActiveTest
      • +
    • Search/AllowWindowsIndexer
      • +
    +
    + ### October 2017 @@ -1402,14 +1445,6 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
  • Defender/ControlledFolderAccessAllowedApplications - string separator is |.
  • Defender/ControlledFolderAccessProtectedFolders - string separator is |.
    • -

    Added the following policies for Windows 10, version 1709:

    - diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 7a0a83df92..4c4c7bab91 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -532,6 +532,18 @@ The following diagram shows the Policy configuration service provider in tree fo ### Cellular policies
    +
    + Cellular/LetAppsAccessCellularData +
    +
    + Cellular/LetAppsAccessCellularData_ForceAllowTheseApps +
    +
    + Cellular/LetAppsAccessCellularData_ForceDenyTheseApps +
    +
    + Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps +
    Cellular/ShowAppCellularAccessUI
    @@ -2584,6 +2596,9 @@ The following diagram shows the Policy configuration service provider in tree fo
    Start/HideLock
    +
    + Start/HidePeopleBar +
    Start/HidePowerButton
    diff --git a/windows/client-management/mdm/policy-csp-authentication.md b/windows/client-management/mdm/policy-csp-authentication.md index 14c360f83a..6a21929f0c 100644 --- a/windows/client-management/mdm/policy-csp-authentication.md +++ b/windows/client-management/mdm/policy-csp-authentication.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 11/01/2017 +ms.date: 11/16/2017 --- # Policy CSP - Authentication @@ -204,16 +204,17 @@ ms.date: 11/01/2017 -

    Added in Windows 10, version 1709. Specifies whether Fast Identity Online (FIDO) device can be used to sign on. +

    Preview release in Windows 10, version 1709. Supported in the next release. Specifies whether Fast Identity Online (FIDO) device can be used to sign on. This policy enables the Windows logon credential provider for FIDO 2.0 +

    Value type is integer. + +

    Here is an example scenario: At Contoso, there are a lot of shared devices and kiosks that employees throughout the day using as many as 20 different devices. To minimize the loss in productivity when employees have to login with username and password everytime they pick up a device, the IT admin deploys SharePC CSP and Authentication/AllowFidoDeviceSignon policy to shared devices. The IT admin provisions and distributes FIDO 2.0 devices to employees, which allows them to authenticate to various shared devices and PCs.

    The following list shows the supported values: - 0 - Do not allow. The FIDO device credential provider disabled.  - 1 - Allow. The FIDO device credential provider is enabled and allows usage of FIDO devices to sign into an Windows. -

    Value type is integer. -

    diff --git a/windows/client-management/mdm/policy-csp-cellular.md b/windows/client-management/mdm/policy-csp-cellular.md index 250e605bc9..b070a9305e 100644 --- a/windows/client-management/mdm/policy-csp-cellular.md +++ b/windows/client-management/mdm/policy-csp-cellular.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 11/01/2017 +ms.date: 11/16/2017 --- # Policy CSP - Cellular @@ -19,11 +19,166 @@ ms.date: 11/01/2017 ## Cellular policies
    +
    + Cellular/LetAppsAccessCellularData +
    +
    + Cellular/LetAppsAccessCellularData_ForceAllowTheseApps +
    +
    + Cellular/LetAppsAccessCellularData_ForceDenyTheseApps +
    +
    + Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps +
    Cellular/ShowAppCellularAccessUI
    +
    + +**Cellular/LetAppsAccessCellularData** + + +
    [eUICCs CSP](euiccs-csp.md)
    + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark3check mark3check mark3check mark3check mark3cross markcross mark
    + + + +Added in Windows 10, version 1709. This policy setting specifies whether Windows apps can access cellular data. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access cellular data by using Settings > Network - Internet > Cellular on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access cellular data and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access cellular data and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access cellular data by using Settings > Network - Internet > Cellular on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.” + +Suported values: + +- 0 - User is in control +- 1 - Force Allow +- 2 - Force Deny + + + +
    + +**Cellular/LetAppsAccessCellularData_ForceAllowTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark3check mark3check mark3check mark3check mark3cross markcross mark
    + + + +Added in Windows 10, version 1709. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. Value type is string. + + +
    + +**Cellular/LetAppsAccessCellularData_ForceDenyTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark3check mark3check mark3check mark3check mark3cross markcross mark
    + + + +Added in Windows 10, version 1709. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. Value type is string. + + +
    + +**Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark3check mark3check mark3check mark3check mark3cross markcross mark
    + + + +Added in Windows 10, version 1709. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the cellular data access setting for the listed apps. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. Value type is string. + +
    **Cellular/ShowAppCellularAccessUI** @@ -61,6 +216,16 @@ ms.date: 11/01/2017 +This policy setting configures the visibility of the link to the per-application cellular access control page in the cellular setting UX. + +If this policy setting is enabled, a drop-down list box presenting possible values will be active. Select "Hide" or "Show" to hide or show the link to the per-application cellular access control page. + +If this policy setting is disabled or is not configured, the link to the per-application cellular access control page is showed by default.” + +Supported values: + +- 0 - Hide +- 1 - Show > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). diff --git a/windows/client-management/mdm/policy-csp-start.md b/windows/client-management/mdm/policy-csp-start.md index 8ab24a2ad2..d3392ef73f 100644 --- a/windows/client-management/mdm/policy-csp-start.md +++ b/windows/client-management/mdm/policy-csp-start.md @@ -67,6 +67,9 @@ ms.date: 11/01/2017
    Start/HideLock
    +
    + Start/HidePeopleBar +
    Start/HidePowerButton
    @@ -901,6 +904,41 @@ ms.date: 11/01/2017 1. Enable policy. 2. Open Start, click on the user tile, and verify "Lock" is not available. + + +
    + +**Start/HidePeopleBar** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark3check mark3check mark3check mark3cross markcross mark
    + + + + +

    Added in Windows 10, version 1709. Enabling this policy removes the people icon from the taskbar as well as the corresponding settings toggle. It also prevents users from pinning people to the taskbar. + +

    Value type is integer. +