CSP Changes 2404

2025-05-12 05:17:22 +00:00 · 2024-05-20 11:37:55 -06:00 · 2024-05-20 11:37:55 -06:00 · b80c59dda8
commit b80c59dda8
parent 0e45abf67f
11 changed files with 531 additions and 38 deletions
--- a/windows/client-management/mdm/Language-pack-management-csp.md
+++ b/windows/client-management/mdm/Language-pack-management-csp.md
@ -1,7 +1,7 @@
 ---
 title: LanguagePackManagement CSP
 description: Learn more about the LanguagePackManagement CSP.
-ms.date: 01/18/2024
+ms.date: 05/20/2024
 ---

 <!-- Auto-Generated CSP Document -->
@ -41,7 +41,7 @@ The following list shows the LanguagePackManagement configuration service provid
 <!-- Device-Install-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] |
+| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
 <!-- Device-Install-Applicability-End -->

 <!-- Device-Install-OmaUri-Begin -->
@ -80,7 +80,7 @@ Language to be installed or being installed.
 <!-- Device-Install-{Language ID}-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] |
+| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
 <!-- Device-Install-{Language ID}-Applicability-End -->

 <!-- Device-Install-{Language ID}-OmaUri-Begin -->
@ -120,7 +120,7 @@ Language tag of the language to be installed or being installed.
 <!-- Device-Install-{Language ID}-CopyToDeviceInternationalSettings-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] |
+| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
 <!-- Device-Install-{Language ID}-CopyToDeviceInternationalSettings-Applicability-End -->

 <!-- Device-Install-{Language ID}-CopyToDeviceInternationalSettings-OmaUri-Begin -->
@ -169,7 +169,7 @@ Copies the language to the international settings (that is, locale, input layout
 <!-- Device-Install-{Language ID}-EnableLanguageFeatureInstallations-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] |
+| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
 <!-- Device-Install-{Language ID}-EnableLanguageFeatureInstallations-Applicability-End -->

 <!-- Device-Install-{Language ID}-EnableLanguageFeatureInstallations-OmaUri-Begin -->
@ -218,7 +218,7 @@ Enables installations of all available language features when the value is true.
 <!-- Device-Install-{Language ID}-ErrorCode-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] |
+| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
 <!-- Device-Install-{Language ID}-ErrorCode-Applicability-End -->

 <!-- Device-Install-{Language ID}-ErrorCode-OmaUri-Begin -->
@ -257,7 +257,7 @@ Error code of queued language installation. 0 if there is no error.
 <!-- Device-Install-{Language ID}-StartInstallation-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] |
+| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
 <!-- Device-Install-{Language ID}-StartInstallation-Applicability-End -->

 <!-- Device-Install-{Language ID}-StartInstallation-OmaUri-Begin -->
@ -296,7 +296,7 @@ Execution node to queue a language for installation on the device.
 <!-- Device-Install-{Language ID}-Status-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] |
+| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
 <!-- Device-Install-{Language ID}-Status-Applicability-End -->

 <!-- Device-Install-{Language ID}-Status-OmaUri-Begin -->
@ -335,7 +335,7 @@ Status of the language queued for install. 0 - not started; 1 - in progress; 2 -
 <!-- Device-InstalledLanguages-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] |
+| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
 <!-- Device-InstalledLanguages-Applicability-End -->

 <!-- Device-InstalledLanguages-OmaUri-Begin -->
@ -374,7 +374,7 @@ Languages currently installed on the device.
 <!-- Device-InstalledLanguages-{Language ID}-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] |
+| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
 <!-- Device-InstalledLanguages-{Language ID}-Applicability-End -->

 <!-- Device-InstalledLanguages-{Language ID}-OmaUri-Begin -->
@ -414,7 +414,7 @@ Language tag of an installed language on the device. Delete to uninstall.
 <!-- Device-InstalledLanguages-{Language ID}-LanguageFeatures-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] |
+| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
 <!-- Device-InstalledLanguages-{Language ID}-LanguageFeatures-Applicability-End -->

 <!-- Device-InstalledLanguages-{Language ID}-LanguageFeatures-OmaUri-Begin -->
@ -453,7 +453,7 @@ Numeric representation of the language features installed. Basic Typing - 1 (0x1
 <!-- Device-InstalledLanguages-{Language ID}-Providers-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] |
+| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
 <!-- Device-InstalledLanguages-{Language ID}-Providers-Applicability-End -->

 <!-- Device-InstalledLanguages-{Language ID}-Providers-OmaUri-Begin -->
@ -492,7 +492,7 @@ Numeric representation of how a language is installed. 1 - The system language p
 <!-- Device-LanguageSettings-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] |
+| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
 <!-- Device-LanguageSettings-Applicability-End -->

 <!-- Device-LanguageSettings-OmaUri-Begin -->
@ -531,7 +531,7 @@ Language settings of the device.
 <!-- Device-LanguageSettings-SystemPreferredUILanguages-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] |
+| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
 <!-- Device-LanguageSettings-SystemPreferredUILanguages-Applicability-End -->

 <!-- Device-LanguageSettings-SystemPreferredUILanguages-OmaUri-Begin -->
--- a/windows/client-management/mdm/defender-csp.md
+++ b/windows/client-management/mdm/defender-csp.md
@ -1,7 +1,7 @@
 ---
 title: Defender CSP
 description: Learn more about the Defender CSP.
-ms.date: 01/31/2024
+ms.date: 05/20/2024
 ---

 <!-- Auto-Generated CSP Document -->
@ -53,6 +53,8 @@ The following list shows the Defender configuration service provider nodes:
          - [RuleData](#configurationdevicecontrolpolicyrulesruleidruledata)
    - [DeviceControlEnabled](#configurationdevicecontrolenabled)
    - [DisableCacheMaintenance](#configurationdisablecachemaintenance)
+    - [DisableCoreServiceECSIntegration](#configurationdisablecoreserviceecsintegration)
+    - [DisableCoreServiceTelemetry](#configurationdisablecoreservicetelemetry)
    - [DisableCpuThrottleOnIdleScans](#configurationdisablecputhrottleonidlescans)
    - [DisableDatagramProcessing](#configurationdisabledatagramprocessing)
    - [DisableDnsOverTcpParsing](#configurationdisablednsovertcpparsing)
@ -71,6 +73,8 @@ The following list shows the Defender configuration service provider nodes:
    - [EnableConvertWarnToBlock](#configurationenableconvertwarntoblock)
    - [EnableDnsSinkhole](#configurationenablednssinkhole)
    - [EnableFileHashComputation](#configurationenablefilehashcomputation)
+    - [EnableUdpReceiveOffload](#configurationenableudpreceiveoffload)
+    - [EnableUdpSegmentationOffload](#configurationenableudpsegmentationoffload)
    - [EngineUpdatesChannel](#configurationengineupdateschannel)
    - [ExcludedIpAddresses](#configurationexcludedipaddresses)
    - [HideExclusionsFromLocalAdmins](#configurationhideexclusionsfromlocaladmins)
@ -1585,6 +1589,104 @@ Defines whether the cache maintenance idle task will perform the cache maintenan

 <!-- Device-Configuration-DisableCacheMaintenance-End -->

+<!-- Device-Configuration-DisableCoreServiceECSIntegration-Begin -->
+### Configuration/DisableCoreServiceECSIntegration
+
+<!-- Device-Configuration-DisableCoreServiceECSIntegration-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
+<!-- Device-Configuration-DisableCoreServiceECSIntegration-Applicability-End -->
+
+<!-- Device-Configuration-DisableCoreServiceECSIntegration-OmaUri-Begin -->
+```Device
+./Device/Vendor/MSFT/Defender/Configuration/DisableCoreServiceECSIntegration
+```
+<!-- Device-Configuration-DisableCoreServiceECSIntegration-OmaUri-End -->
+
+<!-- Device-Configuration-DisableCoreServiceECSIntegration-Description-Begin -->
+<!-- Description-Source-DDF -->
+Turn off ECS integration for Defender core service.
+<!-- Device-Configuration-DisableCoreServiceECSIntegration-Description-End -->
+
+<!-- Device-Configuration-DisableCoreServiceECSIntegration-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- Device-Configuration-DisableCoreServiceECSIntegration-Editable-End -->
+
+<!-- Device-Configuration-DisableCoreServiceECSIntegration-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | `int` |
+| Access Type | Add, Delete, Get, Replace |
+| Default Value  | 0x0 |
+<!-- Device-Configuration-DisableCoreServiceECSIntegration-DFProperties-End -->
+
+<!-- Device-Configuration-DisableCoreServiceECSIntegration-AllowedValues-Begin -->
+**Allowed values**:
+
+| Flag | Description |
+|:--|:--|
+| 0x0 (Default) | The Defender core service will use the Experimentation and Configuration Service (ECS) to rapidly deliver critical, org-specific fixes. |
+| 0x1 | The Defender core service stops using the Experimentation and Configuration Service (ECS). Fixes will continue to be delivered through security intelligence updates. |
+<!-- Device-Configuration-DisableCoreServiceECSIntegration-AllowedValues-End -->
+
+<!-- Device-Configuration-DisableCoreServiceECSIntegration-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- Device-Configuration-DisableCoreServiceECSIntegration-Examples-End -->
+
+<!-- Device-Configuration-DisableCoreServiceECSIntegration-End -->
+
+<!-- Device-Configuration-DisableCoreServiceTelemetry-Begin -->
+### Configuration/DisableCoreServiceTelemetry
+
+<!-- Device-Configuration-DisableCoreServiceTelemetry-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
+<!-- Device-Configuration-DisableCoreServiceTelemetry-Applicability-End -->
+
+<!-- Device-Configuration-DisableCoreServiceTelemetry-OmaUri-Begin -->
+```Device
+./Device/Vendor/MSFT/Defender/Configuration/DisableCoreServiceTelemetry
+```
+<!-- Device-Configuration-DisableCoreServiceTelemetry-OmaUri-End -->
+
+<!-- Device-Configuration-DisableCoreServiceTelemetry-Description-Begin -->
+<!-- Description-Source-DDF -->
+Turn off OneDsCollector telemetry for Defender core service.
+<!-- Device-Configuration-DisableCoreServiceTelemetry-Description-End -->
+
+<!-- Device-Configuration-DisableCoreServiceTelemetry-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- Device-Configuration-DisableCoreServiceTelemetry-Editable-End -->
+
+<!-- Device-Configuration-DisableCoreServiceTelemetry-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | `int` |
+| Access Type | Add, Delete, Get, Replace |
+| Default Value  | 0x0 |
+<!-- Device-Configuration-DisableCoreServiceTelemetry-DFProperties-End -->
+
+<!-- Device-Configuration-DisableCoreServiceTelemetry-AllowedValues-Begin -->
+**Allowed values**:
+
+| Flag | Description |
+|:--|:--|
+| 0x0 (Default) | The Defender core service will use the OneDsCollector framework to rapidly collect telemetry. |
+| 0x1 | The Defender core service stops using the OneDsCollector framework to rapidly collect telemetry, impacting Microsoft's ability to quickly recognize and address poor performance, false positives, and other problems. |
+<!-- Device-Configuration-DisableCoreServiceTelemetry-AllowedValues-End -->
+
+<!-- Device-Configuration-DisableCoreServiceTelemetry-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- Device-Configuration-DisableCoreServiceTelemetry-Examples-End -->
+
+<!-- Device-Configuration-DisableCoreServiceTelemetry-End -->
+
 <!-- Device-Configuration-DisableCpuThrottleOnIdleScans-Begin -->
 ### Configuration/DisableCpuThrottleOnIdleScans

@ -2372,6 +2474,9 @@ This setting controls whether network protection blocks network traffic instead
 <!-- Device-Configuration-EnableDnsSinkhole-Begin -->
 ### Configuration/EnableDnsSinkhole

+> [!NOTE]
+> This policy is deprecated and may be removed in a future release.
+
 <!-- Device-Configuration-EnableDnsSinkhole-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
@ -2467,6 +2572,104 @@ Enables or disables file hash computation feature. When this feature is enabled

 <!-- Device-Configuration-EnableFileHashComputation-End -->

+<!-- Device-Configuration-EnableUdpReceiveOffload-Begin -->
+### Configuration/EnableUdpReceiveOffload
+
+<!-- Device-Configuration-EnableUdpReceiveOffload-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
+<!-- Device-Configuration-EnableUdpReceiveOffload-Applicability-End -->
+
+<!-- Device-Configuration-EnableUdpReceiveOffload-OmaUri-Begin -->
+```Device
+./Device/Vendor/MSFT/Defender/Configuration/EnableUdpReceiveOffload
+```
+<!-- Device-Configuration-EnableUdpReceiveOffload-OmaUri-End -->
+
+<!-- Device-Configuration-EnableUdpReceiveOffload-Description-Begin -->
+<!-- Description-Source-DDF -->
+This setting enables Udp Receive Offload Network Protection.
+<!-- Device-Configuration-EnableUdpReceiveOffload-Description-End -->
+
+<!-- Device-Configuration-EnableUdpReceiveOffload-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- Device-Configuration-EnableUdpReceiveOffload-Editable-End -->
+
+<!-- Device-Configuration-EnableUdpReceiveOffload-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | `int` |
+| Access Type | Add, Delete, Get, Replace |
+| Default Value  | 0 |
+<!-- Device-Configuration-EnableUdpReceiveOffload-DFProperties-End -->
+
+<!-- Device-Configuration-EnableUdpReceiveOffload-AllowedValues-Begin -->
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 0 (Default) | Udp Receive Offload is disabled. |
+| 1 | Udp Receive Offload is enabled. |
+<!-- Device-Configuration-EnableUdpReceiveOffload-AllowedValues-End -->
+
+<!-- Device-Configuration-EnableUdpReceiveOffload-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- Device-Configuration-EnableUdpReceiveOffload-Examples-End -->
+
+<!-- Device-Configuration-EnableUdpReceiveOffload-End -->
+
+<!-- Device-Configuration-EnableUdpSegmentationOffload-Begin -->
+### Configuration/EnableUdpSegmentationOffload
+
+<!-- Device-Configuration-EnableUdpSegmentationOffload-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
+<!-- Device-Configuration-EnableUdpSegmentationOffload-Applicability-End -->
+
+<!-- Device-Configuration-EnableUdpSegmentationOffload-OmaUri-Begin -->
+```Device
+./Device/Vendor/MSFT/Defender/Configuration/EnableUdpSegmentationOffload
+```
+<!-- Device-Configuration-EnableUdpSegmentationOffload-OmaUri-End -->
+
+<!-- Device-Configuration-EnableUdpSegmentationOffload-Description-Begin -->
+<!-- Description-Source-DDF -->
+This setting enables Udp Segmentation Offload Network Protection.
+<!-- Device-Configuration-EnableUdpSegmentationOffload-Description-End -->
+
+<!-- Device-Configuration-EnableUdpSegmentationOffload-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- Device-Configuration-EnableUdpSegmentationOffload-Editable-End -->
+
+<!-- Device-Configuration-EnableUdpSegmentationOffload-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | `int` |
+| Access Type | Add, Delete, Get, Replace |
+| Default Value  | 0 |
+<!-- Device-Configuration-EnableUdpSegmentationOffload-DFProperties-End -->
+
+<!-- Device-Configuration-EnableUdpSegmentationOffload-AllowedValues-Begin -->
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 0 (Default) | Udp Segmentation Offload is disabled. |
+| 1 | Udp Segmentation Offload is enabled. |
+<!-- Device-Configuration-EnableUdpSegmentationOffload-AllowedValues-End -->
+
+<!-- Device-Configuration-EnableUdpSegmentationOffload-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- Device-Configuration-EnableUdpSegmentationOffload-Examples-End -->
+
+<!-- Device-Configuration-EnableUdpSegmentationOffload-End -->
+
 <!-- Device-Configuration-EngineUpdatesChannel-Begin -->
 ### Configuration/EngineUpdatesChannel

--- a/windows/client-management/mdm/defender-ddf.md
+++ b/windows/client-management/mdm/defender-ddf.md
@ -1,7 +1,7 @@
 ---
 title: Defender DDF file
 description: View the XML file containing the device description framework (DDF) for the Defender configuration service provider.
-ms.date: 01/31/2024
+ms.date: 05/20/2024
 ---

 <!-- Auto-Generated CSP Document -->
@ -1755,6 +1755,7 @@ The following XML file contains the device description framework (DDF) for the D
              <MSFT:ValueDescription>DNS Sinkhole is enabled</MSFT:ValueDescription>
            </MSFT:Enum>
          </MSFT:AllowedValues>
+          <MSFT:Deprecated OsBuildDeprecated="10.0.14393" />
        </DFProperties>
      </Node>
      <Node>
@ -2721,6 +2722,84 @@ The following XML file contains the device description framework (DDF) for the D
          </MSFT:AllowedValues>
        </DFProperties>
      </Node>
+      <Node>
+        <NodeName>DisableCoreServiceECSIntegration</NodeName>
+        <DFProperties>
+          <AccessType>
+            <Add />
+            <Delete />
+            <Get />
+            <Replace />
+          </AccessType>
+          <DefaultValue>0x0</DefaultValue>
+          <Description>Turn off ECS integration for Defender core service</Description>
+          <DFFormat>
+            <int />
+          </DFFormat>
+          <Occurrence>
+            <One />
+          </Occurrence>
+          <Scope>
+            <Dynamic />
+          </Scope>
+          <DFType>
+            <MIME />
+          </DFType>
+          <MSFT:Applicability>
+            <MSFT:OsBuildVersion>10.0.14393</MSFT:OsBuildVersion>
+            <MSFT:CspVersion>1.3</MSFT:CspVersion>
+          </MSFT:Applicability>
+          <MSFT:AllowedValues ValueType="Flag">
+            <MSFT:Enum>
+              <MSFT:Value>0x0</MSFT:Value>
+              <MSFT:ValueDescription>The Defender core service will use the Experimentation and Configuration Service (ECS) to rapidly deliver critical, org-specific fixes.</MSFT:ValueDescription>
+            </MSFT:Enum>
+            <MSFT:Enum>
+              <MSFT:Value>0x1</MSFT:Value>
+              <MSFT:ValueDescription>The Defender core service stops using the Experimentation and Configuration Service (ECS). Fixes will continue to be delivered through security intelligence updates.</MSFT:ValueDescription>
+            </MSFT:Enum>
+          </MSFT:AllowedValues>
+        </DFProperties>
+      </Node>
+      <Node>
+        <NodeName>DisableCoreServiceTelemetry</NodeName>
+        <DFProperties>
+          <AccessType>
+            <Add />
+            <Delete />
+            <Get />
+            <Replace />
+          </AccessType>
+          <DefaultValue>0x0</DefaultValue>
+          <Description>Turn off OneDsCollector telemetry for Defender core service</Description>
+          <DFFormat>
+            <int />
+          </DFFormat>
+          <Occurrence>
+            <One />
+          </Occurrence>
+          <Scope>
+            <Dynamic />
+          </Scope>
+          <DFType>
+            <MIME />
+          </DFType>
+          <MSFT:Applicability>
+            <MSFT:OsBuildVersion>10.0.14393</MSFT:OsBuildVersion>
+            <MSFT:CspVersion>1.3</MSFT:CspVersion>
+          </MSFT:Applicability>
+          <MSFT:AllowedValues ValueType="Flag">
+            <MSFT:Enum>
+              <MSFT:Value>0x0</MSFT:Value>
+              <MSFT:ValueDescription>The Defender core service will use the OneDsCollector framework to rapidly collect telemetry.</MSFT:ValueDescription>
+            </MSFT:Enum>
+            <MSFT:Enum>
+              <MSFT:Value>0x1</MSFT:Value>
+              <MSFT:ValueDescription>The Defender core service stops using the OneDsCollector framework to rapidly collect telemetry, impacting Microsoft's ability to quickly recognize and address poor performance, false positives, and other problems.</MSFT:ValueDescription>
+            </MSFT:Enum>
+          </MSFT:AllowedValues>
+        </DFProperties>
+      </Node>
      <Node>
        <NodeName>IntelTDTEnabled</NodeName>
        <DFProperties>
@ -2881,6 +2960,84 @@ The following XML file contains the device description framework (DDF) for the D
          </MSFT:AllowedValues>
        </DFProperties>
      </Node>
+      <Node>
+        <NodeName>EnableUdpSegmentationOffload</NodeName>
+        <DFProperties>
+          <AccessType>
+            <Add />
+            <Delete />
+            <Get />
+            <Replace />
+          </AccessType>
+          <DefaultValue>0</DefaultValue>
+          <Description>This setting enables Udp Segmentation Offload Network Protection.</Description>
+          <DFFormat>
+            <int />
+          </DFFormat>
+          <Occurrence>
+            <One />
+          </Occurrence>
+          <Scope>
+            <Dynamic />
+          </Scope>
+          <DFType>
+            <MIME />
+          </DFType>
+          <MSFT:Applicability>
+            <MSFT:OsBuildVersion>10.0.14393</MSFT:OsBuildVersion>
+            <MSFT:CspVersion>1.3</MSFT:CspVersion>
+          </MSFT:Applicability>
+          <MSFT:AllowedValues ValueType="ENUM">
+            <MSFT:Enum>
+              <MSFT:Value>0</MSFT:Value>
+              <MSFT:ValueDescription>Udp Segmentation Offload is disabled</MSFT:ValueDescription>
+            </MSFT:Enum>
+            <MSFT:Enum>
+              <MSFT:Value>1</MSFT:Value>
+              <MSFT:ValueDescription>Udp Segmentation Offload is enabled</MSFT:ValueDescription>
+            </MSFT:Enum>
+          </MSFT:AllowedValues>
+        </DFProperties>
+      </Node>
+      <Node>
+        <NodeName>EnableUdpReceiveOffload</NodeName>
+        <DFProperties>
+          <AccessType>
+            <Add />
+            <Delete />
+            <Get />
+            <Replace />
+          </AccessType>
+          <DefaultValue>0</DefaultValue>
+          <Description>This setting enables Udp Receive Offload Network Protection.</Description>
+          <DFFormat>
+            <int />
+          </DFFormat>
+          <Occurrence>
+            <One />
+          </Occurrence>
+          <Scope>
+            <Dynamic />
+          </Scope>
+          <DFType>
+            <MIME />
+          </DFType>
+          <MSFT:Applicability>
+            <MSFT:OsBuildVersion>10.0.14393</MSFT:OsBuildVersion>
+            <MSFT:CspVersion>1.3</MSFT:CspVersion>
+          </MSFT:Applicability>
+          <MSFT:AllowedValues ValueType="ENUM">
+            <MSFT:Enum>
+              <MSFT:Value>0</MSFT:Value>
+              <MSFT:ValueDescription>Udp Receive Offload is disabled</MSFT:ValueDescription>
+            </MSFT:Enum>
+            <MSFT:Enum>
+              <MSFT:Value>1</MSFT:Value>
+              <MSFT:ValueDescription>Udp Receive Offload is enabled</MSFT:ValueDescription>
+            </MSFT:Enum>
+          </MSFT:AllowedValues>
+        </DFProperties>
+      </Node>
      <Node>
        <NodeName>AllowSwitchToAsyncInspection</NodeName>
        <DFProperties>
--- a/windows/client-management/mdm/enterprisedesktopappmanagement-csp.md
+++ b/windows/client-management/mdm/enterprisedesktopappmanagement-csp.md
@ -1,7 +1,7 @@
 ---
 title: EnterpriseDesktopAppManagement CSP
 description: Learn more about the EnterpriseDesktopAppManagement CSP.
-ms.date: 01/18/2024
+ms.date: 05/20/2024
 ---

 <!-- Auto-Generated CSP Document -->
@ -172,7 +172,7 @@ For more information, see [DownloadInstall XSD Schema](#downloadinstall-xsd-sche
 | Property name | Property value |
 |:--|:--|
 | Format | `xml` |
-| Access Type | Add, Delete, Exec, Get |
+| Access Type | Add, Delete, Exec, Get, Replace |
 <!-- Device-MSI-{ProductID}-DownloadInstall-DFProperties-End -->

 <!-- Device-MSI-{ProductID}-DownloadInstall-Examples-Begin -->
@ -695,7 +695,7 @@ For more information, see [DownloadInstall XSD Schema](#downloadinstall-xsd-sche
 | Property name | Property value |
 |:--|:--|
 | Format | `xml` |
-| Access Type | Add, Delete, Exec, Get |
+| Access Type | Add, Delete, Exec, Get, Replace |
 <!-- User-MSI-{ProductID}-DownloadInstall-DFProperties-End -->

 <!-- User-MSI-{ProductID}-DownloadInstall-Examples-Begin -->
--- a/windows/client-management/mdm/enterprisedesktopappmanagement-ddf-file.md
+++ b/windows/client-management/mdm/enterprisedesktopappmanagement-ddf-file.md
@ -1,7 +1,7 @@
 ---
 title: EnterpriseDesktopAppManagement DDF file
 description: View the XML file containing the device description framework (DDF) for the EnterpriseDesktopAppManagement configuration service provider.
-ms.date: 04/10/2024
+ms.date: 05/20/2024
 ---

 <!-- Auto-Generated CSP Document -->
@ -225,6 +225,7 @@ The following XML file contains the device description framework (DDF) for the E
              <Delete />
              <Exec />
              <Get />
+              <Replace />
            </AccessType>
            <Description><![CDATA[Executes the download and installation of the application. In Windows 10, version 1703 service release, a new tag <DownloadFromAad> was added to the <Enforcement> section of the XML. The default value is 0 (do not send token). This tag is optional and needs to be set to 1 in case the server wants the download URL to get the AADUserToken.]]></Description>
            <DFFormat>
@ -585,6 +586,7 @@ The following XML file contains the device description framework (DDF) for the E
              <Delete />
              <Exec />
              <Get />
+              <Replace />
            </AccessType>
            <Description><![CDATA[Executes the download and installation of the application. In Windows 10, version 1703 service release, a new tag <DownloadFromAad> was added to the <Enforcement> section of the XML. The default value is 0 (do not send token). This tag is optional and needs to be set to 1 in case the server wants the download URL to get the AADUserToken.]]></Description>
            <DFFormat>
--- a/windows/client-management/mdm/laps-csp.md
+++ b/windows/client-management/mdm/laps-csp.md
@ -1,7 +1,7 @@
 ---
 title: LAPS CSP
 description: Learn more about the LAPS CSP.
-ms.date: 01/31/2024
+ms.date: 05/20/2024
 ---

 <!-- Auto-Generated CSP Document -->
@ -432,7 +432,7 @@ If the specified user or group account is invalid the device will fallback to us
 <!-- Device-Policies-AutomaticAccountManagementEnableAccount-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] |
+| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
 <!-- Device-Policies-AutomaticAccountManagementEnableAccount-Applicability-End -->

 <!-- Device-Policies-AutomaticAccountManagementEnableAccount-OmaUri-Begin -->
@ -488,7 +488,7 @@ If not specified, this setting defaults to False.
 <!-- Device-Policies-AutomaticAccountManagementEnabled-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] |
+| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
 <!-- Device-Policies-AutomaticAccountManagementEnabled-Applicability-End -->

 <!-- Device-Policies-AutomaticAccountManagementEnabled-OmaUri-Begin -->
@ -543,7 +543,7 @@ If not specified, this setting defaults to False.
 <!-- Device-Policies-AutomaticAccountManagementNameOrPrefix-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] |
+| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
 <!-- Device-Policies-AutomaticAccountManagementNameOrPrefix-Applicability-End -->

 <!-- Device-Policies-AutomaticAccountManagementNameOrPrefix-OmaUri-Begin -->
@ -587,7 +587,7 @@ If not specified, this setting will default to "WLapsAdmin".
 <!-- Device-Policies-AutomaticAccountManagementRandomizeName-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] |
+| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
 <!-- Device-Policies-AutomaticAccountManagementRandomizeName-Applicability-End -->

 <!-- Device-Policies-AutomaticAccountManagementRandomizeName-OmaUri-Begin -->
@ -643,7 +643,7 @@ If not specified, this setting defaults to False.
 <!-- Device-Policies-AutomaticAccountManagementTarget-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] |
+| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
 <!-- Device-Policies-AutomaticAccountManagementTarget-Applicability-End -->

 <!-- Device-Policies-AutomaticAccountManagementTarget-OmaUri-Begin -->
@ -759,7 +759,7 @@ If not specified, this setting will default to 0.
 <!-- Device-Policies-PassphraseLength-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] |
+| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
 <!-- Device-Policies-PassphraseLength-Applicability-End -->

 <!-- Device-Policies-PassphraseLength-OmaUri-Begin -->
--- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md
+++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md
@ -1,7 +1,7 @@
 ---
 title: Policies in Policy CSP supported by Group Policy
 description: Learn about the policies in Policy CSP supported by Group Policy.
-ms.date: 04/23/2024
+ms.date: 05/20/2024
 ---

 <!-- Auto-Generated CSP Document -->
@ -871,6 +871,8 @@ This article lists the policies in Policy CSP that have a group policy mapping.
 ## WindowsAI

 - [TurnOffWindowsCopilot](policy-csp-windowsai.md)
+- [DisableAIDataAnalysis](policy-csp-windowsai.md)
+- [AllowImageCreator](policy-csp-windowsai.md)

 ## WindowsDefenderSecurityCenter

--- a/windows/client-management/mdm/policy-csp-internetexplorer.md
+++ b/windows/client-management/mdm/policy-csp-internetexplorer.md
@ -1,7 +1,7 @@
 ---
 title: InternetExplorer Policy CSP
 description: Learn more about the InternetExplorer Area in Policy CSP.
-ms.date: 01/18/2024
+ms.date: 05/20/2024
 ---

 <!-- Auto-Generated CSP Document -->
@ -7718,7 +7718,7 @@ High Safety enables applets to run in their sandbox. Disable Java to prevent any
 <!-- IntranetZoneLogonOptions-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| ✅ Device <br> ✅ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
+| ✅ Device <br> ✅ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.2227] and later <br> ✅ Windows 10, version 2004 [10.0.19041.3758] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.2792] and later <br> ✅ Windows Insider Preview [10.0.25398.643] |
 <!-- IntranetZoneLogonOptions-Applicability-End -->

 <!-- IntranetZoneLogonOptions-OmaUri-Begin -->
@ -8793,7 +8793,7 @@ High Safety enables applets to run in their sandbox. Disable Java to prevent any
 <!-- LocalMachineZoneLogonOptions-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| ✅ Device <br> ✅ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
+| ✅ Device <br> ✅ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.2227] and later <br> ✅ Windows 10, version 2004 [10.0.19041.3758] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.2792] and later <br> ✅ Windows Insider Preview [10.0.25398.643] |
 <!-- LocalMachineZoneLogonOptions-Applicability-End -->

 <!-- LocalMachineZoneLogonOptions-OmaUri-Begin -->
@ -17364,7 +17364,7 @@ High Safety enables applets to run in their sandbox. Disable Java to prevent any
 <!-- TrustedSitesZoneLogonOptions-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| ✅ Device <br> ✅ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
+| ✅ Device <br> ✅ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.2227] and later <br> ✅ Windows 10, version 2004 [10.0.19041.3758] and later <br> ✅ Windows 11, version 22H2 [10.0.22621.2792] and later <br> ✅ Windows Insider Preview [10.0.25398.643] |
 <!-- TrustedSitesZoneLogonOptions-Applicability-End -->

 <!-- TrustedSitesZoneLogonOptions-OmaUri-Begin -->
--- a/windows/client-management/mdm/policy-csp-settings.md
+++ b/windows/client-management/mdm/policy-csp-settings.md
@ -1,7 +1,7 @@
 ---
 title: Settings Policy CSP
 description: Learn more about the Settings Area in Policy CSP.
-ms.date: 01/18/2024
+ms.date: 05/20/2024
 ---

 <!-- Auto-Generated CSP Document -->
@ -169,10 +169,13 @@ Allows the user to change date and time settings.
 <!-- AllowEditDeviceName-Begin -->
 ## AllowEditDeviceName

+> [!NOTE]
+> This policy is deprecated and may be removed in a future release.
+
 <!-- AllowEditDeviceName-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
+| ✅ Device <br> ❌ User | Not applicable | ✅ Windows 10, version 1607 [10.0.14393] and later |
 <!-- AllowEditDeviceName-Applicability-End -->

 <!-- AllowEditDeviceName-OmaUri-Begin -->
@ -183,7 +186,7 @@ Allows the user to change date and time settings.

 <!-- AllowEditDeviceName-Description-Begin -->
 <!-- Description-Source-DDF -->
-Allows the user to edit the device name.
+This policy is deprecated.
 <!-- AllowEditDeviceName-Description-End -->

 <!-- AllowEditDeviceName-Editable-Begin -->
--- a/windows/client-management/mdm/policy-csp-windowsai.md
+++ b/windows/client-management/mdm/policy-csp-windowsai.md
@ -1,7 +1,7 @@
 ---
 title: WindowsAI Policy CSP
 description: Learn more about the WindowsAI Area in Policy CSP.
-ms.date: 04/23/2024
+ms.date: 05/20/2024
 ---

 <!-- Auto-Generated CSP Document -->
@ -9,10 +9,136 @@ ms.date: 04/23/2024
 <!-- WindowsAI-Begin -->
 # Policy CSP - WindowsAI

+[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)]
+
 <!-- WindowsAI-Editable-Begin -->
 <!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
 <!-- WindowsAI-Editable-End -->

+<!-- AllowImageCreator-Begin -->
+## AllowImageCreator
+
+<!-- AllowImageCreator-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
+<!-- AllowImageCreator-Applicability-End -->
+
+<!-- AllowImageCreator-OmaUri-Begin -->
+```Device
+./Device/Vendor/MSFT/Policy/Config/WindowsAI/AllowImageCreator
+```
+<!-- AllowImageCreator-OmaUri-End -->
+
+<!-- AllowImageCreator-Description-Begin -->
+<!-- Description-Source-DDF -->
+This policy setting allows you to control whether Image Creator functionality is available in the Windows Paint app.
+
+- If you disable this policy setting, Image Creator functionality won't be accessible in the Windows Paint app.
+
+- If you enable or don't configure this policy setting, users will be able to access Image Creator functionality.
+<!-- AllowImageCreator-Description-End -->
+
+<!-- AllowImageCreator-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- AllowImageCreator-Editable-End -->
+
+<!-- AllowImageCreator-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | `int` |
+| Access Type | Add, Delete, Get, Replace |
+| Default Value  | 1 |
+<!-- AllowImageCreator-DFProperties-End -->
+
+<!-- AllowImageCreator-AllowedValues-Begin -->
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 0 | Disabled. |
+| 1 (Default) | Enabled. |
+<!-- AllowImageCreator-AllowedValues-End -->
+
+<!-- AllowImageCreator-GpMapping-Begin -->
+**Group policy mapping**:
+
+| Name | Value |
+|:--|:--|
+| Name | AllowImageCreator |
+| Path | WindowsAI > AT > WindowsComponents > Paint |
+<!-- AllowImageCreator-GpMapping-End -->
+
+<!-- AllowImageCreator-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- AllowImageCreator-Examples-End -->
+
+<!-- AllowImageCreator-End -->
+
+<!-- DisableAIDataAnalysis-Begin -->
+## DisableAIDataAnalysis
+
+<!-- DisableAIDataAnalysis-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| ❌ Device <br> ✅ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
+<!-- DisableAIDataAnalysis-Applicability-End -->
+
+<!-- DisableAIDataAnalysis-OmaUri-Begin -->
+```User
+./User/Vendor/MSFT/Policy/Config/WindowsAI/DisableAIDataAnalysis
+```
+<!-- DisableAIDataAnalysis-OmaUri-End -->
+
+<!-- DisableAIDataAnalysis-Description-Begin -->
+<!-- Description-Source-DDF -->
+This policy setting allows you to control whether Windows saves snapshots of the screen and analyzes the user's activity on their device.
+
+- If you enable this policy setting, Windows won't be able to save snapshots and users won't be able to search for or browse through their historical device activity using Recall.
+
+- If you disable or don't configure this policy setting, Windows will save snapshots of the screen and users will be able to search for or browse through a timeline of their past activities using Recall.
+<!-- DisableAIDataAnalysis-Description-End -->
+
+<!-- DisableAIDataAnalysis-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- DisableAIDataAnalysis-Editable-End -->
+
+<!-- DisableAIDataAnalysis-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | `int` |
+| Access Type | Add, Delete, Get, Replace |
+| Default Value  | 0 |
+<!-- DisableAIDataAnalysis-DFProperties-End -->
+
+<!-- DisableAIDataAnalysis-AllowedValues-Begin -->
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 0 (Default) | Enable saving Snapshots for Windows. |
+| 1 | Disable saving Snapshots for Windows. |
+<!-- DisableAIDataAnalysis-AllowedValues-End -->
+
+<!-- DisableAIDataAnalysis-GpMapping-Begin -->
+**Group policy mapping**:
+
+| Name | Value |
+|:--|:--|
+| Name | DisableAIDataAnalysis |
+| Path | WindowsAI > AT > WindowsComponents > WindowsAI |
+<!-- DisableAIDataAnalysis-GpMapping-End -->
+
+<!-- DisableAIDataAnalysis-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- DisableAIDataAnalysis-Examples-End -->
+
+<!-- DisableAIDataAnalysis-End -->
+
 <!-- TurnOffWindowsCopilot-Begin -->
 ## TurnOffWindowsCopilot

--- a/windows/client-management/mdm/surfacehub-csp.md
+++ b/windows/client-management/mdm/surfacehub-csp.md
@ -1,7 +1,7 @@
 ---
 title: SurfaceHub CSP
 description: Learn more about the SurfaceHub CSP.
-ms.date: 04/22/2024
+ms.date: 05/20/2024
 ---

 <!-- Auto-Generated CSP Document -->
@ -358,7 +358,7 @@ Possible error values:
 <!-- Device-DeviceAccount-ExchangeModernAuthEnabled-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 2004 [10.0.19041.789] and later <br> ✅ Windows 10, version 2009 [10.0.19042.789] and later <br> ✅ Windows Insider Preview [99.9.9999] |
+| ✅ Device <br> ❌ User | ✅ Pro <br> ✅ Enterprise <br> ✅ Education <br> ✅ Windows SE <br> ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 2004 [10.0.19041.789] and later <br> ✅ Windows 10, version 2009 [10.0.19042.789] and later <br> ✅ Windows Insider Preview |
 <!-- Device-DeviceAccount-ExchangeModernAuthEnabled-Applicability-End -->

 <!-- Device-DeviceAccount-ExchangeModernAuthEnabled-OmaUri-Begin -->