diff --git a/.openpublishing.redirection.education.json b/.openpublishing.redirection.education.json index 7e028ba6b7..e27a545a00 100644 --- a/.openpublishing.redirection.education.json +++ b/.openpublishing.redirection.education.json @@ -229,6 +229,11 @@ "source_path": "education/windows/windows-editions-for-education-customers.md", "redirect_url": "/education/windows", "redirect_document_id": false + }, + { + "source_path": "education/windows/configure-windows-for-education.md", + "redirect_url": "/education/windows", + "redirect_document_id": false } ] } \ No newline at end of file diff --git a/education/windows/configure-windows-for-education.md b/education/windows/configure-windows-for-education.md deleted file mode 100644 index d9b96510a0..0000000000 --- a/education/windows/configure-windows-for-education.md +++ /dev/null @@ -1,159 +0,0 @@ ---- -title: Windows 10 configuration recommendations for education customers -description: Learn how to configure the OS diagnostic data, consumer experiences, Cortana, search, and some of the preinstalled apps, so that Windows is ready for your school. -ms.topic: how-to -ms.date: 08/10/2022 -appliesto: - - ✅ Windows 10 ---- -# Windows 10 configuration recommendations for education customers - -Privacy is important to us, we want to provide you with ways to customize the OS diagnostic data, consumer experiences, Cortana, search, and some of the preinstalled apps, for usage with [education editions of Windows 10](windows-editions-for-education-customers.md) in education environments. These features work on all Windows 10 editions, but education editions of Windows 10 have the settings preconfigured. We recommend that all Windows 10 devices in an education setting be configured with **[SetEduPolicies](#setedupolicies)** enabled. For more information, see the following table. To learn more about Microsoft's commitment to privacy, see [Windows 10 and privacy](https://go.microsoft.com/fwlink/?LinkId=809305). - -We want all students to have the chance to use the apps they need for success in the classroom and all school personnel to have apps they need for their job. Students and school personnel who use assistive technology apps not available in the Microsoft Store, and use devices running Windows 10 S, will be able to configure the device at no extra charge to Windows 10 Pro Education. To learn more about the steps to configure this device, see [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](change-to-pro-education.md). - -In Windows 10, version 1703 (Creators Update), it's straightforward to configure Windows to be education ready. - -| Area | How to configure | What this area does | Windows 10 Education | Windows 10 Pro Education | Windows 10 S | -| --- | --- | --- | --- | --- | --- | -| **Diagnostic Data** | **AllowTelemetry** | Sets Diagnostic Data to [Basic](/windows/configuration/configure-windows-telemetry-in-your-organization) | This feature is already set | This feature is already set | The policy must be set | -| **Microsoft consumer experiences** | **SetEduPolicies** | Disables suggested content from Windows such as app recommendations | This feature is already set | This feature is already set | The policy must be set | -| **Cortana** | **AllowCortana** | Disables Cortana

* Cortana is enabled by default on all editions in Windows 10, version 1703 | If using Windows 10 Education, upgrading from Windows 10, version 1607 to Windows 10, version 1703 will enable Cortana.

See the [Recommended configuration](#recommended-configuration) section below for recommended Cortana settings. | If using Windows 10 Pro Education, upgrading from Windows 10, version 1607 to Windows 10, version 1703 will enable Cortana.

See the [Recommended configuration](#recommended-configuration) section below for recommended Cortana settings. | See the [Recommended configuration](#recommended-configuration) section below for recommended Cortana settings. | -| **Safe search** | **SetEduPolicies** | Locks Bing safe search to Strict in Microsoft Edge | This feature is already set | This feature is already set | The policy must be set | -| **Bing search advertising** | Ad free search with Bing | Disables ads when searching the internet with Bing in Microsoft Edge. See [Ad-free search with Bing](#ad-free-search-with-bing | View configuration instructions as detailed in [Ad-free search with Bing](#ad-free-search-with-bing) | View configuration instructions as detailed in [Ad-free search with Bing](#ad-free-search-with-bing) | View configuration instructions as detailed in [Ad-free search with Bing](#ad-free-search-with-bing) | -| **Apps** | **SetEduPolicies** | Preinstalled apps like Microsoft Edge, Movies & TV, Groove, and Skype become education ready

* Any app can detect Windows is running in an education ready configuration through [IsEducationEnvironment](/uwp/api/windows.system.profile.educationsettings) | This feature is already set | This feature is already set | The policy must be set | - - -## Recommended configuration -It's easy to be education ready when using Microsoft products. We recommend the following configuration: - -1. Use an Office 365 Education tenant. - - With Office 365, you also have Microsoft Entra ID. To learn more about Office 365 Education features and pricing, see [Office 365 Education plans and pricing](https://products.office.com/en-us/academic/compare-office-365-education-plans). - -2. Activate Intune for Education in your tenant. - - You can [sign up to learn more about Intune for Education](https://info.microsoft.com/US-WNDWS-CNTNT-FY17-01Jan-17-IntuneforEducationlandingpageandnurture292531_01Registration-ForminBody.html). - -3. On PCs running Windows 10, version 1703: - 1. Provision the PC using one of these methods: - * [Provision PCs with the Set up School PCs app](use-set-up-school-pcs-app.md) - The usage of this method will automatically set both **SetEduPolicies** to True and **AllowCortana** to False. - * [Provision PCs with a custom package created with Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-create-package) - Make sure to set both **SetEduPolicies** to True and **AllowCortana** to False. - 2. Join the PC to Microsoft Entra ID. - * Use Set up School PCs or Windows Configuration Designer to bulk enroll to Microsoft Entra ID. - * Manually Microsoft Entra join the PC during the Windows device setup experience. - 3. Enroll the PCs in MDM. - * If you've activated Intune for Education in your Microsoft Entra tenant, enrollment will happen automatically when the PC is joined to Microsoft Entra ID. Intune for Education will automatically set **SetEduPolicies** to True and **AllowCortana** to False. - 4. Ensure that needed assistive technology apps can be used. - * If you've students or school personnel who rely on assistive technology apps that aren't available in the Microsoft Store, and who are using a Windows 10 S device, configure their device to Windows 10 Pro Education to allow the download and use of non-Microsoft Store assistive technology apps. See [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](change-to-pro-education.md) for more info. - -4. Distribute the PCs to students. - - Students sign in with their Azure AD/Office 365 identity, which enables single sign-on to Bing in Microsoft Edge, enabling an ad-free search experience with Bing in Microsoft Edge. - -5. Ongoing management through Intune for Education. - - You can set many policies through Intune for Education, including **SetEduPolicies** and **AllowCortana**, for ongoing management of the PCs. - -## Configuring Windows -You can configure Windows through provisioning or management tools including industry standard MDM. -- Provisioning - A one-time setup process. -- Management - A one-time and/or ongoing management of a PC by setting policies. - -You can set all the education compliance areas through both provisioning and management tools. Additionally, these Microsoft education tools will ensure PCs that you set up are education ready: -- [Set up School PCs](use-set-up-school-pcs-app.md) -- [Intune for Education](/intune-education/available-settings) - -## AllowCortana -**AllowCortana** is a policy that enables or disables Cortana. It's a policy node in the Policy configuration service provider, [AllowCortana](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowcortana). - -> [!NOTE] -> See the [Recommended configuration](#recommended-configuration) section for recommended Cortana settings. - -Use one of these methods to set this policy. - -### MDM -- Intune for Education automatically sets this policy in the **All devices** group policy configuration. -- If you're using an MDM provider other than Intune for Education, check your MDM provider documentation on how to set this policy. - - If your MDM provider doesn't explicitly support this policy, you can manually set this policy if your MDM provider allows specific OMA-URIs to be manually set. - - For example, in Intune, create a new configuration policy and add an OMA-URI. - - OMA-URI: ./Vendor/MSFT/Policy/Config/Experience/AllowCortana - - Data type: Integer - - Value: 0 - -### Group Policy -Set **Computer Configuration > Administrative Templates > Windows Components > Search > AllowCortana** to **Disabled**. - -### Provisioning tools -- [Set up School PCs](use-set-up-school-pcs-app.md) always sets this policy in provisioning packages it creates. -- [Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-create-package) - - Under **Runtime settings**, click the **Policies** settings group, set **Experience > Cortana** to **No**. - -## SetEduPolicies -**SetEduPolicies** is a policy that applies a set of configuration behaviors to Windows. It's a policy node in the [SharedPC configuration service provider](/windows/client-management/mdm/sharedpc-csp). - -Use one of these methods to set this policy. - -### MDM -- Intune for Education automatically sets this policy in the **All devices** group policy configuration. -- If you're using an MDM provider other than Intune for Education, check your MDM provider documentation on how to set this policy. - - If your MDM provider doesn't explicitly support this policy, you can manually set this policy if your MDM provider allows specific OMA-URIs to be manually set. - - For example, in Intune, create a new configuration policy and add an OMA-URI. - - OMA-URI: ./Vendor/MSFT/SharedPC/SetEduPolicies - - Data type: Boolean - - Value: true - - ![Create an OMA URI for SetEduPolices.](images/setedupolicies_omauri.png) - -### Group Policy -**SetEduPolicies** isn't natively supported in Group Policy. Instead, use the [MDM Bridge WMI Provider](/windows/win32/dmwmibridgeprov/mdm-bridge-wmi-provider-portal) to set the policy in [MDM SharedPC](/windows/win32/dmwmibridgeprov/mdm-sharedpc). - -For example: - -- Open PowerShell as an administrator and enter the following: - - ``` - $sharedPC = Get-CimInstance -Namespace "root\cimv2\mdm\dmmap" -ClassName "MDM_SharedPC" - - $sharedPC.SetEduPolicies = $True - - Set-CimInstance -CimInstance $sharedPC - - Get-CimInstance -Namespace $namespaceName -ClassName $MDM_SharedPCClass - ``` - -### Provisioning tools -- [Set up School PCs](use-set-up-school-pcs-app.md) always sets this policy in provisioning packages it creates. -- [Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-create-package) - - Under **Runtime settings**, click the **SharedPC** settings group, set **PolicyCustomization > SetEduPolicies** to **True**. - - ![Set SetEduPolicies to True in Windows Configuration Designer.](images/wcd/setedupolicies.png) - -## Ad-free search with Bing -Provide an ad-free experience that is a safer, more private search option for K–12 education institutions in the United States. - -### Configurations - - - -#### Microsoft Entra ID and Office 365 Education tenant -To suppress ads when searching with Bing on Microsoft Edge on any network, follow these steps: - -1. Ensure your Office 365 tenant is registered as an education tenant. For more information, see [Verify your Office 365 domain to prove education status](https://support.office.com/article/Verify-your-Office-365-domain-to-prove-ownership-nonprofit-or-education-status-or-to-activate-viva-engage-87d1844e-aa47-4dc0-a61b-1b773fd4e590). -2. Domain join the Windows 10 PCs to your Microsoft Entra tenant (this tenant is the same as your Office 365 tenant). -3. Configure **SetEduPolicies** according to one of the methods described in the previous sections in this topic. -4. Have students sign in with their Microsoft Entra identity, which is the same as your Office 365 identity, to use the PC. -> [!NOTE] -> If you are verifying your Office 365 domain to prove education status (step 1 above), you may need to wait up to 7 days for the ad-free experience to take effect. Microsoft recommends not to roll out the browser to your students until that time. - -#### Office 365 sign-in to Bing -To suppress ads only when the student signs into Bing with their Office 365 account in Microsoft Edge, follow these steps: - -1. Configure **SetEduPolicies** according to one of the methods described in the previous sections in this topic. -2. Have students sign into Bing with their Office 365 account. - - -## Related topics -[Deployment recommendations for school IT administrators](edu-deployment-recommendations.md) diff --git a/education/windows/images/setedupolicies_omauri.png b/education/windows/images/setedupolicies_omauri.png deleted file mode 100644 index eb3d9e216c..0000000000 Binary files a/education/windows/images/setedupolicies_omauri.png and /dev/null differ diff --git a/education/windows/images/wcd/setedupolicies.png b/education/windows/images/wcd/setedupolicies.png deleted file mode 100644 index e240063f68..0000000000 Binary files a/education/windows/images/wcd/setedupolicies.png and /dev/null differ diff --git a/education/windows/images/wcd/wcd_settings_assignedaccess.png b/education/windows/images/wcd/wcd_settings_assignedaccess.png deleted file mode 100644 index 443a5d0688..0000000000 Binary files a/education/windows/images/wcd/wcd_settings_assignedaccess.png and /dev/null differ diff --git a/windows/application-management/app-v/appv-planning-for-high-availability-with-appv.md b/windows/application-management/app-v/appv-planning-for-high-availability-with-appv.md index cb1db35d6e..aeb7575b4c 100644 --- a/windows/application-management/app-v/appv-planning-for-high-availability-with-appv.md +++ b/windows/application-management/app-v/appv-planning-for-high-availability-with-appv.md @@ -32,7 +32,7 @@ You can use Internet Information Services' (IIS) network load balancing (NLB) to Review the following articles to learn more about configuring IIS and NLB for computers running Windows Server operating systems: -* [Achieving High Availability and Scalability - ARR and NLB](https://www.iis.net/learn/extensions/configuring-application-request-routing-arr/achieving-high-availability-and-scalability-arr-and-nlb) describes how to configure IIS 7.0. +* [Achieving High Availability and Scalability - ARR and NLB](/iis/extensions/configuring-application-request-routing-arr/achieving-high-availability-and-scalability-arr-and-nlb) describes how to configure IIS 7.0. * [Network load balancing overview](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831698(v=ws.11)) will tell you more about how to configure Microsoft Windows Server. @@ -88,13 +88,13 @@ Use the following steps to modify the connection string to include ```failover p 3. Modify the **MANAGEMENT\_SQL\_CONNECTION\_STRING** value with the ```failover partner = ``` value. 4. Restart management service using the IIS console. > [!NOTE] - >Database Mirroring is on the list of [deprecated database engine features in SQL Server 2012]() due to the **AlwaysOn** feature available starting with Microsoft SQL Server 2012. + >Database Mirroring is on the list of [deprecated database engine features in SQL Server 2012](/previous-versions/sql/sql-server-2012/ms143729(v=sql.110)) due to the **AlwaysOn** feature available starting with Microsoft SQL Server 2012. -Click any of the following links for more information: +For more information, see the following articles: * [Prepare a mirror database for mirroring (SQL Server)](/sql/database-engine/database-mirroring/prepare-a-mirror-database-for-mirroring-sql-server). * [Establish a database mirroring session using Windows Authentication (SQL Server Management Studio)](/sql/database-engine/database-mirroring/establish-database-mirroring-session-windows-authentication). -* [Deprecated database engine features in SQL Server 2012](). +* [Deprecated database engine features in SQL Server 2012](/previous-versions/sql/sql-server-2012/ms143729(v=sql.110)). ## Support for Microsoft SQL Server Always On configuration diff --git a/windows/client-management/manage-windows-copilot.md b/windows/client-management/manage-windows-copilot.md index 24110d05f3..918fe88905 100644 --- a/windows/client-management/manage-windows-copilot.md +++ b/windows/client-management/manage-windows-copilot.md @@ -6,7 +6,9 @@ ms.subservice: windows-copilot ms.date: 03/21/2024 ms.author: mstewart author: mestew -ms.collection: windows-copilot +ms.collection: + - windows-copilot + - magic-ai-copilot appliesto: - ✅ Windows 11, version 22H2 or later --- diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md index 49d00a03bf..6542f4aa17 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md @@ -1,7 +1,7 @@ --- title: Policies in Policy CSP supported by Group Policy description: Learn about the policies in Policy CSP supported by Group Policy. -ms.date: 04/10/2024 +ms.date: 04/23/2024 --- @@ -871,7 +871,6 @@ This article lists the policies in Policy CSP that have a group policy mapping. ## WindowsAI - [TurnOffWindowsCopilot](policy-csp-windowsai.md) -- [DisableAIDataAnalysis](policy-csp-windowsai.md) ## WindowsDefenderSecurityCenter diff --git a/windows/client-management/mdm/policy-csp-windowsai.md b/windows/client-management/mdm/policy-csp-windowsai.md index aa027def07..7f0e55df51 100644 --- a/windows/client-management/mdm/policy-csp-windowsai.md +++ b/windows/client-management/mdm/policy-csp-windowsai.md @@ -1,7 +1,7 @@ --- title: WindowsAI Policy CSP description: Learn more about the WindowsAI Area in Policy CSP. -ms.date: 01/31/2024 +ms.date: 04/23/2024 --- @@ -9,74 +9,10 @@ ms.date: 01/31/2024 # Policy CSP - WindowsAI -[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] - - -## DisableAIDataAnalysis - - -| Scope | Editions | Applicable OS | -|:--|:--|:--| -| ❌ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] | - - - -```User -./User/Vendor/MSFT/Policy/Config/WindowsAI/DisableAIDataAnalysis -``` - - - - -This policy setting allows you to prevent Windows AI from using and analyzing user patterns and data. - -- If you enable this policy setting, Windows AI won't be able to take advantage of historical user patterns. - -- If you disable or don't configure this policy setting, Windows AI will be able to assist users by considering their historical behaviors and data. - - - - - - - -**Description framework properties**: - -| Property name | Property value | -|:--|:--| -| Format | `int` | -| Access Type | Add, Delete, Get, Replace | -| Default Value | 0 | - - - -**Allowed values**: - -| Value | Description | -|:--|:--| -| 0 (Default) | Enable Data Analysis for Windows AI. | -| 1 | Disable Data Analysis for Windows AI. | - - - -**Group policy mapping**: - -| Name | Value | -|:--|:--| -| Name | DisableAIDataAnalysis | -| Path | WindowsAI > AT > WindowsComponents > WindowsAI | - - - - - - - - ## TurnOffWindowsCopilot diff --git a/windows/client-management/mdm/surfacehub-csp.md b/windows/client-management/mdm/surfacehub-csp.md index 553037a410..78f6dd37b7 100644 --- a/windows/client-management/mdm/surfacehub-csp.md +++ b/windows/client-management/mdm/surfacehub-csp.md @@ -1,7 +1,7 @@ --- title: SurfaceHub CSP description: Learn more about the SurfaceHub CSP. -ms.date: 01/18/2024 +ms.date: 04/22/2024 --- @@ -65,6 +65,10 @@ The following list shows the SurfaceHub configuration service provider nodes: - [MOMAgent](#momagent) - [WorkspaceID](#momagentworkspaceid) - [WorkspaceKey](#momagentworkspacekey) + - [MOMAgentGovtCloud](#momagentgovtcloud) + - [AzureCloudIndexGovtCloud](#momagentgovtcloudazurecloudindexgovtcloud) + - [WorkspaceIDGovtCloud](#momagentgovtcloudworkspaceidgovtcloud) + - [WorkspaceKeyGovtCloud](#momagentgovtcloudworkspacekeygovtcloud) - [Properties](#properties) - [AllowAutoProxyAuth](#propertiesallowautoproxyauth) - [AllowSessionResume](#propertiesallowsessionresume) @@ -2011,6 +2015,162 @@ Primary key for authenticating with workspace. Will always return an empty strin + +## MOMAgentGovtCloud + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 22H2 [10.0.19045.4355] and later | + + + +```Device +./Vendor/MSFT/SurfaceHub/MOMAgentGovtCloud +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `node` | +| Access Type | Get | + + + + + + + + + +### MOMAgentGovtCloud/AzureCloudIndexGovtCloud + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 22H2 [10.0.19045.4355] and later | + + + +```Device +./Vendor/MSFT/SurfaceHub/MOMAgentGovtCloud/AzureCloudIndexGovtCloud +``` + + + + +Enum value for Azure Clouds supported for OMS tracking in SurfaceHub. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Get, Replace | +| Default Value | 0 | + + + + + + + + + +### MOMAgentGovtCloud/WorkspaceIDGovtCloud + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 22H2 [10.0.19045.4355] and later | + + + +```Device +./Vendor/MSFT/SurfaceHub/MOMAgentGovtCloud/WorkspaceIDGovtCloud +``` + + + + +GUID identifying the Microsoft Operations Management Suite workspace ID to collect the data for Govt Clouds. Set this to an empty string to disable the MOM agent. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `chr` (string) | +| Access Type | Get, Replace | + + + + + + + + + +### MOMAgentGovtCloud/WorkspaceKeyGovtCloud + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 22H2 [10.0.19045.4355] and later | + + + +```Device +./Vendor/MSFT/SurfaceHub/MOMAgentGovtCloud/WorkspaceKeyGovtCloud +``` + + + + +Primary key for authenticating with workspace for Govt Clouds. Will always return an empty string. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `chr` (string) | +| Access Type | Get, Replace | + + + + + + + + ## Properties diff --git a/windows/client-management/mdm/surfacehub-ddf-file.md b/windows/client-management/mdm/surfacehub-ddf-file.md index 4bfee13fce..3222bade2d 100644 --- a/windows/client-management/mdm/surfacehub-ddf-file.md +++ b/windows/client-management/mdm/surfacehub-ddf-file.md @@ -1,7 +1,7 @@ --- title: SurfaceHub DDF file description: View the XML file containing the device description framework (DDF) for the SurfaceHub configuration service provider. -ms.date: 01/18/2024 +ms.date: 04/22/2024 --- @@ -12,11 +12,10 @@ The following XML file contains the device description framework (DDF) for the S ```xml -]> + 1.2 - - + SurfaceHub ./Vendor/MSFT @@ -86,8 +85,7 @@ The following XML file contains the device description framework (DDF) for the S - - + @@ -110,8 +108,7 @@ The following XML file contains the device description framework (DDF) for the S - - + @@ -134,8 +131,7 @@ The following XML file contains the device description framework (DDF) for the S - - + @@ -158,8 +154,7 @@ The following XML file contains the device description framework (DDF) for the S - - + @@ -203,8 +198,7 @@ The following XML file contains the device description framework (DDF) for the S - - + @@ -227,8 +221,7 @@ The following XML file contains the device description framework (DDF) for the S - - + @@ -251,8 +244,7 @@ The following XML file contains the device description framework (DDF) for the S - - + @@ -534,8 +526,7 @@ The following XML file contains the device description framework (DDF) for the S 10.0.15063 1.0 - - + @@ -611,8 +602,7 @@ The following XML file contains the device description framework (DDF) for the S - - + @@ -753,8 +743,7 @@ The following XML file contains the device description framework (DDF) for the S - - + @@ -982,8 +971,7 @@ The following XML file contains the device description framework (DDF) for the S - - + @@ -1028,8 +1016,7 @@ The following XML file contains the device description framework (DDF) for the S - - + @@ -1522,8 +1509,7 @@ The following XML file contains the device description framework (DDF) for the S 10.0.15063, 10.0.14393.969 1.0 - - + @@ -1584,8 +1570,7 @@ The following XML file contains the device description framework (DDF) for the S - - + @@ -1633,8 +1618,7 @@ The following XML file contains the device description framework (DDF) for the S - - + @@ -1657,8 +1641,99 @@ The following XML file contains the device description framework (DDF) for the S - - + + + + + + MOMAgentGovtCloud + + + + + + + + + + + + + + + + + + 10.0.19045.4355 + 1.0 + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBF;0xCA;0xCB;0xCD; + + + + WorkspaceIDGovtCloud + + + + + + GUID identifying the Microsoft Operations Management Suite workspace ID to collect the data for Govt Clouds. Set this to an empty string to disable the MOM agent. + + + + + + + + + + + text/plain + + + + + WorkspaceKeyGovtCloud + + + + + + Primary key for authenticating with workspace for Govt Clouds.. Will always return an empty string. + + + + + + + + + + + text/plain + + + + + AzureCloudIndexGovtCloud + + + + + + 0 + Enum value for Azure Clouds supported for OMS tracking in SurfaceHub. + + + + + + + + + + + text/plain + @@ -1702,8 +1777,7 @@ The following XML file contains the device description framework (DDF) for the S - - + @@ -1726,8 +1800,7 @@ The following XML file contains the device description framework (DDF) for the S - - + @@ -1754,8 +1827,7 @@ The following XML file contains the device description framework (DDF) for the S 10.0.17134, 10.0.16299.64 1.0 - - + LanProfile @@ -1777,8 +1849,7 @@ The following XML file contains the device description framework (DDF) for the S - - + @@ -1801,8 +1872,7 @@ The following XML file contains the device description framework (DDF) for the S - - + diff --git a/windows/configuration/cellular/provisioning-apn.md b/windows/configuration/cellular/provisioning-apn.md index 88c77810eb..8fcf389cf7 100644 --- a/windows/configuration/cellular/provisioning-apn.md +++ b/windows/configuration/cellular/provisioning-apn.md @@ -1,47 +1,44 @@ --- -title: Configure cellular settings for tablets and PCs -description: Enterprises can provision cellular settings for tablets and PC with built-in cellular modems or plug-in USB modem dongles. +title: Configure cellular settings +description: Learn how to provision cellular settings for devices with built-in modems or plug-in USB modem dongles. ms.topic: concept-article -ms.date: 04/13/2018 +ms.date: 04/23/2024 --- -# Configure cellular settings for tablets and PCs +# Configure cellular settings ->**Looking for consumer information?** See [Cellular settings in Windows 10](https://support.microsoft.com/help/10739/windows-10-cellular-settings) +This article describes how to configure cellular settings for devices that have a cellular modem using a [provisioning package](../provisioning-packages/provisioning-packages.md). After the devices are configured, users are automatically connected using the access point name (APN) defined in the provisioning package, without needing to connect manually. -Enterprises can configure cellular settings for tablets and PC that have built-in cellular modems or plug-in USB modem dongles and apply the settings in a [provisioning package](../provisioning-packages/provisioning-packages.md). After the devices are configured, users are automatically connected using the access point name (APN) defined by the enterprise without needing to manually connect. - -For users who work in different locations, you can configure one APN to connect when the users are at work and a different APN when the users are traveling. +For users who work in different locations, you can configure one APN to connect when the users are at work, and a different APN when the users are traveling. ## Prerequisites -- Windows 10, version 1703, desktop editions (Home, Pro, Enterprise, Education) -- Tablet or PC with built-in cellular modem or plug-in USB modem dongle +- Device with built-in cellular modem or plug-in USB modem dongle - [Windows Configuration Designer](../provisioning-packages/provisioning-install-icd.md) -- APN (the address that your PC uses to connect to the Internet when using the cellular data connection) +- APN (the address that the device uses to connect to the Internet when using the cellular data connection) ## How to configure cellular settings in a provisioning package -1. In Windows Configuration Designer, [start a new project](../provisioning-packages/provisioning-create-package.md) using the **Advanced provisioning** option. -1. Enter a name for your project, and then click **Next**. -1. Select **All Windows desktop editions**, click **Next**, and then click **Finish**. -1. Go to **Runtime settings > Connections > EnterpriseAPN**. -1. Enter a name for the connection, and then click **Add**. +1. In Windows Configuration Designer, [start a new project](../provisioning-packages/provisioning-create-package.md) using the **Advanced provisioning** option +1. Enter a name for your project, and then select **Next** +1. Select **All Windows desktop editions**, select **Next**, and then select **Finish** +1. Go to **Runtime settings > Connections > EnterpriseAPN** +1. Enter a name for the connection, and then select **Add** ![Example of APN connection name.](images/apn-add.png) -1. The connection appears in the **Available customizations** pane. Select it to view the settings that you can configure for the connection. +1. The connection appears in the **Available customizations** pane. Select it to view the settings that you can configure for the connection ![settings for new connection.](images/apn-add-details.png) -1. The following table describes the settings available for the connection. +1. The following table describes the settings available for the connection | Setting | Description | | --- | --- | - | AlwaysOn | By default, the Connection Manager will automatically attempt to connect to the APN when a connection is available. You can disable this setting. | + | AlwaysOn | By default, the Connection Manager automatically attempts to connect to the APN when a connection is available. You can disable the setting. | | APNName | Enter the name of the APN. | | AuthType | You can select **None** (the default), or specify **Auto**, **PAP**, **CHAP**, or **MSCHAPv2** authentication. If you select PAP, CHAP, or MSCHAPv2 authentication, you must also enter a user name and password. | - | ClassId | This is a GUID that defines the APN class to the modem. This is only required when **IsAttachAPN** is **true** and the attach APN is not only used as the Internet APN. | + | ClassId | This is a GUID that defines the APN class to the modem. This is only required when **IsAttachAPN** is **true** and the attached APN isn't only used as the Internet APN. | | Enabled | By default, the connection is enabled. You can change this setting. | | IccId | This is the Integrated Circuit Card ID (ICCID) associated with the cellular connection profile. | | IPType | By default, the connection can use IPv4 and IPv6 concurrently. You can change this setting to only IPv4, only IPv6, or IPv6 with IPv4 provided by 46xlat. | @@ -55,22 +52,22 @@ For users who work in different locations, you can configure one APN to connect ## Confirm the settings -After you apply the provisioning package, you can confirm that the settings have been applied. +After you apply the provisioning package, you can confirm that the settings are applied. -1. On the configured device, open a command prompt as an administrator. +1. On the configured device, open a command prompt as an administrator 1. Run the following command: ```cmd netsh mbn show profiles ``` -1. The command will list the mobile broadband profiles. Using the "Name" for the listed mobile broadband profile, run: +1. The command lists the mobile broadband profiles. Using the **Name** for the listed mobile broadband profile, run: ```cmd netsh mbn show profiles name="name" ``` - This command will list details for that profile, including Access Point Name. + This command lists the details for that profile, including Access Point Name. Alternatively, you can also use the command: @@ -84,4 +81,4 @@ From the results of that command, get the name of the cellular/mobile broadband netsh mbn show connection interface="name" ``` -The result of that command will show details for the cellular interface, including Access Point Name. +The result of that command shows the details for the cellular interface, including Access Point Name. diff --git a/windows/configuration/taskbar/images/pin-add-11.png b/windows/configuration/taskbar/images/pin-add-11.png index de84d0154c..48c0a2a00f 100644 Binary files a/windows/configuration/taskbar/images/pin-add-11.png and b/windows/configuration/taskbar/images/pin-add-11.png differ diff --git a/windows/configuration/taskbar/images/pin-layout-11.png b/windows/configuration/taskbar/images/pin-layout-11.png index 717f210776..5df7a8bfda 100644 Binary files a/windows/configuration/taskbar/images/pin-layout-11.png and b/windows/configuration/taskbar/images/pin-layout-11.png differ diff --git a/windows/configuration/taskbar/images/pin-remove-11.png b/windows/configuration/taskbar/images/pin-remove-11.png index d815923516..8915aedaf6 100644 Binary files a/windows/configuration/taskbar/images/pin-remove-11.png and b/windows/configuration/taskbar/images/pin-remove-11.png differ diff --git a/windows/configuration/taskbar/images/pin-replace-11.png b/windows/configuration/taskbar/images/pin-replace-11.png index ce90eebcad..9d57facb80 100644 Binary files a/windows/configuration/taskbar/images/pin-replace-11.png and b/windows/configuration/taskbar/images/pin-replace-11.png differ diff --git a/windows/configuration/taskbar/images/taskbar-11.png b/windows/configuration/taskbar/images/taskbar-11.png index accd2c6f8f..0e24fb2679 100644 Binary files a/windows/configuration/taskbar/images/taskbar-11.png and b/windows/configuration/taskbar/images/taskbar-11.png differ diff --git a/windows/configuration/taskbar/images/taskbar-sections-11.png b/windows/configuration/taskbar/images/taskbar-sections-11.png index 3e14e85b9d..68e6ce31c5 100644 Binary files a/windows/configuration/taskbar/images/taskbar-sections-11.png and b/windows/configuration/taskbar/images/taskbar-sections-11.png differ diff --git a/windows/configuration/taskbar/includes/turn-off-windows-copilot.md b/windows/configuration/taskbar/includes/turn-off-windows-copilot.md deleted file mode 100644 index 69b9f7fd71..0000000000 --- a/windows/configuration/taskbar/includes/turn-off-windows-copilot.md +++ /dev/null @@ -1,18 +0,0 @@ ---- -author: paolomatarazzo -ms.author: paoloma -ms.date: 04/11/2024 -ms.topic: include ---- - -### Turn off Windows Copilot - -This policy setting allows you to turn off Windows Copilot. - -- If you enable this policy setting, users can't use Copilot. The Copilot icon doesn't appear on the taskbar either -- If you disable or don't configure this policy setting, users can use Copilot, if available - -| | Path | -|--|--| -| **CSP** | `./User/Vendor/MSFT/Policy/Config/WindowsAI/`[TurnOffWindowsCopilot](/windows/client-management/mdm/policy-csp-windowsai#turnoffwindowscopilot) | -| **GPO** | **User Configuration** > **Administrative Templates** > **Windows Components** > **Windows Copilot** | diff --git a/windows/configuration/taskbar/index.md b/windows/configuration/taskbar/index.md index 8fee3ecb0c..bc031e827b 100644 --- a/windows/configuration/taskbar/index.md +++ b/windows/configuration/taskbar/index.md @@ -49,6 +49,7 @@ Let's review the components of the Windows taskbar by dividing it into three are 1. The system tray, which displays icons like the pen menu, touch keyboard, virtual touchpad, and any application icons that are running in the background like OneDrive, Teams, or antivirus software 1. Quick Actions 1. Calendar + 1. Action Center 1. Action center 1. Copilot @@ -73,7 +74,6 @@ Let's review the components of the Windows taskbar by dividing it into two areas - The system tray, which displays icons like the pen menu, touch keyboard, virtual touchpad, power, network, volume, and any application icons that are running in the background like OneDrive, Teams, or antivirus software - Calendar - Action center - - Copilot :::image type="content" source="images/taskbar-sections-10.png" alt-text="Screenshot of the Windows 11 taskbar with the two areas highlighted." border="false" lightbox="./images/taskbar-sections-10.png"::: diff --git a/windows/configuration/taskbar/policy-settings.md b/windows/configuration/taskbar/policy-settings.md index cf9fa4a5ea..72ca73538b 100644 --- a/windows/configuration/taskbar/policy-settings.md +++ b/windows/configuration/taskbar/policy-settings.md @@ -37,7 +37,6 @@ Select one of the tabs to see the list of available settings: |[Show additional calendar](#show-additional-calendar)|❌|✅| |[Simplify Quick Settings Layout](#simplify-quick-settings-layout)|✅|✅| |[Turn off automatic promotion of notification icons to the taskbar](#turn-off-automatic-promotion-of-notification-icons-to-the-taskbar)|❌|✅| -|[Turn off Windows Copilot](#turn-off-windows-copilot)|✅|✅| ::: zone-end @@ -62,7 +61,6 @@ Select one of the tabs to see the list of available settings: |[Show additional calendar](#show-additional-calendar)|❌|✅| |[Turn off automatic promotion of notification icons to the taskbar](#turn-off-automatic-promotion-of-notification-icons-to-the-taskbar)|❌|✅| |[Turn off notification area cleanup](#turn-off-notification-area-cleanup)|❌|✅| -|[Turn off Windows Copilot](#turn-off-windows-copilot)|✅|✅| ::: zone-end @@ -109,8 +107,6 @@ Select one of the tabs to see the list of available settings: [!INCLUDE [turn-off-notification-area-cleanup](includes/turn-off-notification-area-cleanup.md)] ::: zone-end -[!INCLUDE [turn-off-windows-copilot](includes/turn-off-windows-copilot.md)] - #### [:::image type="icon" source="../images/icons/touch.svg"::: **Taskbar behaviors**](#tab/actions) ::: zone pivot="windows-11" diff --git a/windows/security/cloud-security/index.md b/windows/security/cloud-security/index.md index b31f712e0f..9fde8b8939 100644 --- a/windows/security/cloud-security/index.md +++ b/windows/security/cloud-security/index.md @@ -1,6 +1,6 @@ --- title: Windows and cloud security -description: Get an overview of cloud security features in Windows +description: Get an overview of cloud security features in Windows. ms.date: 08/02/2023 ms.topic: overview author: paolomatarazzo @@ -9,7 +9,7 @@ ms.author: paoloma # Windows and cloud security -Today's workforce has more freedom and mobility than ever before, and the risk of data exposure is also at its highest. We are focused on getting customers to the cloud to benefit from modern hybrid workstyles while improving security management. Built on zero-trust principles, Windows works with Microsoft cloud services to safeguard sensitive information while controlling access and mitigating threats. +Today's workforce has more freedom and mobility than ever before, and the risk of data exposure is also at its highest. We're focused on getting customers to the cloud to benefit from modern hybrid workstyles while improving security management. Built on zero-trust principles, Windows works with Microsoft cloud services to safeguard sensitive information while controlling access and mitigating threats. From identity and device management to Office apps and data storage, Windows and integrated cloud services can help improve productivity, security, and resilience anywhere. diff --git a/windows/security/identity-protection/hello-for-business/configure.md b/windows/security/identity-protection/hello-for-business/configure.md index b4d14a1882..008110433e 100644 --- a/windows/security/identity-protection/hello-for-business/configure.md +++ b/windows/security/identity-protection/hello-for-business/configure.md @@ -2,7 +2,7 @@ title: Configure Windows Hello for Business description: Learn about the configuration options for Windows Hello for Business and how to implement them in your organization. ms.topic: how-to -ms.date: 01/03/2024 +ms.date: 04/23/2024 --- # Configure Windows Hello for Business diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md b/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md index 5fe562311d..e1845d9363 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md @@ -1,7 +1,7 @@ --- title: Dynamic lock description: Learn how to configure dynamic lock on Windows devices via group policies. This feature locks a device when a Bluetooth signal falls below a set value. -ms.date: 02/29/2024 +ms.date: 04/23/2024 ms.topic: how-to --- diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index 1b1ad680bf..805091b707 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -1,11 +1,11 @@ --- title: Use Certificates to enable SSO for Microsoft Entra join devices description: If you want to use certificates for on-premises single-sign on for Microsoft Entra joined devices, then follow these additional steps. -ms.date: 08/19/2018 +ms.date: 04/24/2024 ms.topic: how-to --- -# Using Certificates for AADJ On-premises Single-sign On +# Using Certificates for Microsoft Entra joined on-premises single-sign on [!INCLUDE [apply-to-hybrid-cert-trust-entra](deploy/includes/apply-to-hybrid-cert-trust-entra.md)] @@ -16,34 +16,35 @@ If you plan to use certificates for on-premises single-sign on, then follow thes Steps you'll perform include: -- [Prepare Microsoft Entra Connect](#prepare-microsoft-entra-connect) -- [Prepare the Network Device Enrollment Services Service Account](#prepare-the-network-device-enrollment-services-ndes-service-account) -- [Prepare Active Directory Certificate Services](#prepare-active-directory-certificate-authority) -- [Install the Network Device Enrollment Services Role](#install-and-configure-the-ndes-role) -- [Configure Network Device Enrollment Services to work with Microsoft Intune](#configure-network-device-enrollment-services-to-work-with-microsoft-intune) -- [Download, Install and Configure the Intune Certificate Connector](#download-install-and-configure-the-intune-certificate-connector) -- [Create and Assign a Simple Certificate Enrollment Protocol (SCEP) Certificate Profile](#create-and-assign-a-simple-certificate-enrollment-protocol-scep-certificate-profile) +> [!div class="checklist"] +> - [Prepare Microsoft Entra Connect](#prepare-microsoft-entra-connect) +> - [Prepare the Network Device Enrollment Services Service Account](#prepare-the-network-device-enrollment-services-ndes-service-account) +> - [Prepare Active Directory Certificate Services](#prepare-active-directory-certificate-authority) +> - [Install the Network Device Enrollment Services Role](#install-and-configure-the-ndes-role) +> - [Configure Network Device Enrollment Services to work with Microsoft Intune](#configure-network-device-enrollment-services-to-work-with-microsoft-intune) +> - [Download, Install and Configure the Intune Certificate Connector](#download-install-and-configure-the-intune-certificate-connector) +> - [Create and Assign a Simple Certificate Enrollment Protocol (SCEP) Certificate Profile](#create-and-assign-a-simple-certificate-enrollment-protocol-scep-certificate-profile) ## Requirements -You need to install and configure additional infrastructure to provide Microsoft Entra joined devices with on-premises single-sign on. +You must install and configure additional infrastructure to provide Microsoft Entra joined devices with on-premises single-sign on. -- An existing Windows Server 2012 R2 or later Enterprise Certificate Authority -- A Windows Server 2012 R2 domain joined server that hosts the Network Device Enrollment Services role +- An existing Windows Server Enterprise Certificate Authority +- A domain joined Windows Server that hosts the Network Device Enrollment Services (NDES) role ### High Availability -The Network Device Enrollment Services (NDES) server role acts as a certificate registration authority. Certificate registration servers enroll certificates on behalf of the user. Users request certificates from the NDES service rather than directly from the issuing certificate authority. +The NDES server role acts as a certificate registration authority (CRA). Certificate registration servers enroll certificates on behalf of the user. Users request certificates from the NDES service rather than directly from the issuing certificate authority. -The architecture of the NDES server prevents it from being clustered or load balanced for high availability. To provide high availability, you need to install more than one identically configured NDES servers, and use Microsoft Intune to load balance then (in round-robin fashion). +The architecture of the NDES server prevents it from being clustered or load balanced for high availability. To provide high availability, you need to install more than one identically configured NDES servers, and use Microsoft Intune to load balance then (in round-robin fashion). -The Network Device Enrollment Service (NDES) server role can issue up to three unique certificate templates. The server role accomplishes this by mapping the purpose of the certificate request to a configured certificate template. The certificate request purpose has three options: +The Network Device Enrollment Service (NDES) server role can issue up to three unique certificate templates. The server role accomplishes this by mapping the purpose of the certificate request to a configured certificate template. The certificate request purpose has three options: - Signature - Encryption - Signature and Encryption -If you need to deploy more than three types of certificates to the Microsoft Entra joined device, you need additional NDES servers. Alternatively, consider consolidating certificate templates to reduce the number of certificate templates. +If you need to deploy more than three types of certificates to the Microsoft Entra joined device, you need additional NDES servers. Alternatively, consider consolidating certificate templates to reduce the number of certificate templates. ### Network Requirements @@ -51,36 +52,31 @@ All communication occurs securely over port 443. ## Prepare Microsoft Entra Connect -Successful authentication to on-premises resources using a certificate requires the certificate to provide a hint about the on-premises domain. The hint can be the user's Active Directory distinguished name as the subject of the certificate, or the hint can be the user's user principal name where the suffix matches the Active Directory domain name. +Successful authentication to on-premises resources using a certificate requires the certificate to provide a hint about the on-premises domain. The hint can be the user's Active Directory distinguished name as the subject of the certificate, or the hint can be the user's user principal name where the suffix matches the Active Directory domain name. -Most environments change the user principal name suffix to match the organization's external domain name (or vanity domain), which prevents the user principal name as a hint to locate a domain controller. Therefore, the certificate needs the user's on-premises distinguished name in the subject to properly locate a domain controller. +Most environments change the user principal name suffix to match the organization's external domain name (or vanity domain), which prevents the user principal name as a hint to locate a domain controller. Therefore, the certificate needs the user's on-premises distinguished name in the subject to properly locate a domain controller. -To include the on-premises distinguished name in the certificate's subject, Microsoft Entra Connect must replicate the Active Directory **distinguishedName** attribute to the Microsoft Entra ID **onPremisesDistinguishedName** attribute. Microsoft Entra Connect version 1.1.819 includes the proper synchronization rules needed for these attributes. +To include the on-premises distinguished name in the certificate's subject, Microsoft Entra Connect must replicate the Active Directory **distinguishedName** attribute to the Microsoft Entra ID **onPremisesDistinguishedName** attribute. Microsoft Entra Connect version 1.1.819 includes the proper synchronization rules needed for these attributes. ### Verify Microsoft Entra Connect version -Sign-in to computer running Microsoft Entra Connect with access equivalent to _local administrator_. +Sign-in to computer running Microsoft Entra Connect with access equivalent to *local administrator*. -1. Open **Synchronization Services** from the **Microsoft Entra Connect** folder. - -2. In the **Synchronization Service Manager**, select **Help** and then select **About**. - -3. If the version number isn't **1.1.819** or later, then upgrade Microsoft Entra Connect to the latest version. +1. Open **Synchronization Services** from the **Microsoft Entra Connect** folder +1. In the **Synchronization Service Manager**, select **Help** and then select **About** +1. If the version number isn't **1.1.819** or later, then upgrade Microsoft Entra Connect to the latest version ### Verify the onPremisesDistinguishedName attribute is synchronized The easiest way to verify that the onPremisesDistingushedNamne attribute is synchronized is to use the Graph Explorer for Microsoft Graph. -1. Open a web browser and navigate to [Graph Explorer](https://developer.microsoft.com/graph/graph-explorer). - -2. Select **Sign in to Graph Explorer** and provide Azure credentials. +1. Open a web browser and navigate to [Graph Explorer](https://developer.microsoft.com/graph/graph-explorer) +1. Select **Sign in to Graph Explorer** and provide Azure credentials > [!NOTE] - > To successfully query the Graph API, adequate [permissions](/graph/api/user-get?) must be granted. - -3. Select **Modify permissions (Preview)**. Scroll down and locate **User.Read.All** (or any other required permission) and select **Consent**. You'll now be prompted for delegated permissions consent. - -4. In the Graph Explorer URL, enter `https://graph.microsoft.com/v1.0/users/[userid]?$select=displayName,userPrincipalName,onPremisesDistinguishedName`, where **[userid]** is the user principal name of a user in Microsoft Entra ID. Select **Run query**. + > To successfully query the Graph API, adequate [permissions](/graph/api/user-get?) must be granted +1. Select **Modify permissions (Preview)**. Scroll down and locate **User.Read.All** (or any other required permission) and select **Consent**. You'll now be prompted for delegated permissions consent +1. In the Graph Explorer URL, enter `https://graph.microsoft.com/v1.0/users/[userid]?$select=displayName,userPrincipalName,onPremisesDistinguishedName`, where **[userid]** is the user principal name of a user in Microsoft Entra ID. Select **Run query** > [!NOTE] > Because the v1.0 endpoint of the Graph API only provides a limited set of parameters, we will use the $select [Optional OData query parameter](/graph/api/user-get?). For convenience, it is possible to switch the API version selector from **v1.0** to **beta** before performing the query. This will provide all available user information, but remember, **beta** endpoint queries should not be used in production scenarios. @@ -95,7 +91,7 @@ The easiest way to verify that the onPremisesDistingushedNamne attribute is sync GET https://graph.microsoft.com/v1.0/users/{id | userPrincipalName}?$select=displayName,userPrincipalName,onPremisesDistinguishedName ``` -5. In the returned results, review the JSON data for the **onPremisesDistinguishedName** attribute. Ensure the attribute has a value and that the value is accurate for the given user. If the **onPremisesDistinguishedName** attribute isn't synchronized the value will be **null**. +1. In the returned results, review the JSON data for the **onPremisesDistinguishedName** attribute. Ensure the attribute has a value and that the value is accurate for the given user. If the **onPremisesDistinguishedName** attribute isn't synchronized the value will be **null** #### Response \ No newline at end of file diff --git a/windows/whats-new/deprecated-features.md b/windows/whats-new/deprecated-features.md index 662ade9a57..bb6cfe5b36 100644 --- a/windows/whats-new/deprecated-features.md +++ b/windows/whats-new/deprecated-features.md @@ -1,7 +1,7 @@ --- title: Deprecated features in the Windows client description: Review the list of features that Microsoft is no longer actively developing in Windows 10 and Windows 11. -ms.date: 03/25/2024 +ms.date: 04/23/2024 ms.service: windows-client ms.subservice: itpro-fundamentals ms.localizationpriority: medium @@ -51,7 +51,7 @@ The features in this article are no longer being actively developed, and might b | TLS server authentication certificates using RSA keys with key lengths shorter than 2048 bits | Support for certificates using RSA keys with key lengths shorter than 2048 bits will be deprecated. Internet standards and regulatory bodies disallowed the use of 1024-bit keys in 2013, recommending specifically that RSA keys should have a key length of 2048 bits or longer. For more information, see [Transitioning of Cryptographic Algorithms and Key Sizes - Discussion Paper (nist.gov)](https://csrc.nist.gov/CSRC/media/Projects/Key-Management/documents/transitions/Transitioning_CryptoAlgos_070209.pdf). This deprecation focuses on ensuring that all RSA certificates used for TLS server authentication must have key lengths greater than or equal to 2048 bits to be considered valid by Windows.

TLS certificates issued by enterprise or test certification authorities (CA) aren't impacted with this change. However, we recommend that they be updated to RSA keys greater than or equal to 2048 bits as a security best practice. This change is necessary to preserve security of Windows customers using certificates for authentication and cryptographic purposes.| March 2024| | Test Base | [Test Base for Microsoft 365](/microsoft-365/test-base/overview), an Azure cloud service for application testing, is deprecated. The service will be retired in the future and will be no longer available for use after retirement. | March 2024 | | Windows Mixed Reality | [Windows Mixed Reality](/windows/mixed-reality/enthusiast-guide/before-you-start) is deprecated and will be removed in Windows 11, version 24H2. This deprecation includes the [Mixed Reality Portal](/windows/mixed-reality/enthusiast-guide/install-windows-mixed-reality) app, [Windows Mixed Reality for SteamVR](/windows/mixed-reality/enthusiast-guide/using-steamvr-with-windows-mixed-reality), and Steam VR Beta. Existing Windows Mixed Reality devices will continue to work with Steam through November 2026, if users remain on their current released version of Windows 11, version 23H2. After November 2026, Windows Mixed Reality will no longer receive security updates, nonsecurity updates, bug fixes, technical support, or online technical content updates.

This deprecation doesn't affect HoloLens. We remain committed to HoloLens and our enterprise customers. | December 2023 | -| Microsoft Defender Application Guard for Edge | [Microsoft Defender Application Guard](/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview), including the [Windows Isolated App Launcher APIs](/windows/win32/api/isolatedapplauncher/), is being deprecated for Microsoft Edge for Business and [will no longer be updated](feature-lifecycle.md). Please download the [Microsoft Edge For Business Security Whitepaper](https://edgestatic.azureedge.net/shared/cms/pdfs/Microsoft_Edge_Security_Whitepaper_v2.pdf) to learn more about Edge for Business security capabilities. | December 2023 | +| Microsoft Defender Application Guard for Edge | [Microsoft Defender Application Guard](/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview), including the [Windows Isolated App Launcher APIs](/windows/win32/api/isolatedapplauncher/), is being deprecated for Microsoft Edge for Business and [will no longer be updated](feature-lifecycle.md). Please download the [Microsoft Edge For Business Security Whitepaper](https://edgestatic.azureedge.net/shared/cms/pdfs/Microsoft_Edge_Security_Whitepaper_v2.pdf) to learn more about Edge for Business security capabilities.

**[Update - April 2024]**: Because Application Guard is deprecated there will not be a migration to Edge Manifest V3. The corresponding extensions and associated [Windows Store app](https://apps.microsoft.com/detail/9N8GNLC8Z9C8) will not be available after May 2024. This affects the following browsers: [*Application Guard Extension - Chrome*](https://chromewebstore.google.com/detail/application-guard-extensi/mfjnknhkkiafjajicegabkbimfhplplj) and [*Application Guard Extension - Firefox*](https://addons.mozilla.org/firefox/addon/application-guard-extension/). If you want to block unprotected browsers until you are ready to retire MDAG usage in your enterprise, we recommend using AppLocker policies or [Microsoft Edge management service](/deployedge/microsoft-edge-management-service). For more information, see [Microsoft Edge and Microsoft Defender Application Guard](/deployedge/microsoft-edge-security-windows-defender-application-guard). | December 2023 | | Legacy console mode | The [legacy console mode](/windows/console/legacymode) is deprecated and no longer being updated. In future Windows releases, it will be available as an optional [Feature on Demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities). This feature won't be installed by default. | December 2023 | | Windows speech recognition | [Windows speech recognition](https://support.microsoft.com/windows/83ff75bd-63eb-0b6c-18d4-6fae94050571) is deprecated and is no longer being developed. This feature is being replaced with [voice access](https://support.microsoft.com/topic/4dcd23ee-f1b9-4fd1-bacc-862ab611f55d). Voice access is available for Windows 11, version 22H2, or later devices. Currently, voice access supports five English locales: English - US, English - UK, English - India, English - New Zealand, English - Canada, and English - Australia. For more information, see [Setup voice access](https://support.microsoft.com/topic/set-up-voice-access-9fc44e29-12bf-4d86-bc4e-e9bb69df9a0e). | December 2023 | | Microsoft Defender Application Guard for Office | [Microsoft Defender Application Guard for Office](/microsoft-365/security/office-365-security/app-guard-for-office-install), including the [Windows Isolated App Launcher APIs](/windows/win32/api/isolatedapplauncher/), is being deprecated and will no longer be updated. We recommend transitioning to Microsoft Defender for Endpoint [attack surface reduction rules](/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction) along with [Protected View](/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365#global-settings-for-safe-attachments) and [Windows Defender Application Control](/windows/security/application-security/application-control/windows-defender-application-control/wdac). | November 2023 |