Merged PR 8690: add instructions for anonymous email/IM on Surface Hub

devices/surface-hub/change-history-surface-hub.md

@@ -9,7 +9,7 @@ ms.pagetype: surfacehub
 author: jdeckerms
 ms.author: jdecker
 ms.topic: article
-ms.date: 05/22/2018
+ms.date: 06/01/2018
 ms.localizationpriority: medium
 ---
 
@@ -17,6 +17,12 @@ ms.localizationpriority: medium
 
 This topic lists new and updated topics in the [Surface Hub Admin Guide]( surface-hub-administrators-guide.md).
 
+## June 2018
+
+New or changed topic | Description
+--- | ---
+[On-premises deployment (single forest)](on-premises-deployment-surface-hub-device-accounts.md) and [On-premises deployment (multiple forests)](on-premises-deployment-surface-hub-multi-forest.md) | Added (prerelease) instructions for disabling anonymous email and IM.
+
 ## May 2018
 
 New or changed topic | Description
@@ -29,6 +35,7 @@ New or changed topic | Description
 --- | ---
 [Hybrid deployment](hybrid-deployment-surface-hub-device-accounts.md) | Updated instructions for Skype for Business Hybrid.
 
+
 ## March 2018
 
 New or changed topic | Description

devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md

@@ -9,8 +9,7 @@ ms.sitesec: library
 ms.pagetype: surfacehub
 author: jdeckerms
 ms.author: jdecker
-ms.topic: article
-ms.date: 04/13/2018
+ms.date: 06/01/2018
 ms.localizationpriority: medium
 ---
 
@@ -105,10 +104,54 @@ If you have a single-forest on-premises deployment with Microsoft Exchange 2013
     Set-CsMeetingRoom  -Identity HUB01 -DomainController DC-ND-001.contoso.com -LineURI “tel:+14255550555;ext=50555"  -EnterpriseVoiceEnabled $true
     ```
 
-    Again, you'll need to replace the provided domain controller and phone number examples with your own information. The parameter value `$true` stays the same.
+    Again, you need to replace the provided domain controller and phone number examples with your own information. The parameter value `$true` stays the same.
     
 
- 
+ ## Disable anonymous email and IM
+
+
+>[!WARNING]
+>This information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
+
+Surface Hub uses a device account to provide email and collaboration services (IM, video, voice). This device account is used as the originating identity (the “from” party) when sending email, IM, and placing calls. As this account is not coming from an individual, identifiable user, it is deemed “anonymous” because it originated from the Surface Hub's device account.  
+
+Assume you have a per-user client policy assigned to each meeting room device with an identity of **SurfaceHubPolicy**. To disable anonymous email and messaging, you add a clientPolicyEntry to this client policy by using the following commands.
+
+```
+$policyEntry = New-CsClientPolicyEntry -Name AllowResourceAccountSendMessage -value $false
+$clientPolicy = Get-CsClientPolicy -Identity SurfaceHubPolicy
+$clientPolicy.PolicyEntry.Add($policyEntry)
+Set-CsClientPolicy -Instance $clientPolicy
+```
+
+To verify that the policy has been set:
+
+```
+Select-Object -InputObject $clientPolicy -Property PolicyEntry
+```
+
+The output should be:
+
+```
+PolicyEntry
+-----------
+{Name=AllowResourceAccountSendMessage;Value=False}
+```
+	
+	
+To change the policy entry:
+
+```
+$policyEntry =  New-CsClientPolicyEntry -Name AllowResourceAccountSendMessage -value $true
+$clientPolicy | Set-CsClientPolicy -PolicyEntry @{Replace = $policyEntry}
+```	
+	
+To remove the policy entry:
+
+```
+$policyEntry = New-CsClientPolicyEntry -Name AllowResourceAccountSendMessage -value $true
+$clientPolicy | Set-CsClientPolicy -PolicyEntry @{Remove = $policyEntry}
+```
 
  
 

devices/surface-hub/on-premises-deployment-surface-hub-multi-forest.md

@@ -8,8 +8,7 @@ ms.sitesec: library
 ms.pagetype: surfacehub
 author: jdeckerms
 ms.author: jdecker
-ms.topic: article
-ms.date: 07/27/2017
+ms.date: 06/01/2018
 ms.localizationpriority: medium
 ---
 
@@ -98,7 +97,50 @@ If you have a multi-forest on-premises deployment with Microsoft Exchange 2013 o
     You'll need to use the Session Initiation Protocol (SIP) address and domain controller for the Surface Hub, along with your own Skype for Business Server pool identifier and user identity.
 
 
+## Disable anonymous email and IM
 
+>[!WARNING]
+>This information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
+
+Surface Hub uses a device account to provide email and collaboration services (IM, video, voice). This device account is used as the originating identity (the “from” party) when sending email, IM, and placing calls. As this account is not coming from an individual, identifiable user, it is deemed “anonymous” because it originated from the Surface Hub's device account.  
+
+Assume you have a per-user client policy assigned to each meeting room device with an identity of **SurfaceHubPolicy**. To disable anonymous email and messaging, you add a clientPolicyEntry to this client policy by using the following commands.
+
+```
+$policyEntry = New-CsClientPolicyEntry -Name AllowResourceAccountSendMessage -value $false
+$clientPolicy = Get-CsClientPolicy -Identity SurfaceHubPolicy
+$clientPolicy.PolicyEntry.Add($policyEntry)
+Set-CsClientPolicy -Instance $clientPolicy
+```
+
+To verify that the policy has been set:
+
+```
+Select-Object -InputObject $clientPolicy -Property PolicyEntry
+```
+
+The output should be:
+
+```
+PolicyEntry
+-----------
+{Name=AllowResourceAccountSendMessage;Value=False}
+```
+	
+	
+To change the policy entry:
+
+```
+$policyEntry =  New-CsClientPolicyEntry -Name AllowResourceAccountSendMessage -value $true
+$clientPolicy | Set-CsClientPolicy -PolicyEntry @{Replace = $policyEntry}
+```	
+	
+To remove the policy entry:
+
+```
+$policyEntry = New-CsClientPolicyEntry -Name AllowResourceAccountSendMessage -value $true
+$clientPolicy | Set-CsClientPolicy -PolicyEntry @{Remove = $policyEntry}
+```