diff --git a/browsers/edge/docfx.json b/browsers/edge/docfx.json index 48a4dd1620..7f80f4653b 100644 --- a/browsers/edge/docfx.json +++ b/browsers/edge/docfx.json @@ -19,7 +19,8 @@ "ROBOTS": "INDEX, FOLLOW", "ms.technology": "microsoft-edge", "ms.topic": "article", - "ms.author": "lizross" + "ms.author": "lizross", + "ms.date": "04/05/2017" }, "externalReference": [ ], diff --git a/browsers/internet-explorer/docfx.json b/browsers/internet-explorer/docfx.json index b19b1d7f96..c7550c36c9 100644 --- a/browsers/internet-explorer/docfx.json +++ b/browsers/internet-explorer/docfx.json @@ -20,7 +20,8 @@ "ms.author": "lizross", "author": "eross-msft", "ms.technology": "internet-explorer", - "ms.topic": "article" + "ms.topic": "article", + "ms.date": "04/05/2017" }, "externalReference": [ ], diff --git a/devices/hololens/docfx.json b/devices/hololens/docfx.json index e3ef216bfb..b737302611 100644 --- a/devices/hololens/docfx.json +++ b/devices/hololens/docfx.json @@ -33,7 +33,8 @@ "breadcrumb_path": "/hololens/breadcrumb/toc.json", "ms.technology": "windows", "ms.topic": "article", - "ms.author": "jdecker" + "ms.author": "jdecker", + "ms.date": "04/05/2017" }, "fileMetadata": {}, "template": [ diff --git a/devices/surface-hub/docfx.json b/devices/surface-hub/docfx.json index df5f770c84..430f78295f 100644 --- a/devices/surface-hub/docfx.json +++ b/devices/surface-hub/docfx.json @@ -22,7 +22,8 @@ "ms.mktglfcycl": "manage", "author": "jdeckerms", "ms.sitesec": "library", - "ms.author": "jdecker" + "ms.author": "jdecker", + "ms.date": "05/23/2017" }, "externalReference": [ ], diff --git a/devices/surface/docfx.json b/devices/surface/docfx.json index e14912dea9..ff7e999dc3 100644 --- a/devices/surface/docfx.json +++ b/devices/surface/docfx.json @@ -19,7 +19,8 @@ "ROBOTS": "INDEX, FOLLOW", "ms.technology": "windows", "ms.topic": "article", - "ms.author": "jdecker" + "ms.author": "jdecker", + "ms.date": "05/09/2017" }, "externalReference": [ ], diff --git a/education/docfx.json b/education/docfx.json index d0d03f4aea..edff4fd2ac 100644 --- a/education/docfx.json +++ b/education/docfx.json @@ -19,7 +19,8 @@ "ms.author": "celested", "audience": "windows-education", "ms.topic": "article", - "breadcrumb_path": "/education/breadcrumb/toc.json" + "breadcrumb_path": "/education/breadcrumb/toc.json", + "ms.date": "05/09/2017" }, "externalReference": [ ], diff --git a/education/get-started/get-started-with-microsoft-education.md b/education/get-started/get-started-with-microsoft-education.md index d82cbe9b63..a93c3a283c 100644 --- a/education/get-started/get-started-with-microsoft-education.md +++ b/education/get-started/get-started-with-microsoft-education.md @@ -1,7 +1,7 @@ --- title: Deploy and manage a full cloud IT solution with Microsoft Education description: Learn how to use the new Microsoft Education system to set up a cloud infrastructure for your school, acquire devices and apps, and configure and deploy policies to your Windows 10 devices. -keywords: education, Microsoft Education, Microsoft Education system, full cloud IT solution, school, deploy, setup, manage, Windows 10, Intune for Education, Office 365 for Education, Microsoft Store for Education, Azure AD, Set up School PCs +keywords: education, Microsoft Education, full cloud IT solution, school, deploy, setup, manage, Windows 10, Intune for Education, Office 365 for Education, School Data Sync, Microsoft Teams, Microsoft Store for Education, Azure AD, Set up School PCs ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -27,6 +27,7 @@ Hello, IT administrators! In this walkthrough, we'll show you how you can quickl - **Office 365 for Education** provides online apps for work from anywhere and desktop apps for advanced functionality, built for working together and available across devices, and it's free for schools, teachers, and students - **School Data Sync** to help automate the process for importing and integrating School Information System (SIS) data that you can use with Office 365 - **OneNote Class Notebook** to organize course content, create and deliver interactive lessons to some or all students, collaborate and provide private feedback to individual students, and connect with major LMS and SIS partners for assignment workflow +- **Microsoft Teams** to bring conversations, content, and apps together in one place and create collaborate classrooms, connect in professional learning communities, and communicate with school staff - **Learning Tools** are moving beyond the OneNote desktop app and is now available in Office Lens, OneNote Online, Word Online, and Word desktop - **Whiteboard** to create interactive lessons on the big screen, share and collaborate real-time by connecting to Class Notebook and Classroom - **Windows 10, version 1703 (Creators Update)** which brings 3D for everyone and other new and updated Windows features @@ -43,6 +44,7 @@ Go to the Mi In this walkthrough, we'll show you the basics on how to: - Acquire an Office 365 for Education tenant, if you don't already have one - Import school, student, teacher, and class data using School Data Sync (SDS) +- Deploy Microsoft Teams to enable groups and teams in your school to communicate and collaborate - Manage apps and settings deployment with Intune for Education - Acquire additional apps in Microsoft Store for Education - Use the Set up School PCs app to quickly set up and provision your Windows 10 education devices @@ -52,7 +54,7 @@ This diagram shows a high-level view of what we cover in this walkthrough. The n **Figure 1** - Microsoft Education IT administrator workflow - + ## Prerequisites Complete these tasks before you start the walkthrough: @@ -116,7 +118,7 @@ Already have an Office 365 for Education verified tenant? Just sign in with your  3. Enter your Office 365 global admin credentials to apply the Intune for Education trial to your tenant. -4. Skip ahead and follow the instructions in the walkthrough beginning with [3. Configure Microsoft Store for Education](#3-configure-microsoft-store-for-education). +4. Skip ahead and follow the instructions in the walkthrough beginning with [4. Configure Microsoft Store for Education](#4-configure-microsoft-store-for-education). ## 1. Set up a new Office 365 for Education tenant @@ -131,7 +133,7 @@ Don't have an Office 365 for Education verified tenant or just starting out? Fol  -3. Save your sign-in info so you can use it to sign into https://portal.office.com (the sign-in page). Click **You're ready to go...** +3. Save your sign-in info so you can use it to sign in to https://portal.office.com (the sign-in page). Click **You're ready to go...** 4. In the **Verify eligibility for Microsoft Office 365 for Education** screen: 1. Add your domain name and follow the steps to confirm ownership of the domain. 2. Choose your DNS hosting provider to see step-by-step instructions on how to confirm that you own the domain. @@ -140,7 +142,7 @@ Don't have an Office 365 for Education verified tenant or just starting out? Fol You may need to fill in other information to provide that you qualify for an education tenant. Provide and submit the info to Microsoft to continue verification for your tenant. -As part of setting up a basic cloud infrastructure, you don't need to complete the rest of the Office 365 for Education setup so we will skip the rest of setup for now and start importing school data. You can pick up where you left off with Office 365 for Education setup once you've completed the rest of the steps in the walkthrough. See [6.3 Complete Office 365 for Education setup](#63-complete-office-365-education-setup) for info. +As part of setting up a basic cloud infrastructure, you don't need to complete the rest of the Office 365 for Education setup so we will skip the rest of setup for now and start importing school data. You can pick up where you left off with Office 365 for Education setup once you've completed the rest of the steps in the walkthrough. See [7.3 Complete Office 365 for Education setup](#73-complete-office-365-education-setup) for info. ## 2. Use School Data Sync to import student data @@ -240,7 +242,7 @@ The Classroom application is retired, but you will need to assign the Classroom 3. Select the domain for the schools/sections. This domain will be used for the Section email addresses created during setup. If you have more than one domain, make sure you select the appropriate domain for the sync profile and subsequent sections being created. 4. In the **Select school and section properties** section, ensure the attributes that have been automatically selected for you align to your CSV files. If you select additional properties, or deselect any properties, make sure you have the properties and values contained within the CSV files. For the walkthrough, you don't have to change the default. 5. In the **Sync option for Section Group Display Name**, check the box if you want to allow teachers to overwrite the section names. Otherwise, SDS will always reset the display name value for sections to the value contained within the CSV files. - 6. In the **License Options** section, check the box to allow users being created to receive an Office 365 license. + 6. In the **License Options** section, check the box to enable the Classroom Preview license for all synced students and teachers within the sync profile. 7. Check the **Intune for Education** checkbox to allow users to receive the Intune for Education license and to create the SDS dynamic groups and security groups, which be used within Intune for Education. 8. Click **Next**. @@ -295,35 +297,68 @@ The Classroom application is retired, but you will need to assign the Classroom That's it for importing sample school data using SDS. -## 3. Configure Microsoft Store for Education +## 3. Enable Microsoft Teams for your school +Microsoft Teams is a digital hub that brings conversations, content, and apps together in one place. Because it's built on Office 365, schools benefit from integration with their familiar Office apps and services. Your institution can use Microsoft Teams to create collaborative classrooms, connect in professional learning communities, and communicate with school staff all from a single experience in Office 365 for Education. + +To get started, IT administrators need to use the Office 365 Admin Center to enable Microsoft Teams for your school. + +**Enable Microsoft Teams for your school** + +1. Sign in to Office 365 with your work or school account. +2. Click **Admin** to go to the Office 365 admin center. +3. Go to **Settings > Services & add-ins**. +4. On the **Services & add-ins** page, select **Microsoft Teams**. + + **Figure 14** - Select Microsoft Teams from the list of services & add-ins + +  + +5. On the Microsoft Teams settings screen, select the license that you want to configure, **Student** or **Faculty and Staff**. + + **Figure 15** - Select the license that you want to configure + +  + +6. After you select the license type, set the toggle to turn on Microsoft Teams for your organization. + + **Figure 16** - Turn on Microsoft Teams for your organization + +  + +7. Click **Save**. + +You can find more info about how to control which users in your school can use Microsoft Teams, turn off group creation, configure tenant-level settings, and more by reading the *Guide for IT admins** getting started guide in the Meet Microsoft Teams page. + +## 4. Configure Microsoft Store for Education You'll need to configure Microsoft Store for Education to accept the services agreement and make sure your Microsoft Store account is associated with Intune for Education. **Associate your Microsoft Store account with Intune for Education** -1. Sign into Microsoft Store for Education. + +1. Sign in to Microsoft Store for Education. 2. Accept the Microsoft Store for Business and Education Services Agreement. This will take you to the Microsoft Store for Education portal. - **Figure 14** - Microsoft Store for Education portal + **Figure 17** - Microsoft Store for Education portal  3. In the Microsoft Store portal, click **Manage** to go to the Microsoft Store **Overview** page. 4. Find the **Overview** page, find the **Store settings** tile and click **Management tools**. - **Figure 15** - Select management tools from the list of Store settings options + **Figure 18** - Select management tools from the list of Store settings options  4. In the **Management tools** page, find **Microsoft Intune** on the list and click **Activate** to get Intune for Education ready for use with Microsoft Store for Education. - **Figure 16** - Activate Intune for Education as the management tool + **Figure 19** - Activate Intune for Education as the management tool  Your Microsoft Store for Education account is now linked to Intune for Education so let's set that up next. -## 4. Use Intune for Education to manage groups, apps, and settings +## 5. Use Intune for Education to manage groups, apps, and settings Intune for Education is a streamlined device management solution for educational institutions that can be used to quickly set up and manage Windows 10 devices for your school. It provides a new streamlined UI with the enterprise readiness and resiliency of the Intune service. You can learn more about Intune for Education by reading the Intune for Education documentation. ### Example - Set up Intune for Education, buy apps from the Store, and install the apps @@ -351,20 +386,20 @@ Intune for Education provides an **Express configuration** option so you can get 1. Log into the Intune for Education console. You will see the Intune for Education dashboard once you're logged in. - **Figure 17** - Intune for Education dashboard + **Figure 20** - Intune for Education dashboard  2. On the dashboard, click **Launch Express Configuration**, or select the **Express configuration** option on the menu on the left. 3. In the **Welcome to Intune for Education** screen, click **Get started**. - **Figure 18** - Click Get started to set up Intune for Education + **Figure 21** - Click Get started to set up Intune for Education  4. In the **Get school information (optional)** screen, it should indicate that SDS is already configured. Click **Next**. - **Figure 19** - SDS is configured + **Figure 22** - SDS is configured  @@ -377,7 +412,7 @@ Intune for Education provides an **Express configuration** option so you can get > [!TIP] > At the top of the screen, did you notice the **Choose group** button change to a green check mark? This means we are done with that step. If you change your mind or need to make changes, simply click on the button to go back to that step. Try it! > - > **Figure 20** - Click on the buttons to go back to that step + > **Figure 23** - Click on the buttons to go back to that step > >  @@ -390,7 +425,7 @@ Intune for Education provides an **Express configuration** option so you can get > [!TIP] > Web apps are pushed as links in the Windows Start menu under **All apps**. If you want apps to appear in Microsoft Edge browser tabs, use the **Homepages** setting for Microsoft Edge through **Express configuration** or **Manage Users and Devices**. - **Figure 21** - Choose the apps that you want to install for the group + **Figure 24** - Choose the apps that you want to install for the group  @@ -400,7 +435,7 @@ Intune for Education provides an **Express configuration** option so you can get 8. In the **Choose settings** screen, we will set the settings to apply to the group. Click the reverse caret (downward-facing arrow) to expand the settings group and get more information about each setting in that settings group. - **Figure 22** - Expand the settings group to get more details + **Figure 25** - Expand the settings group to get more details  @@ -408,20 +443,20 @@ Intune for Education provides an **Express configuration** option so you can get - In the **Microsoft Edge settings** group, change the **Do-Not-Track headers** setting to **Require**. - In the **App settings** group, change the **Microsoft Store for Business apps** setting to **Block**, and then set the **Require Microsoft Store for Business apps to be installed from private store** to **Require**. - **Figure 23** - Set some additional settings + **Figure 26** - Set some additional settings  10. Click **Next**. In the **Review** screen, you will see a summary of the apps and settings you selected to apply. - **Figure 24** - Review the group, apps, and settings you configured + **Figure 27** - Review the group, apps, and settings you configured  11. Click **Save** to end express configuration. 12. You will see the **You're done!** screen which lets you choose one of two options. - **Figure 25** - All done with Intune for Education express configuration + **Figure 28** - All done with Intune for Education express configuration  @@ -438,13 +473,13 @@ Intune for Education provides an **Express configuration** option so you can get 1. In the Intune for Education console, click **Apps** from the menu on the left. - **Figure 26** - Click on **Apps** to see the list of apps for your tenant + **Figure 29** - Click on **Apps** to see the list of apps for your tenant  2. In the **Store apps** section, click **+ New app**. This will take you to the Microsoft Store for Education portal and you will already be signed in. - **Figure 27** - Select the option to add a new Store app + **Figure 30** - Select the option to add a new Store app  @@ -463,7 +498,7 @@ Intune for Education provides an **Express configuration** option so you can get For example, if you bought Duolingo and Khan Academy, they will show up in your inventory along with the apps that Microsoft automatically provisioned for your education tenant. - **Figure 28** - Apps inventory in Microsoft Store for Education + **Figure 31** - Apps inventory in Microsoft Store for Education  @@ -478,40 +513,40 @@ Now that you've bought the apps, use Intune for Education to specify the group t 1. In the Intune for Education console, click the **Groups** option from the menu on the left. - **Figure 29** - Groups page in Intune for Education + **Figure 32** - Groups page in Intune for Education  2. In the **Groups** page, select **All Users** from the list of groups on the left, and then click **Users** in the taskbar at the top of the **All Users** page. - **Figure 30** - List of all users in the tenant + **Figure 33** - List of all users in the tenant  3. In the taskbar at the top, select **Apps** and then click **Edit apps** to see a list of available apps. - **Figure 31** - Edit apps to assign them to users + **Figure 34** - Edit apps to assign them to users  4. Select the apps to deploy to the group. A blue checkmark will appear next to the apps you select. - **Figure 32** - Select the apps to deploy to the group + **Figure 35** - Select the apps to deploy to the group  5. Once you're done, click **Save** at the bottom of the page to deploy the selected apps to the group. 6. You'll be notified that app assignments are being updated. The updated **All Users** groups page now include the apps you selected. - **Figure 33** - Updated list of assigned apps + **Figure 36** - Updated list of assigned apps  You're now done assigning apps to all users in your tenant. It's time to set up your Windows 10 device(s) and check that your cloud infrastructure is correctly set up and your apps are being pushed to your devices from the cloud. -## 5. Set up Windows 10 devices +## 6. Set up Windows 10 devices -### 5.1 Set up devices using Set up School PCs or Windows OOBE +### 6.1 Set up devices using Set up School PCs or Windows OOBE We recommend using the latest build of Windows 10, version 1703 on your education devices. To set up new Windows 10 devices and enroll them to your education tenant, choose from one of these options: - **Option 1: [Use the Set up School PCs app](#usesetupschoolpcs)** - You can use the app to create a setup file that you can use to quickly set up one or more Windows 10 devices. - **Option 2: [Go through Windows OOBE and join the device to Azure AD](#usewindowsoobandjoinaad)** - You can go through a typical Windows 10 device setup or first-run experience to configure your device. @@ -551,13 +586,13 @@ Set up School PCs makes it easy to set up Windows 10 PCs with Microsoft's recomm 1. If you don't have a Wi-Fi network configured, make sure you connect the device to the Internet through a wired or Ethernet connection. 2. Go through the Windows device setup experience. On a new or reset device, this starts with the **Let's start with region. Is this right?** screen. - **Figure 34** - Let's start with region + **Figure 37** - Let's start with region  3. Continue with setup. In the **How would you like to set up?** screen, select **Set up for an organization**. - **Figure 35** - Select setup for an organization + **Figure 38** - Select setup for an organization  @@ -566,7 +601,7 @@ Set up School PCs makes it easy to set up Windows 10 PCs with Microsoft's recomm 6. Click **Accept** to go through the rest of device setup. -### 5.2 Verify correct device setup +### 6.2 Verify correct device setup Verify that the device is set up correctly and boots without any issues. **Verify that the device was set up correctly** @@ -576,11 +611,11 @@ Verify that the device is set up correctly and boots without any issues. > [!NOTE] > It may take some time before some apps are pushed down to your device from Intune for Education. Check again later if you don't see some of the apps you provisioned for the user. - **Figure 36** - Sample list of apps for a user + **Figure 39** - Sample list of apps for a user  -### 5.3 Verify the device is Azure AD joined +### 6.3 Verify the device is Azure AD joined Let's now verify that the device is joined to your organization's Azure AD and shows up as being managed in Microsoft Intune for Education. **Verify if the device is joined to Azure AD** @@ -588,7 +623,7 @@ Let's now verify that the device is joined to your organization's Azure AD and s 2. Select **Groups** and select **All Devices**. 3. In the **All Devices** page, see the list of devices and verify that the device you're signed into appears on the list. - **Figure 37** - List of all managed devices + **Figure 40** - List of all managed devices  @@ -596,23 +631,23 @@ Let's now verify that the device is joined to your organization's Azure AD and s 5. Select **Accounts > Access work or school**. 6. In the **Access work or school** page, confirm that the device is connected to the organization's Azure AD. - **Figure 38** - Confirm that the Windows 10 device is joined to Azure AD + **Figure 41** - Confirm that the Windows 10 device is joined to Azure AD  **That's it! You're done!** You've completed basic cloud setup, deployment, and management using Microsoft Education. You can continue follow the rest of the walkthrough to finish setup and complete other tasks. -## 6. Finish setup and other tasks +## 7. Finish setup and other tasks -### 6.1 Update group settings in Intune for Education +### 7.1 Update group settings in Intune for Education If you need to make changes or updates to any of the apps or settings for the group(s), follow these steps. 1. Log in to the Intune for Education console. 2. Click **Groups** and then choose **Settings** in the taskbar at the top of the page. 3. You will see the same settings groups that you saw in express setup for Intune for Education as well as other settings categories such as **Windows Defender settings**, **Device sharing**, **Edition upgrade**, and so on. - **Figure 39** - See the list of available settings in Intune for Education + **Figure 42** - See the list of available settings in Intune for Education  @@ -622,7 +657,7 @@ If you need to make changes or updates to any of the apps or settings for the gr 5. Click **Save** or **Discard changes**. -### 6.2 Configure Azure settings +### 7.2 Configure Azure settings After completing the basic setup for your cloud infrastructure and confirming that it is up and running, it's time to prepare for additional devices to be added and enable capabilities for the user to use. #### Enable many devices to be added by a single person @@ -634,7 +669,7 @@ Follow the steps in this section to enable a single person to add many devices t 2. Configure the device settings for the school's Active Directory. To do this, go to the new Azure portal, https://portal.azure.com. 3. Select **Azure Active Directory > Users and groups > Device settings**. - **Figure 40** - Device settings in the new Azure portal + **Figure 43** - Device settings in the new Azure portal  @@ -651,22 +686,22 @@ Follow the steps in this section to ensure that settings for the each user follo 3. Select **Azure Active Directory > Users and groups > Device settings**. 4. Find the setting **Users may sync settings and enterprise app data** and change the value to **All**. - **Figure 41** - Enable settings to roam with users + **Figure 44** - Enable settings to roam with users  5. Click **Save** to update device settings. -### 6.3 Complete Office 365 for Education setup +### 7.3 Complete Office 365 for Education setup Now that your basic cloud infrastructure is up and running, it's time to complete the rest of the Office 365 for Education setup. You can find detailed information about completing Office 365 setup, services and applications, troubleshooting, and more by reading the Office 365 admin documentation. -### 6.4 Add more users +### 7.4 Add more users After your cloud infrastructure is set up and you have a device management strategy in place, you may need to add more users and you want the same policies to apply to these users. You can add new users to your tenant simply by adding them to the Office 365 groups. Adding new users to Office 365 groups automatically adds them to the corresponding groups in Intune for Education. See Add users to Office 365 to learn more. Once you're done adding new users, go to the Intune for Education console and verify that the same users were added to the Intune for Education groups as well. -### 6.5 Connect other devices to your cloud infrastructure -Adding a new device to your cloud-based tenant is easy. For new devices, you can follow the steps in [5. Set up Windows 10 devices](#5-set-up-windows-10-devices). For other devices, such as those personally-owned by teachers who need to connect to the school network to access work or school resources (BYOD), you can follow the steps in this section to get these devices connected. +### 7.5 Connect other devices to your cloud infrastructure +Adding a new device to your cloud-based tenant is easy. For new devices, you can follow the steps in [6. Set up Windows 10 devices](#6-set-up-windows-10-devices). For other devices, such as those personally-owned by teachers who need to connect to the school network to access work or school resources (BYOD), you can follow the steps in this section to get these devices connected. > [!NOTE] > These steps enable users to get access to the organization's resources, but it also gives the organization some control over the device. @@ -679,7 +714,7 @@ Adding a new device to your cloud-based tenant is easy. For new devices, you can For example, if a teacher connects their personal device to the school network, they'll see the following screen after typing in their account information. - **Figure 42** - Device is now managed by Intune for Education + **Figure 45** - Device is now managed by Intune for Education  @@ -689,11 +724,11 @@ Adding a new device to your cloud-based tenant is easy. For new devices, you can 5. After the user's credentails are validated, the window will refresh and will now include an entry that shows the device is now connected to the organization's MDM. This means the device is now enrolled in Intune for Education MDM and the account should have access to the organization's resources. - **Figure 43** - Device is connected to organization's MDM + **Figure 46** - Device is connected to organization's MDM  -6. You can confirm that the new device and user are showing up as Intune for Education-managed by going to the Intune for Education management portal and following the steps in [5.3 Verify the device is Azure AD joined](#53-verify-the-device-is-azure-ad-joined). +6. You can confirm that the new device and user are showing up as Intune for Education-managed by going to the Intune for Education management portal and following the steps in [6.3 Verify the device is Azure AD joined](#63-verify-the-device-is-azure-ad-joined). It may take several minutes before the new device shows up so check again later. diff --git a/education/get-started/images/microsoft_education_it_getstarted_workflow.png b/education/get-started/images/microsoft_education_it_getstarted_workflow.png new file mode 100644 index 0000000000..ebcaa2add9 Binary files /dev/null and b/education/get-started/images/microsoft_education_it_getstarted_workflow.png differ diff --git a/education/get-started/images/o365_msteams_settings.PNG b/education/get-started/images/o365_msteams_settings.PNG new file mode 100644 index 0000000000..0e3dab4886 Binary files /dev/null and b/education/get-started/images/o365_msteams_settings.PNG differ diff --git a/education/get-started/images/o365_msteams_turnon.PNG b/education/get-started/images/o365_msteams_turnon.PNG new file mode 100644 index 0000000000..95588d5031 Binary files /dev/null and b/education/get-started/images/o365_msteams_turnon.PNG differ diff --git a/education/get-started/images/o365_settings_services_msteams.PNG b/education/get-started/images/o365_settings_services_msteams.PNG new file mode 100644 index 0000000000..ca4dee07ac Binary files /dev/null and b/education/get-started/images/o365_settings_services_msteams.PNG differ diff --git a/education/windows/change-history-edu.md b/education/windows/change-history-edu.md index 00af76258b..e3cec30bb9 100644 --- a/education/windows/change-history-edu.md +++ b/education/windows/change-history-edu.md @@ -1,6 +1,7 @@ --- title: Change history for Windows 10 for Education (Windows 10) description: New and changed topics in Windows 10 for Education +keywords: Windows 10 education documentation, change history ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library diff --git a/education/windows/chromebook-migration-guide.md b/education/windows/chromebook-migration-guide.md index 27bf9b1c63..a192cd0edf 100644 --- a/education/windows/chromebook-migration-guide.md +++ b/education/windows/chromebook-migration-guide.md @@ -2,7 +2,7 @@ title: Chromebook migration guide (Windows 10) description: In this guide you will learn how to migrate a Google Chromebook-based learning environment to a Windows 10-based learning environment. ms.assetid: 7A1FA48A-C44A-4F59-B895-86D4D77F8BEA -keywords: migrate, automate, device +keywords: migrate, automate, device, Chromebook migration ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library diff --git a/education/windows/configure-windows-for-education.md b/education/windows/configure-windows-for-education.md index 715ba27c8a..03caa021e6 100644 --- a/education/windows/configure-windows-for-education.md +++ b/education/windows/configure-windows-for-education.md @@ -1,7 +1,7 @@ --- title: Windows 10 configuration recommendations for education customers description: Provides guidance on ways to configure the OS diagnostic data, consumer experiences, Cortana, search, as well as some of the preinstalled apps, so that Windows is ready for your school. -keywords: ["Windows 10 deployment", "recommendations", "privacy settings", "school", "education", "configurations"] +keywords: Windows 10 deployment, recommendations, privacy settings, school, education, configurations ms.mktglfcycl: plan ms.sitesec: library localizationpriority: high diff --git a/education/windows/deploy-windows-10-in-a-school-district.md b/education/windows/deploy-windows-10-in-a-school-district.md index 4037a7093e..1669188d1a 100644 --- a/education/windows/deploy-windows-10-in-a-school-district.md +++ b/education/windows/deploy-windows-10-in-a-school-district.md @@ -1,7 +1,7 @@ --- title: Deploy Windows 10 in a school district (Windows 10) description: Learn how to deploy Windows 10 in a school district. Integrate the school environment with Office 365, Active Directory Domain Services (AD DS), and Microsoft Azure Active Directory (Azure AD), use System Center Configuration Manager, Intune, and Group Policy to manage devices. -keywords: configure, tools, device, school +keywords: configure, tools, device, school district, deploy Windows 10 ms.prod: w10 ms.mktglfcycl: plan ms.pagetype: edu diff --git a/education/windows/deploy-windows-10-in-a-school.md b/education/windows/deploy-windows-10-in-a-school.md index e81b0dbbd7..8c0efa4efe 100644 --- a/education/windows/deploy-windows-10-in-a-school.md +++ b/education/windows/deploy-windows-10-in-a-school.md @@ -1,7 +1,7 @@ --- title: Deploy Windows 10 in a school (Windows 10) description: Learn how to integrate your school environment with Microsoft Office 365, Active Directory Domain Services (AD DS), and Microsoft Azure Active Directory (Azure AD). Deploy Windows 10 and apps to new devices or upgrade existing devices to Windows 10. Manage faculty, students, and devices by using Microsoft Intune and Group Policy. -keywords: configure, tools, device, school +keywords: configure, tools, device, school, deploy Windows 10 ms.prod: w10 ms.mktglfcycl: plan ms.pagetype: edu diff --git a/education/windows/edu-deployment-recommendations.md b/education/windows/edu-deployment-recommendations.md index ceecbfb175..e10a79af57 100644 --- a/education/windows/edu-deployment-recommendations.md +++ b/education/windows/edu-deployment-recommendations.md @@ -1,7 +1,7 @@ --- title: Deployment recommendations for school IT administrators description: Provides guidance on ways to customize the OS privacy settings, as well as some of the apps, for Windows-based devices used in schools so that you can choose what information is shared with Microsoft. -keywords: ["Windows 10 deployment", "recommendations", "privacy settings", "school"] +keywords: Windows 10 deployment, recommendations, privacy settings, school ms.mktglfcycl: plan ms.sitesec: library localizationpriority: high diff --git a/education/windows/education-scenarios-store-for-business.md b/education/windows/education-scenarios-store-for-business.md index 77b128ce18..f9dbde2df7 100644 --- a/education/windows/education-scenarios-store-for-business.md +++ b/education/windows/education-scenarios-store-for-business.md @@ -1,7 +1,7 @@ --- title: Education scenarios Microsoft Store for Education description: Learn how IT admins and teachers can use Microsoft Store for Education to acquire and manage apps in schools. -keywords: ["school", "store for business"] +keywords: school, Microsoft Store for Education, Microsoft education store ms.prod: W10 ms.mktglfcycl: plan ms.sitesec: library diff --git a/education/windows/get-minecraft-for-education.md b/education/windows/get-minecraft-for-education.md index 1e81d3437e..595d935f57 100644 --- a/education/windows/get-minecraft-for-education.md +++ b/education/windows/get-minecraft-for-education.md @@ -1,7 +1,7 @@ --- title: Get Minecraft Education Edition description: Learn how to get and distribute Minecraft Education Edition. -keywords: school, minecraft +keywords: school, Minecraft, education edition ms.prod: W10 ms.mktglfcycl: plan ms.sitesec: library diff --git a/education/windows/images/suspc_createpackage_recommendedapps_office061217.png b/education/windows/images/suspc_createpackage_recommendedapps_office061217.png new file mode 100644 index 0000000000..ac2ccbe4eb Binary files /dev/null and b/education/windows/images/suspc_createpackage_recommendedapps_office061217.png differ diff --git a/education/windows/school-get-minecraft.md b/education/windows/school-get-minecraft.md index a07b93cce8..2d28eccfc9 100644 --- a/education/windows/school-get-minecraft.md +++ b/education/windows/school-get-minecraft.md @@ -1,7 +1,7 @@ --- title: For IT administrators get Minecraft Education Edition description: Learn how IT admins can get and distribute Minecraft in their schools. -keywords: ["school"] +keywords: Minecraft, Education Edition, IT admins, acquire ms.prod: W10 ms.mktglfcycl: plan ms.sitesec: library diff --git a/education/windows/set-up-students-pcs-to-join-domain.md b/education/windows/set-up-students-pcs-to-join-domain.md index 9a8c59b2c6..81edf2b7a9 100644 --- a/education/windows/set-up-students-pcs-to-join-domain.md +++ b/education/windows/set-up-students-pcs-to-join-domain.md @@ -1,7 +1,7 @@ --- title: Set up student PCs to join domain description: Learn how to use Configuration Designer to easily provision student devices to join Active Directory. -keywords: school +keywords: school, student PC setup, Windows Configuration Designer ms.prod: W10 ms.mktglfcycl: plan ms.sitesec: library diff --git a/education/windows/set-up-students-pcs-with-apps.md b/education/windows/set-up-students-pcs-with-apps.md index 401f60f084..bcb92096ac 100644 --- a/education/windows/set-up-students-pcs-with-apps.md +++ b/education/windows/set-up-students-pcs-with-apps.md @@ -1,7 +1,7 @@ --- title: Provision student PCs with apps description: Learn how to use Configuration Designer to easily provision student devices to join Active Directory. -keywords: ["shared cart", "shared PC", "school"] +keywords: shared cart, shared PC, school, provision PCs with apps, Windows Configuration Designer ms.prod: W10 ms.mktglfcycl: plan ms.sitesec: library diff --git a/education/windows/take-a-test-app-technical.md b/education/windows/take-a-test-app-technical.md index 5aa6b3ed7b..2e60824894 100644 --- a/education/windows/take-a-test-app-technical.md +++ b/education/windows/take-a-test-app-technical.md @@ -1,7 +1,7 @@ --- title: Take a Test app technical reference description: The policies and settings applied by the Take a Test app. -keywords: take a test, test taking, school +keywords: take a test, test taking, school, policies ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library diff --git a/education/windows/take-a-test-multiple-pcs.md b/education/windows/take-a-test-multiple-pcs.md index 18d4fc79ab..19b0f65e62 100644 --- a/education/windows/take-a-test-multiple-pcs.md +++ b/education/windows/take-a-test-multiple-pcs.md @@ -1,7 +1,7 @@ --- title: Set up Take a Test on multiple PCs description: Learn how to set up and use the Take a Test app on multiple PCs. -keywords: ["take a test", "test taking", "school"] +keywords: take a test, test taking, school, set up on multiple PCs ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library diff --git a/education/windows/take-a-test-single-pc.md b/education/windows/take-a-test-single-pc.md index c7b5339f40..19053b9c55 100644 --- a/education/windows/take-a-test-single-pc.md +++ b/education/windows/take-a-test-single-pc.md @@ -1,7 +1,7 @@ --- title: Set up Take a Test on a single PC description: Learn how to set up and use the Take a Test app on a single PC. -keywords: take a test, test taking, school +keywords: take a test, test taking, school, set up on single PC ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library diff --git a/education/windows/take-tests-in-windows-10.md b/education/windows/take-tests-in-windows-10.md index 361dbff702..c526121def 100644 --- a/education/windows/take-tests-in-windows-10.md +++ b/education/windows/take-tests-in-windows-10.md @@ -1,7 +1,7 @@ --- title: Take tests in Windows 10 description: Learn how to set up and use the Take a Test app. -keywords: take a test, test taking, school +keywords: take a test, test taking, school, how to, use Take a Test ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library diff --git a/education/windows/teacher-get-minecraft.md b/education/windows/teacher-get-minecraft.md index 36de86549d..24cf0d3cb4 100644 --- a/education/windows/teacher-get-minecraft.md +++ b/education/windows/teacher-get-minecraft.md @@ -1,7 +1,7 @@ --- title: For teachers get Minecraft Education Edition description: Learn how teachers can get and distribute Minecraft. -keywords: ["school", "minecraft"] +keywords: school, Minecraft, Education Edition, educators, teachers, acquire, distribute ms.prod: W10 ms.mktglfcycl: plan ms.sitesec: library diff --git a/education/windows/use-set-up-school-pcs-app.md b/education/windows/use-set-up-school-pcs-app.md index 7338cfbdc0..e225fb543c 100644 --- a/education/windows/use-set-up-school-pcs-app.md +++ b/education/windows/use-set-up-school-pcs-app.md @@ -1,7 +1,7 @@ --- title: Use Set up School PCs app description: Learn how the Set up School PCs app works and how to use it. -keywords: shared cart, shared PC, school, set up school pcs +keywords: shared cart, shared PC, school, Set up School PCs, overview, how to use ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -145,7 +145,7 @@ The **Set up School PCs** app guides you through the configuration choices for t  -5. To assign a name to the student PCs, in the **Assign a name to these student PCs** page: +5. To assign a name to the student PCs, in the **Name these devices** page: 1. Add a short name that Set up School PCs will use as a prefix to identify and easily manage the group of devices, apps, and other settings through your device management client. > [!NOTE] @@ -191,13 +191,17 @@ The **Set up School PCs** app guides you through the configuration choices for t 3. Click **Next** or **Skip** depending on whether you want to set up Take a Test. -8. In the **Add recommended apps** page, you can choose from a set of recommended Microsoft Store apps to provision. The recommended apps include Minecraft: Education Edition and several STEM and Makerspace apps. +8. In the **Add recommended apps** page, you can choose from a set of recommended Microsoft Store apps to provision. The recommended apps include the following: + * **Office 365 for Windows 10 S (Education Preview)** - Your student PCs must be running Windows 10 S to install this app. If you try to install this app on other editions of Windows, setup will fail. + * **Minecraft: Education Edition** - Free trial + * Popular **STEM and Makerspace apps** + 1. Select the apps that you would like to provision and then click **Next** when you're done. 2. Click **Skip** if you don't want to provision any apps. **Figure 6** - Select from a set of recommended Microsoft Store apps -  +  The set of recommended Microsoft Store for Education apps may vary from what we show here. diff --git a/mdop/docfx.json b/mdop/docfx.json index 5b4039884d..845ff81056 100644 --- a/mdop/docfx.json +++ b/mdop/docfx.json @@ -20,7 +20,8 @@ "ms.technology": "mdop", "ms.sitesec": "library", "ms.topic": "article", - "ms.author": "jamiet" + "ms.author": "jamiet", + "ms.date": "04/05/2017" }, "externalReference": [ ], diff --git a/store-for-business/TOC.md b/store-for-business/TOC.md index ba2c1b8c8a..514ff6cfea 100644 --- a/store-for-business/TOC.md +++ b/store-for-business/TOC.md @@ -27,4 +27,5 @@ ### [Update Microsoft Store for Business and Microsoft Store for Education account settings](update-windows-store-for-business-account-settings.md) ### [Manage user accounts in Microsoft Store for Business and Education](manage-users-and-groups-windows-store-for-business.md) ## [Troubleshoot Microsoft Store for Business](troubleshoot-windows-store-for-business.md) +## [Notifications in Microsoft Store for Business and Education](notifications-microsoft-store-business.md) diff --git a/store-for-business/docfx.json b/store-for-business/docfx.json index 05874cfbb2..82310e9a78 100644 --- a/store-for-business/docfx.json +++ b/store-for-business/docfx.json @@ -35,7 +35,8 @@ "uhfHeaderId": "MSDocsHeader-WindowsIT", "ms.author": "trudyha", "ms.technology": "windows", - "ms.topic": "article" + "ms.topic": "article", + "ms.date": "05/09/2017" }, "fileMetadata": {}, "template": [], diff --git a/store-for-business/education/TOC.md b/store-for-business/education/TOC.md index 2e4ef3a73c..1c2ebc03b3 100644 --- a/store-for-business/education/TOC.md +++ b/store-for-business/education/TOC.md @@ -32,4 +32,5 @@ ### [Update Microsoft Store for Business and Microsoft Store for Education account settings](/microsoft-store/update-windows-store-for-business-account-settings?toc=/microsoft-store/education/toc.json) ### [Manage user accounts in Microsoft Store for Business and Education](/microsoft-store/manage-users-and-groups-windows-store-for-business?toc=/microsoft-store/education/toc.json) ## [Troubleshoot Microsoft Store for Business](/microsoft-store/troubleshoot-windows-store-for-business?toc=/microsoft-store/education/toc.json) +## [Notifications in Microsoft Store for Business and Education](/microsoft-store/notifications-microsoft-store-business?toc=/microsoft-store/education/toc.json) diff --git a/store-for-business/notifications-microsoft-store-business.md b/store-for-business/notifications-microsoft-store-business.md new file mode 100644 index 0000000000..cb657a21ef --- /dev/null +++ b/store-for-business/notifications-microsoft-store-business.md @@ -0,0 +1,33 @@ +--- +title: Notifications in Microsoft Store for Business and Education (Windows 10) +description: Notifications alert you to issues or outages with Micrososft Store for Business and Education. +keywords: notifications, alerts +ms.assetid: +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: store +author: TrudyHa +localizationpriority: high +--- + +# Notifications in Microsoft Store for Business and Education + + +**Applies to** + +- Windows 10 +- Windows 10 Mobile + +Microsoft Store for Business and Microsoft Store for Education use a set of notifications to alert admins if there is an issue or outage with Microsoft Store. + +## Notifications for admins + +| Store area | Notification message | Customer impact | +| ---------- | -------------------- | --------------- | +| General | We’re on it. Something happened on our end with the Store. Waiting a bit might help. | You might be unable to sign in. There might be an intermittent Azure AD outage. | +| Manage | We’re on it. Something happened on our end with management for apps and software. We’re working to fix the problem. | You might be unable to manage inventory, including viewing inventory, distributing apps, assigning licenses, or viewing and managing order history. | +| Shop | We’re on it. Something happened on our end with purchasing. We’re working to fix the problem. | Shop might not be available. You might not be able to purchase new, or additional licenses. | +| Private store | We’re on it. Something happened on our end with your organization’s private store. People in your organization can’t download apps right now. We’re working to fix the problem. | People in your organization might not be able to view the private store, or get apps. | +| Acquistion and licensing | We’re on it. People in your org might not be able to install or use certain apps. We’re working to fix the problem. | People in your org might not be able to claim a license from your private store. | +| Partner | We’re on it. Something happened on our end with Find a Partner. We’re working to fix the problem. | You might not be able to search for a partner. | \ No newline at end of file diff --git a/store-for-business/windows-store-for-business-overview.md b/store-for-business/windows-store-for-business-overview.md index 0edcf1dfa2..430cd5c616 100644 --- a/store-for-business/windows-store-for-business-overview.md +++ b/store-for-business/windows-store-for-business-overview.md @@ -472,7 +472,7 @@ Microsoft Store for Business and Education is currently available in these marke
Added the following new policies for Windows 10, version 1703:
+Added the following new policies for Windows 10, version 1709:
+Added new CSP in the next major update to Windows 10.
+Added new CSP in Windows 10, version 1709.
To PurposeGroups setting, added the following values for the next major update of Windows 10:
+To PurposeGroups setting, added the following values Windows 10, version 1709:
[CM_CellularEntries CSP](cm-cellularentries-csp.md)
[EnterpriseAPN CSP](enterpriseapn-csp.md)
In the next major update of Windows 10, support was added for Windows 10 Home, Pro, Enterprise, and Education editions.
+In the Windows 10, version 1709, support was added for Windows 10 Home, Pro, Enterprise, and Education editions.
Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
---|---|---|---|---|---|---|
![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+
Added in Windows 10, version 1703. Specifies whether to allow the address bar drop-down functionality in Microsoft Edge. If you want to minimize network connections from Microsoft Edge to Microsoft services, we recommend disabling this functionality. @@ -2358,6 +2384,29 @@ ADMX Info: **Browser/AllowMicrosoftCompatibilityList** + +
Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
---|---|---|---|---|---|---|
![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+
Added in Windows 10, version 1703. Specifies whether to use the Microsoft compatibility list in Microsoft Edge. The Microsoft compatibility list is a Microsoft-provided list that enables sites with known compatibility issues to display properly. By default, the Microsoft compatibility list is enabled and can be viewed by visiting "about:compat". @@ -2466,6 +2515,29 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis **Browser/AllowSearchEngineCustomization** + +
Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
---|---|---|---|---|---|---|
![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+
Added in Windows 10, version 1703. Allows search engine customization for MDM-enrolled devices. Users can change their default search engine. @@ -2566,6 +2638,29 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis **Browser/ClearBrowsingDataOnExit** + +
Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
---|---|---|---|---|---|---|
![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+
Added in Windows 10, version 1703. Specifies whether to clear browsing data on exiting Microsoft Edge. @@ -2587,6 +2682,29 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis **Browser/ConfigureAdditionalSearchEngines** + +
Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
---|---|---|---|---|---|---|
![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+
Added in Windows 10, version 1703. Allows you to add up to 5 additional search engines for MDM-enrolled devices. @@ -2610,6 +2728,29 @@ Employees cannot remove these search engines, but they can set any one as the de **Browser/DisableLockdownOfStartPages** + +
Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
---|---|---|---|---|---|---|
![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+
Added in Windows 10, version 1703. Boolean value that specifies whether the lockdown on the Start pages is disabled. This policy works with the Browser/HomePages policy, which locks down the Start pages that the users cannot modify. You can use the DisableLockdownOfStartPages policy to allow users to modify the Start pages when the Browser/HomePages policy is in effect. @@ -2819,6 +2960,29 @@ Employees cannot remove these search engines, but they can set any one as the de **Browser/PreventFirstRunPage** + +
Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
---|---|---|---|---|---|---|
![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+
Added in Windows 10, version 1703. Specifies whether to enable or disable the First Run webpage. On the first explicit user-launch of Microsoft Edge, a First Run webpage hosted on Microsoft.com opens automatically via a FWLINK. This policy allows enterprises (such as those enrolled in a zero-emissions configuration) to prevent this page from opening. @@ -2834,6 +2998,29 @@ Employees cannot remove these search engines, but they can set any one as the de **Browser/PreventLiveTileDataCollection** + +
Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
---|---|---|---|---|---|---|
![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+
Added in Windows 10, version 1703. Specifies whether Microsoft can collect information to create a Live Tile when pinning a site to Start from Microsoft Edge. @@ -3005,6 +3192,29 @@ Employees cannot remove these search engines, but they can set any one as the de **Browser/SetDefaultSearchEngine** + +
Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
---|---|---|---|---|---|---|
![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+
Added in Windows 10, version 1703. Allows you configure the default search engine for your employees. By default, your employees can change the default search engine at any time. If you want to prevent your employees from changing the default search engine that you set, you can do so by configuring the AllowSearchEngineCustomization policy. @@ -7113,6 +7323,29 @@ ADMX Info: **Experience/AllowTailoredExperiencesWithDiagnosticData** + +
Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
---|---|---|---|---|---|---|
![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+
Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
---|---|---|---|---|---|---|
![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+
Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
---|---|---|---|---|---|---|
![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+
Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
---|---|---|---|---|---|---|
![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+
Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
---|---|---|---|---|---|---|
![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+
Added in Windows 10, version 1709. Turn off the display (on battery). This policy setting allows you to specify the period of inactivity before Windows turns off the display. + +
If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows turns off the display. + +
If you disable or do not configure this policy setting, users control this setting. + +
If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the display from turning off. The "Prevent enabling lock screen slide show" (DeviceLock/PreventLockScreenSlideShow) policy setting can be used to disable the slide show feature. + + + +ADMX Info: +- GP english name: *Turn off the display (on battery)* +- GP name: *VideoPowerDownTimeOutDC_2* +- GP path: *System/Power Management/Video and Display Settings* +- GP ADMX file name: *power.admx* + + + + + +**Power/DisplayOffTimeoutPluggedIn** + + + +
Added in Windows 10, version 1709. Turn off the display (plugged in). This policy setting allows you to specify the period of inactivity before Windows turns off the display. + +
If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows turns off the display. + +
If you disable or do not configure this policy setting, users control this setting. + +
If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the display from turning off. The "Prevent enabling lock screen slide show" (DeviceLock/PreventLockScreenSlideShow) policy setting can be used to disable the slide show feature. + + + +ADMX Info: +- GP english name: *Turn off the display (plugged in)* +- GP name: *VideoPowerDownTimeOutAC_2* +- GP path: *System/Power Management/Video and Display Settings* +- GP ADMX file name: *power.admx* + + + + + +**Power/HibernateTimeoutOnBattery** + + +
Added in Windows 10, version 1709. Specify the system hibernate timeout (on battery). This policy setting allows you to specify the period of inactivity before Windows transitions the system to hibernate. + +
If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows transitions to hibernate. + +
If you disable or do not configure this policy setting, users control this setting. + + +
If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" (DeviceLock/PreventLockScreenSlideShow) policy setting can be used to disable the slide show feature. + + +ADMX Info: +- GP english name: *Specify the system hibernate timeout (on battery)* +- GP name: *DCHibernateTimeOut_2* +- GP path: *System/Power Management/Sleep Settings* +- GP ADMX file name: *power.admx* + + + + + +**Power/HibernateTimeoutPluggedIn** + + +
Added in Windows 10, version 1709. Specify the system hibernate timeout (plugged in). This policy setting allows you to specify the period of inactivity before Windows transitions the system to hibernate. + +
If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows transitions to hibernate. + +
If you disable or do not configure this policy setting, users control this setting. + +
If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" (DeviceLock/PreventLockScreenSlideShow) policy setting can be used to disable the slide show feature. + + + +ADMX Info: +- GP english name: *Specify the system hibernate timeout (plugged in)* +- GP name: *ACHibernateTimeOut_2* +- GP path: *System/Power Management/Sleep Settings* +- GP ADMX file name: *power.admx* + + + + **Power/RequirePasswordWhenComputerWakesOnBattery** @@ -11665,6 +12084,53 @@ ADMX Info: + + +**Power/StandbyTimeoutOnBattery** + + +
Added in Windows 10, version 1709. Specify the system sleep timeout (on battery). This policy setting allows you to specify the period of inactivity before Windows transitions the system to sleep. + +
If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows transitions to sleep. + +
If you disable or do not configure this policy setting, users control this setting. + +
If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" (DeviceLock/PreventLockScreenSlideShow) policy setting can be used to disable the slide show feature. + + + +ADMX Info: +- GP english name: *Specify the system sleep timeout (on battery)* +- GP name: *DCStandbyTimeOut_2* +- GP path: *System/Power Management/Sleep Settings* +- GP ADMX file name: *power.admx* + + + + + +**Power/StandbyTimeoutPluggedIn** + + +
Added in Windows 10, version 1709. Specify the system sleep timeout (plugged in). This policy setting allows you to specify the period of inactivity before Windows transitions the system to sleep. + +
If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows transitions to sleep. + +
If you disable or do not configure this policy setting, users control this setting. + +
If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" (DeviceLock/PreventLockScreenSlideShow) policy setting can be used to disable the slide show feature. + + + +ADMX Info: +- GP english name: *Specify the system sleep timeout (plugged in)* +- GP name: *ACStandbyTimeOut_2* +- GP path: *System/Power Management/Sleep Settings* +- GP ADMX file name: *power.admx* + + + + **Printers/PointAndPrintRestrictions** @@ -14835,7 +15301,7 @@ ADMX Info: -
Enabling this policy prevents indexing from continuing after less than the specified amount of hard drive space is left on the same drive as the index location. Select between 0 and 2147483647 MB. +
Enabling this policy prevents indexing from continuing after less than the specified amount of hard drive space is left on the same drive as the index location. Select between 0 and 1.
Enable this policy if computers in your environment have extremely limited hard drive space. @@ -18165,6 +18631,29 @@ ADMX Info: **TimeLanguageSettings/AllowSet24HourClock** + +
Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
---|---|---|---|---|---|---|
![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+
Allows for the configuration of the default clock setting to be the 24 hour format. Selecting 'Set 24 hour Clock' enables this setting. Selecting 'Locale default setting' uses the default clock as prescribed by the current locale setting. @@ -18220,6 +18709,29 @@ ADMX Info: **Update/ActiveHoursMaxRange** + +
Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
---|---|---|---|---|---|---|
![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+
The default value is 8 (8 AM). + + + +**Update/AutoRestartDeadlinePeriodInDays** + + +
Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
---|---|---|---|---|---|---|
![]() |
+ ![]() |
+ + | ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+
Added in Windows 10, version 1703. This policy defines the deadline in days after which a reboot for updates will become mandatory. + +
Supported values are 2-30 days. + +
The default value is 7 days. + @@ -18461,6 +19008,29 @@ ADMX Info: **Update/AutoRestartNotificationSchedule** + +
Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
---|---|---|---|---|---|---|
![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+
Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
---|---|---|---|---|---|---|
![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+
Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
---|---|---|---|---|---|---|
![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+
Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
---|---|---|---|---|---|---|
![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+
Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
---|---|---|---|---|---|---|
![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+
Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
---|---|---|---|---|---|---|
![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+
Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
---|---|---|---|---|---|---|
![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+
Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +MobileEnterprise | +
---|---|---|---|---|---|---|
![]() |
+ ![]() |
+ + | ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+
Supported operations are Get and Replace. +**DeviceTagging** +
Added in Windows 10, version 1709. Represents Windows Defender Advanced Threat Protection configuration for managing role based access and device tagging. + +
Supported operations is Get. + +**DeviceTagging/Group** +
Added in Windows 10, version 1709. Device group identifiers. + +
The data type is a string. + +
Supported operations are Get and Replace. + +**DeviceTagging/Criticality** +
Added in Windows 10, version 1709. Asset criticality value. Supported values: + +- 0 - Normal +- 1 - Critical + +
The data type is an integer. + +
Supported operations are Get and Replace.
+
## Examples
@@ -98,7 +120,7 @@ The following list describes the characteristics and parameters.
Care must be taken to get a support statement from the software provider that their app is safe with WIP before adding it to your **App Rules** list. If you don’t get this statement, it’s possible that you could experience app compat issues due to an app losing the ability to access a necessary file after revocation.
+>Enlightened apps are expected to prevent enterprise data from going to unprotected network locations and to avoid encrypting personal data. On the other hand, WIP-unaware apps might not respect the corporate network boundary, and WIP-unaware apps will encrypt all files they create or modify. This means that they could encrypt personal data and cause data loss during the revocation process. Care must be taken to get a support statement from the software provider that their app is safe with WIP before adding it to your **App Rules** list. If you don’t get this statement, it’s possible that you could experience app compat issues due to an app losing the ability to access a necessary file after revocation.
#### Add a store app rule to your policy
For this example, we’re going to add Microsoft OneNote, a store app, to the **App Rules** list.
@@ -309,13 +309,13 @@ If you're running into compatibility issues where your app is incompatible with
### Manage the WIP protection mode for your enterprise data
After you've added the apps you want to protect with WIP, you'll need to apply a management and protection mode.
-We recommend that you start with **Silent** or **Override** while verifying with a small group that you have the right apps on your protected apps list. After you're done, you can change to your final enforcement policy, either **Override** or **Block**.
+We recommend that you start with **Silent** or **Allow Overrides** while verifying with a small group that you have the right apps on your protected apps list. After you're done, you can change to your final enforcement policy, either **Allow Overrides** or **Hide Overrides**.
|Mode |Description |
|-----|------------|
-|Block |WIP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between other people and devices outside of your enterprise.|
-|Override |WIP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log, accessible through the [Reporting CSP](https://go.microsoft.com/fwlink/p/?LinkID=746459). |
-|Silent |WIP runs silently, logging inappropriate data sharing, without blocking anything that would’ve been prompted for employee interaction while in Override mode. Unallowed actions, like apps inappropriately trying to access a network resource or WIP-protected data, are still blocked.|
+|Hide Overrides|WIP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between other people and devices outside of your enterprise.|
+|Allow Overrides|WIP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log, accessible through the [Reporting CSP](https://go.microsoft.com/fwlink/p/?LinkID=746459). |
+|Silent |WIP runs silently, logging inappropriate data sharing, without blocking anything that would’ve been prompted for employee interaction while in Allow Overrides mode. Unallowed actions, like apps inappropriately trying to access a network resource or WIP-protected data, are still blocked.|
|Off (not recommended) |WIP is turned off and doesn't help to protect or audit your data. After you turn off WIP, an attempt is made to decrypt any WIP-tagged files on the locally attached drives. Be aware that your previous decryption and policy info isn’t automatically reapplied if you turn WIP protection back on.|

diff --git a/windows/threat-protection/windows-information-protection/create-wip-policy-using-sccm.md b/windows/threat-protection/windows-information-protection/create-wip-policy-using-sccm.md
index 4dbf46f1e8..d8a879c4d2 100644
--- a/windows/threat-protection/windows-information-protection/create-wip-policy-using-sccm.md
+++ b/windows/threat-protection/windows-information-protection/create-wip-policy-using-sccm.md
@@ -63,7 +63,7 @@ During the policy-creation process in System Center Configuration Manager, you c
The steps to add your app rules are based on the type of rule template being applied. You can add a store app (also known as a Universal Windows Platform (UWP) app), a signed Windows desktop app, or an AppLocker policy file.
>[!IMPORTANT]
->WIP-aware apps are expected to prevent enterprise data from going to unprotected network locations and to avoid encrypting personal data. On the other hand, WIP-unaware apps might not respect the corporate network boundary, and WIP-unaware apps will encrypt all files they create or modify. This means that they could encrypt personal data and cause data loss during the revocation process. Care must be taken to get a support statement from the software provider that their app is safe with WIP before adding it to your **App rules** list. If you don’t get this statement, it’s possible that you could experience app compat issues due to an app losing the ability to access a necessary file after revocation.
+>Enlightened apps are expected to prevent enterprise data from going to unprotected network locations and to avoid encrypting personal data. On the other hand, WIP-unaware apps might not respect the corporate network boundary, and WIP-unaware apps will encrypt all files they create or modify. This means that they could encrypt personal data and cause data loss during the revocation process. Care must be taken to get a support statement from the software provider that their app is safe with WIP before adding it to your **App rules** list. If you don’t get this statement, it’s possible that you could experience app compat issues due to an app losing the ability to access a necessary file after revocation.
#### Add a store app rule to your policy
For this example, we’re going to add Microsoft OneNote, a store app, to the **App Rules** list.
@@ -94,7 +94,9 @@ If you don't know the publisher or product name, you can find them for both desk
1. Go to the [Windows Store for Business](https://go.microsoft.com/fwlink/p/?LinkID=722910) website, and find your app. For example, Microsoft OneNote.
- >**Note** For example:
+ >[!IMPORTANT]
+ >The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as “CN=” followed by the `windowsPhoneLegacyId`. For example:
```json
{
"windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d",
@@ -121,7 +124,8 @@ If you don't know the publisher or product name, you can find them for both desk
**To find the Publisher and Product Name values for apps installed on Windows 10 mobile phones**
1. If you need to add mobile apps that aren't distributed through the Store for Business, you must use the **Windows Device Portal** feature.
- >**Note**
```json
{
@@ -460,6 +465,9 @@ After you've decided where your protected apps can access enterprise data on you
- **No.** Hides the **Personal** option from employees. Be aware that if you pick this option, apps that use the **Save As** dialog box might encrypt new files as corporate data unless a different file path is given during the original file creation. After this happens, decryption of work files becomes more difficult.
+ >[!IMPORTANT]
+ >The **Show the Personal option in the File ownership menus of File Explorer and the Save As dialog box** option is only available for Configuration Manager versions 1610 and below.
+
- **Prevent corporate data from being accessed by apps when the device is locked. Applies only to Windows 10 Mobile**. Determines whether to encrypt enterprise data using a key that's protected by an employee's PIN code on a locked device. Apps won't be able to read corporate data when the device is locked. The options are:
- **Yes (recommended).** Turns on the feature and provides the additional protection.
diff --git a/windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md b/windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md
new file mode 100644
index 0000000000..60eb44c676
--- /dev/null
+++ b/windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md
@@ -0,0 +1,43 @@
+---
+title: Deploy your Windows Information Protection (WIP) policy using the Azure portal for Microsoft Intune (Windows 10)
+description: After you’ve created your Windows Information Protection (WIP) policy, you'll need to deploy it to your organization's enrolled devices.
+keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, Intune
+ms.prod: w10
+ms.mktglfcycl: explore
+ms.sitesec: library
+ms.pagetype: security
+author: eross-msft
+localizationpriority: high
+---
+
+# Deploy your Windows Information Protection (WIP) policy using the Azure portal for Microsoft Intune
+
+**Applies to:**
+
+- Windows 10, version 1607 and later
+- Windows 10 Mobile, version 1607 and later (except Microsoft Azure Rights Management, which is only available on the desktop)
+
+After you’ve created your Windows Information Protection (WIP) policy, you'll need to deploy it to your organization's enrolled devices. Enrollment can be done for business or personal devices, allowing the devices to use your managed apps and to sync with your managed content and information.
+
+**To deploy your WIP policy**
+
+1. On the **App policy** pane, click your newly-created policy, click **User groups** from the menu that appears, and then click **Add user group**.
+
+ A list of user groups, made up of all of the security groups in your Azure Active Directory, appear in the **Add user group** pane.
+
+2. Choose the group you want your policy to apply to, and then click **Select** to deploy the policy.
+
+ The policy is deployed to the selected users' devices.
+
+ 
+
+
+>[!NOTE]
+>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).
+
+## Related topics
+- [Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune.md)
+
+- [Associate and deploy your Windows Information Protection (WIP) and VPN policies by using Microsoft Intune](create-vpn-and-wip-policy-using-intune.md)
+
+- [General guidance and best practices for Windows Information Protection (WIP)](guidance-and-best-practices-wip.md)
diff --git a/windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune.md b/windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune.md
index c7dcdf364b..a3b19da3c4 100644
--- a/windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune.md
+++ b/windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune.md
@@ -1,5 +1,5 @@
---
-title: Deploy your Windows Information Protection (WIP) policy using Microsoft Intune (Windows 10)
+title: Deploy your Windows Information Protection (WIP) policy using the classic console for Microsoft Intune (Windows 10)
description: After you’ve created your Windows Information Protection (WIP) policy, you'll need to deploy it to your organization's enrolled devices.
ms.assetid: 9c4a01e7-0b1c-4f15-95d0-0389f0686211
keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, Intune
@@ -11,11 +11,11 @@ author: eross-msft
localizationpriority: high
---
-# Deploy your Windows Information Protection (WIP) policy using Microsoft Intune
+# Deploy your Windows Information Protection (WIP) policy using the classic console for Microsoft Intune
**Applies to:**
-- Windows 10, version 1607
-- Windows 10 Mobile
+- Windows 10, version 1607 and later
+- Windows 10 Mobile, version 1607 and later
After you’ve created your Windows Information Protection (WIP) policy, you'll need to deploy it to your organization's enrolled devices. Enrollment can be done for business or personal devices, allowing the devices to use your managed apps and to sync with your managed content and information.
diff --git a/windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md b/windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md
index 77df2d4e51..159440b9aa 100644
--- a/windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md
+++ b/windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md
@@ -1,6 +1,6 @@
---
title: List of enlightened Microsoft apps for use with Windows Information Protection (WIP) (Windows 10)
-description: Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your Protected Apps list.
+description: Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your allowed apps list.
ms.assetid: 17c85ea3-9b66-4b80-b511-8f277cb4345f
keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection
ms.prod: w10
@@ -21,7 +21,7 @@ localizationpriority: high
Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your allowed apps list.
## Enlightened versus unenlightened apps
-Apps can be enlightened (also referred to as WIP-aware) or unenlightened (also referred to as WIP-unaware).
+Apps can be enlightened or unenlightened:
- **Enlightened apps** can differentiate between corporate and personal data, correctly determining which to protect, based on your policies.
@@ -31,6 +31,8 @@ Apps can be enlightened (also referred to as WIP-aware) or unenlightened (also r
- Windows **Save As** experiences only allow you to save your files as enterprise.
+- **WIP-work only apps** are unenlightened line-of-business apps that have been tested and deemed safe for use in an enterprise with WIP and Mobile App Management (MAM) solutions.
+
## List of enlightened Microsoft apps
Microsoft has made a concerted effort to enlighten several of our more popular apps, including the following:
@@ -42,9 +44,13 @@ Microsoft has made a concerted effort to enlighten several of our more popular a
- Mobile Office apps, including Word, Excel, PowerPoint, OneNote, and Outlook Mail and Calendar
-- Microsoft Photos
+- Office 365 ProPlus apps, including Word, Excel, PowerPoint, OneNote, and Outlook
-
+- OneDrive app
+
+- OneDrive sync client (OneDrive.exe, the next generation sync client)
+
+- Microsoft Photos
- Groove Music
@@ -58,6 +64,11 @@ Microsoft has made a concerted effort to enlighten several of our more popular a
- Microsoft Remote Desktop
+## List of WIP-work only apps from Microsoft
+Microsoft still has apps that are unenlightened, but which have been tested and deemed safe for use in an enterprise with WIP and MAM solutions.
+
+- Skype for Business
+
## Adding enlightened Microsoft apps to the allowed apps list
You can add any or all of the enlightened Microsoft apps to your allowed apps list. Included here is the **Publisher name**, **Product or File name**, and **App Type** info for both Microsoft Intune and System Center Configuration Manager.
@@ -70,12 +81,14 @@ You can add any or all of the enlightened Microsoft apps to your allowed apps li
|PowerPoint Mobile |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US` After you turn off WIP, an attempt is made to decrypt any WIP-tagged files on the locally attached drives. Be aware that your previous decryption and policy info isn’t automatically reapplied if you turn WIP protection back on. **Note**
+
+|Name|Twitter|
+|---|---|
+|Casey Smith |@subTee|
+|Matt Graeber | @mattifestation|
+|Matt Nelson | @enigma0x3|
+|Oddvar Moe |@Oddvarmoe|
+
+
+
+>[!Note]
+>This application list is fluid and will be updated with the latest vendor information as application vulnerabilities are resolved and new issues are discovered.
+
+Certain software applications may allow additional code to run by design. These types of applications should be blocked by your Device Guard policy. In addition, when an application version is upgraded to fix a security vulnerability or potential Device Guard bypass, you should add deny rules to your code integrity policies for that application’s previous, less secure versions.
+
+Microsoft recommends that you install the latest security updates. The June 2017 Windows updates resolve several issues in in-box PowerShell modules that allowed an attacker to bypass Device Guard code integrity policies. These modules cannot be blocked by name or version, and therefore must be blocked by their corresponding hashes.
+
+Microsoft recommends that you block the following Microsoft-signed applications and PowerShell files by merging the following policy into your existing policy to add these deny rules using the Merge-CIPolicy cmdlet:
+
+```
+
+
To create a code integrity policy, copy each of the following commands into an elevated Windows PowerShell session, in order:
@@ -36,7 +237,7 @@ To create a code integrity policy, copy each of the following commands into an e
` New-CIPolicy -Level PcaCertificate -FilePath $InitialCIPolicy –UserPEs 3> CIPolicyLog.txt `
- > **Notes**
+ > [!Notes]
> - When you specify the **-UserPEs** parameter (to include user mode executables in the scan), rule option **0 Enabled:UMCI** is automatically added to the code integrity policy. In contrast, if you do not specify **-UserPEs**, the policy will be empty of user mode executables and will only have rules for kernel mode binaries like drivers, in other words, the whitelist will not include applications. If you create such a policy and later add rule option **0 Enabled:UMCI**, all attempts to start applications will cause a response from Device Guard. In audit mode, the response is logging an event, and in enforced mode, the response is blocking the application.
@@ -52,7 +253,8 @@ To create a code integrity policy, copy each of the following commands into an e
After you complete these steps, the Device Guard binary file (DeviceGuardPolicy.bin) and original .xml file (IntialScan.xml) will be available on your desktop. You can use the binary version as a code integrity policy or sign it for additional security.
-> **Note** We recommend that you keep the original .xml file of the policy for use when you need to merge the code integrity policy with another policy or update its rule options. Alternatively, you would have to create a new policy from a new scan for servicing. For more information about how to merge code integrity policies, see [Merge code integrity policies](#merge-code-integrity-policies).
+> [!Note]
+> We recommend that you keep the original .xml file of the policy for use when you need to merge the code integrity policy with another policy or update its rule options. Alternatively, you would have to create a new policy from a new scan for servicing. For more information about how to merge code integrity policies, see [Merge code integrity policies](#merge-code-integrity-policies).
We recommend that every code integrity policy be run in audit mode before being enforced. Doing so allows administrators to discover any issues with the policy without receiving error message dialog boxes. For information about how to audit a code integrity policy, see the next section, [Audit code integrity policies](#audit-code-integrity-policies).
@@ -60,7 +262,8 @@ We recommend that every code integrity policy be run in audit mode before being
When code integrity policies are run in audit mode, it allows administrators to discover any applications that were missed during an initial policy scan and to identify any new applications that have been installed and run since the original policy was created. While a code integrity policy is running in audit mode, any binary that runs and would have been denied had the policy been enforced is logged in the **Applications and Services Logs\\Microsoft\\Windows\\CodeIntegrity\\Operational** event log. When these logged binaries have been validated, they can easily be added to a new code integrity policy. When the new exception policy is created, you can merge it with your existing code integrity policies.
-> **Note** Before you begin this process, you need to create a code integrity policy binary file. If you have not already done so, see [Create a code integrity policy from a golden computer](#create-a-code-integrity-policy-from-a-golden-computer), earlier in this topic, for a step-by-step walkthrough of the process to create a code integrity policy and convert it to binary format.
+> [!Note]
+> Before you begin this process, you need to create a code integrity policy binary file. If you have not already done so, see [Create a code integrity policy from a golden computer](#create-a-code-integrity-policy-from-a-golden-computer), earlier in this topic, for a step-by-step walkthrough of the process to create a code integrity policy and convert it to binary format.
**To audit a code integrity policy with local policy:**
@@ -68,7 +271,7 @@ When code integrity policies are run in audit mode, it allows administrators to
2. On the computer you want to run in audit mode, open the Local Group Policy Editor by running **GPEdit.msc**.
- > **Notes**
+ > [!Note]
> - The computer that you will run in audit mode must be clean of viruses or malware. Otherwise, in the process that you follow after auditing the system, you might unintentionally merge in a code integrity policy that allows viruses or malware to run.
@@ -76,7 +279,7 @@ When code integrity policies are run in audit mode, it allows administrators to
3. Navigate to **Computer Configuration\\Administrative Templates\\System\\Device Guard**, and then select **Deploy Code Integrity Policy**. Enable this setting by using the appropriate file path, for example, C:\\Windows\\System32\\CodeIntegrity\\DeviceGuardPolicy.bin, as shown in Figure 1.
- > **Notes**
+ > [!Note]
> - The illustration shows the example file name *DeviceGuardPolicy.bin* because this name was used earlier in this topic, in [Create a code integrity policy from a golden computer](#create-a-code-integrity-policy-from-a-golden-computer). Also, this policy file does not need to be copied to every system. You can instead copy the code integrity policies to a file share to which all computer accounts have access.
@@ -124,7 +327,8 @@ Use the following procedure after you have been running a computer with a code i
` New-CIPolicy -Audit -Level Hash -FilePath $CIAuditPolicy –UserPEs 3> CIPolicylog.txt`
- > **Note** When you create policies from audit events, you should carefully consider the file rule level that you select to trust. The preceding example uses the **Hash** rule level, which is the most specific. Any change to the file (such as replacing the file with a newer version of the same file) will change the Hash value, and require an update to the policy.
+ > [!Note]
+ > When you create policies from audit events, you should carefully consider the file rule level that you select to trust. The preceding example uses the **Hash** rule level, which is the most specific. Any change to the file (such as replacing the file with a newer version of the same file) will change the Hash value, and require an update to the policy.
4. Find and review the Device Guard audit policy .xml file that you created. If you used the example variables as shown, the filename will be **DeviceGuardAuditPolicy.xml**, and it will be on your desktop. Look for the following:
@@ -134,7 +338,8 @@ Use the following procedure after you have been running a computer with a code i
You can now use this file to update the existing code integrity policy that you ran in audit mode by merging the two policies. For instructions on how to merge this audit policy with the existing code integrity policy, see the next section, [Merge code integrity policies](#merge-code-integrity-policies).
-> **Note** You may have noticed that you did not generate a binary version of this policy as you did in [Create a code integrity policy from a golden computer](#create-a-code-integrity-policy-from-a-golden-computer). This is because code integrity policies created from an audit log are not intended to run as stand-alone policies but rather to update existing code integrity policies.
+> [!Note]
+> You may have noticed that you did not generate a binary version of this policy as you did in [Create a code integrity policy from a golden computer](#create-a-code-integrity-policy-from-a-golden-computer). This is because code integrity policies created from an audit log are not intended to run as stand-alone policies but rather to update existing code integrity policies.
## Use a code integrity policy to control specific plug-ins, add-ins, and modules
@@ -166,7 +371,8 @@ New-CIPolicy -Rules $rule -FilePath ".\BlockAddins.xml" -UserPEs
When you develop code integrity policies, you will occasionally need to merge two policies. A common example is when a code integrity policy is initially created and audited. Another example is when you create a single master policy by using multiple code integrity policies previously created from golden computers. Because each computer running Windows 10 can have only one code integrity policy, it is important to properly maintain these policies. In this example, audit events have been saved into a secondary code integrity policy that you then merge with the initial code integrity policy.
-> **Note** The following example uses several of the code integrity policy .xml files that you created in earlier sections in this topic. You can follow this process, however, with any two code integrity policies you would like to combine.
+> [!Note]
+> The following example uses several of the code integrity policy .xml files that you created in earlier sections in this topic. You can follow this process, however, with any two code integrity policies you would like to combine.
To merge two code integrity policies, complete the following steps in an elevated Windows PowerShell session:
@@ -182,7 +388,8 @@ To merge two code integrity policies, complete the following steps in an elevate
` $CIPolicyBin=$CIPolicyPath+"NewDeviceGuardPolicy.bin"`
- > **Note** The variables in this section specifically expect to find an initial policy on your desktop called **InitialScan.xml** and an audit code integrity policy called **DeviceGuardAuditPolicy.xml**. If you want to merge other code integrity policies, update the variables accordingly.
+ > [!Note]
+ > The variables in this section specifically expect to find an initial policy on your desktop called **InitialScan.xml** and an audit code integrity policy called **DeviceGuardAuditPolicy.xml**. If you want to merge other code integrity policies, update the variables accordingly.
2. Use [Merge-CIPolicy](https://technet.microsoft.com/library/mt634485.aspx) to merge two policies and create a new code integrity policy:
@@ -198,7 +405,8 @@ Now that you have created a new code integrity policy (for example, called **New
Every code integrity policy is created with audit mode enabled. After you have successfully deployed and tested a code integrity policy in audit mode and are ready to test the policy in enforced mode, complete the following steps in an elevated Windows PowerShell session:
-> **Note** Every code integrity policy should be tested in audit mode first. For information about how to audit code integrity policies, see [Audit code integrity policies](#audit-code-integrity-policies), earlier in this topic.
+> [!Note]
+> Every code integrity policy should be tested in audit mode first. For information about how to audit code integrity policies, see [Audit code integrity policies](#audit-code-integrity-policies), earlier in this topic.
1. Initialize the variables that will be used:
@@ -210,7 +418,8 @@ Every code integrity policy is created with audit mode enabled. After you have s
` $CIPolicyBin=$CIPolicyPath+"EnforcedDeviceGuardPolicy.bin"`
- > **Note** The initial code integrity policy that this section refers to was created in the [Create a code integrity policy from a golden computer](#create-a-code-integrity-policy-from-a-golden-computer) section. If you are using a different code integrity policy, update the **CIPolicyPath** and **InitialCIPolicy** variables.
+ > [!Note]
+ > The initial code integrity policy that this section refers to was created in the [Create a code integrity policy from a golden computer](#create-a-code-integrity-policy-from-a-golden-computer) section. If you are using a different code integrity policy, update the **CIPolicyPath** and **InitialCIPolicy** variables.
2. Ensure that rule options 9 (“Advanced Boot Options Menu”) and 10 (“Boot Audit on Failure”) are set the way that you intend for this policy. We strongly recommend that you enable these rule options before you run any enforced policy for the first time. Enabling these options provides administrators with a pre-boot command prompt, and allows Windows to start even if the code integrity policy blocks a kernel-mode driver from running. When ready for enterprise deployment, you can remove these options.
@@ -228,7 +437,8 @@ Every code integrity policy is created with audit mode enabled. After you have s
` Set-RuleOption -FilePath $EnforcedCIPolicy -Option 3 -Delete`
- > **Note** To enforce a code integrity policy, you delete option 3, the **Audit Mode Enabled** option. There is no “enforced” option that can be placed in a code integrity policy.
+ > [!Note]
+ > To enforce a code integrity policy, you delete option 3, the **Audit Mode Enabled** option. There is no “enforced” option that can be placed in a code integrity policy.
5. Use [ConvertFrom-CIPolicy](https://technet.microsoft.com/library/mt733073.aspx) to convert the new code integrity policy to binary format:
@@ -244,7 +454,8 @@ Signing code integrity policies by using an on-premises CA-generated certificate
Before signing code integrity policies for the first time, be sure to enable rule options 9 (“Advanced Boot Options Menu”) and 10 (“Boot Audit on Failure”) to leave troubleshooting options available to administrators. To ensure that a rule option is enabled, you can run a command such as `Set-RuleOption -FilePath
This can be relevant because of drivers. You could create a code integrity policy on hardware that uses a particular set of drivers, and if other drivers in your environment use the same signature, they would also be allowed to run. However, you might need to create several code integrity policies on different "reference" hardware, then merge the policies together, to ensure that the resulting policy recognizes all the drivers in your environment.
- - Is there already a list of accepted applications?
A list of accepted applications can be used to help create a baseline code integrity policy.
As of Windows 10, version 1703, it might also be useful to have a list of plug-ins, add-ins, or modules that you want to allow only in a specific app (such as a line-of-business app). Similarly, it might be useful to have a list of plug-ins, add-ins, or modules that you want to block in a specific app (such as a browser).
-
- What software does each department or role need? Should they be able to install and run other departments’ software?
If multiple departments are allowed to run the same list of software, you might be able to merge several code integrity policies to simplify management.
- Are there departments or roles where unique, restricted software is used?
If one department needs to run an application that no other department is allowed, it might require a separate code integrity policy. Similarly, if only one department must run an old version of an application (while other departments allow only the newer version), it might require a separate code integrity policy.
+ - Is there already a list of accepted applications?
A list of accepted applications can be used to help create a baseline code integrity policy.
As of Windows 10, version 1703, it might also be useful to have a list of plug-ins, add-ins, or modules that you want to allow only in a specific app (such as a line-of-business app). Similarly, it might be useful to have a list of plug-ins, add-ins, or modules that you want to block in a specific app (such as a browser).
+
+ - As part of a threat review process, have you reviewed systems for software that can load arbitrary DLLs or run code or scripts?
+ In day-to-day operations, your organization’s security policy may allow certain applications, code, or scripts to run on your systems depending on their role and the context. However, if your security policy requires that you run only trusted applications, code, and scripts on your systems, you may decide to lock these systems down securely with Device Guard code integrity policies. You can also fine-tune your control by using Device Guard in combination with AppLocker, as described in [Device Guard with AppLocker](https://technet.microsoft.com/itpro/windows/keep-secure/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies#device-guard-with-applocker).
+
+ Legitimate applications from trusted vendors provide valid functionality. However, an attacker could also potentially use that same functionality to run malicious executable code that could bypass code integrity policies.
+
+ For operational scenarios that require elevated security, certain applications with known Code Integrity bypasses may represent a security risk if you whitelist them in your code integrity policies. Other applications where older versions of the application had vulnerabilities also represent a risk. Therefore, you may want to deny or block such applications from your code integrity policies. For applications with vulnerabilities, once the vulnerabilities are fixed you can create a rule that only allows the fixed or newer versions of that application. The decision to allow or block applications depends on the context and on how the reference system is being used.
+
+ Security professionals collaborate with Microsoft continuously to help protect customers. With the help of their valuable reports, Microsoft has identified a list of known applications that an attacker could potentially use to bypass Device Guard code integrity policies. (See the Acknowledgments section of [Deploy code integrity policies: steps](https://technet.microsoft.com/itpro/windows/keep-secure/deploy-code-integrity-policies-steps)).
+Depending on the context, you may want to block these applications. To see this list of applications and for use case examples, such as disabling Windows Script Host (WHS) or disabling msbuild.exe, see Deploy code integrity policies: steps.
+
+
+
+
+
+
+
+
+
4. **Identify LOB applications that are currently unsigned**. Although requiring signed code (through code integrity policies) protects against many threats, your organization might use unsigned LOB applications, for which the process of signing might be difficult. You might also have applications that are signed, but you want to add a secondary signature to them. If so, identify these applications, because you will need to create a catalog file for them. For a basic description of catalog files, see the table in [Introduction to Device Guard: virtualization-based security and code integrity policies](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md). For more background information about catalog files, see [Reviewing your applications: application signing and catalog files](requirements-and-deployment-planning-guidelines-for-device-guard.md#reviewing-your-applications-application-signing-and-catalog-files).
## Getting started on the deployment process
diff --git a/windows/device-security/docfx.json b/windows/device-security/docfx.json
index c0e36621af..ca5178e70e 100644
--- a/windows/device-security/docfx.json
+++ b/windows/device-security/docfx.json
@@ -33,7 +33,10 @@
"globalMetadata": {
"uhfHeaderId": "MSDocsHeader-WindowsIT",
"breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json",
- "ms.technology": "windows"
+ "ms.technology": "windows",
+ "ms.topic": "article",
+ "ms.author": "justinha",
+ "ms.date": "04/05/2017"
},
"fileMetadata": {},
"template": [],
diff --git a/windows/device-security/images/tpm-capabilities.png b/windows/device-security/images/tpm-capabilities.png
new file mode 100644
index 0000000000..aecbb68522
Binary files /dev/null and b/windows/device-security/images/tpm-capabilities.png differ
diff --git a/windows/device-security/images/tpm-remote-attestation.png b/windows/device-security/images/tpm-remote-attestation.png
new file mode 100644
index 0000000000..fa092591a1
Binary files /dev/null and b/windows/device-security/images/tpm-remote-attestation.png differ
diff --git a/windows/device-security/tpm/tpm-recommendations.md b/windows/device-security/tpm/tpm-recommendations.md
index 20d05b68d2..1b874b2988 100644
--- a/windows/device-security/tpm/tpm-recommendations.md
+++ b/windows/device-security/tpm/tpm-recommendations.md
@@ -100,8 +100,8 @@ The following table defines which Windows features require TPM support.
| Windows Features | Windows 10 TPM 1.2 | Windows 10 TPM 2.0 | Details |
|-------------------------|----------------------|----------------------|----------|
-| Measured Boot | Required | Required | Measured boot requires TPM 1.2 or 2.0 and UEFI Secure boot. |
-| Bitlocker | Required | Required | TPM 1.2 or later required or a removable USB memory device such as a flash drive. |
+| Measured Boot | Required | Required | Measured boot requires TPM 1.2 or 2.0 and UEFI Secure Boot. |
+| Bitlocker | Required | Required | TPM 1.2 or later required or a removable USB memory device such as a flash drive. Please note that TPM 2.0 requires UEFI Secure Boot in order for BitLocker to work properly. |
| Passport: Domain AADJ Join | Required | Required | Supports both versions of TPM, but requires TPM with HMAC and EK certificate for key attestation support. |
| Passport: MSA or Local Account | Required | Required | TPM 2.0 is required with HMAC and EK certificate for key attestation support. |
| Device Encryption | Not Applicable | Required | TPM 2.0 is required for all InstantGo devices. |
@@ -120,4 +120,4 @@ Government customers and enterprise customers in regulated industries may have a
## Related topics
-- [Trusted Platform Module](trusted-platform-module-top-node.md) (list of topics)
\ No newline at end of file
+- [Trusted Platform Module](trusted-platform-module-top-node.md) (list of topics)
diff --git a/windows/hub/docfx.json b/windows/hub/docfx.json
index e134b0e320..a95581a35a 100644
--- a/windows/hub/docfx.json
+++ b/windows/hub/docfx.json
@@ -35,7 +35,10 @@
"globalMetadata": {
"uhfHeaderId": "MSDocsHeader-WindowsIT",
"breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json",
- "ms.technology": "windows"
+ "ms.technology": "windows",
+ "ms.topic": "article",
+ "ms.author": "brianlic",
+ "ms.date": "04/05/2017"
},
"fileMetadata": {},
"template": [],
diff --git a/windows/threat-protection/TOC.md b/windows/threat-protection/TOC.md
index 681794b4f9..2a1c0426c4 100644
--- a/windows/threat-protection/TOC.md
+++ b/windows/threat-protection/TOC.md
@@ -134,9 +134,12 @@
## [Protect your enterprise data using Windows Information Protection (WIP)](windows-information-protection\protect-enterprise-data-using-wip.md)
### [Create a Windows Information Protection (WIP) policy](windows-information-protection\overview-create-wip-policy.md)
-#### [Create a Windows Information Protection (WIP) policy using Microsoft Intune](windows-information-protection\create-wip-policy-using-intune.md)
-##### [Deploy your Windows Information Protection (WIP) policy](windows-information-protection\deploy-wip-policy-using-intune.md)
-##### [Create and deploy a VPN policy for Windows Information Protection (WIP) using Microsoft Intune](windows-information-protection\create-vpn-and-wip-policy-using-intune.md)
+#### [Create a Windows Information Protection (WIP) using the classic console for Microsoft Intune](windows-information-protection\create-wip-policy-using-intune.md)
+##### [Deploy your Windows Information Protection (WIP) policy using the classic console for Microsoft Intune](windows-information-protection\deploy-wip-policy-using-intune.md)
+##### [Associate and deploy a VPN policy for Windows Information Protection (WIP) using the classic console for Microsoft Intune](windows-information-protection\create-vpn-and-wip-policy-using-intune.md)
+#### [Create a Windows Information Protection (WIP) with enrollment policy using the Azure portal for Microsoft Intune](windows-information-protection\create-wip-policy-using-intune-azure.md)
+##### [Deploy your Windows Information Protection (WIP) policy using the Azure portal for Microsoft Intune](windows-information-protection\deploy-wip-policy-using-intune-azure.md)
+##### [Associate and deploy a VPN policy for Windows Information Protection (WIP) using the Azure portal for Microsoft Intune](windows-information-protection\create-vpn-and-wip-policy-using-intune-azure.md)
#### [Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager](windows-information-protection\create-wip-policy-using-sccm.md)
#### [Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](windows-information-protection\create-and-verify-an-efs-dra-certificate.md)
#### [Determine the Enterprise Context of an app running in Windows Information Protection (WIP)](windows-information-protection\wip-app-enterprise-context.md)
diff --git a/windows/threat-protection/change-history-for-threat-protection.md b/windows/threat-protection/change-history-for-threat-protection.md
index 07f61a5d85..ed82259478 100644
--- a/windows/threat-protection/change-history-for-threat-protection.md
+++ b/windows/threat-protection/change-history-for-threat-protection.md
@@ -11,10 +11,19 @@ author: brianlic-msft
# Change history for threat protection
This topic lists new and updated topics in the [Threat protection](index.md) documentation.
+## June 2017
+|New or changed topic |Description |
+|---------------------|------------|
+[Create a Windows Information Protection (WIP) with enrollment policy using the Azure portal for Microsoft Intune](windows-information-protection\create-wip-policy-using-intune-azure.md)|New topic for MDM using the Azure portal.|
+[Deploy your Windows Information Protection (WIP) policy using the Azure portal for Microsoft Intune](windows-information-protection\deploy-wip-policy-using-intune-azure.md)|New topic for MDM using the Azure portal.|
+[Associate and deploy a VPN policy for Windows Information Protection (WIP) using the Azure portal for Microsoft Intune](windows-information-protection\create-vpn-and-wip-policy-using-intune-azure.md)|New topic for MDM using the Azure portal.|
+|[List of enlightened Microsoft apps for use with Windows Information Protection (WIP)](windows-information-protection\enlightened-microsoft-apps-and-wip.md)|Updated to include newly enlightened and supported apps.|
+
+
## March 2017
|New or changed topic |Description |
|---------------------|------------|
-|[How to collect Windows Information Protection (WIP) audit event logs](windows-information-protection\collect-wip-audit-event-logs.md) |New |
+||[How to collect Windows Information Protection (WIP) audit event logs](windows-information-protection\collect-wip-audit-event-logs.md) |New |
|[Mandatory tasks and settings required to turn on Windows Information Protection (WIP)](windows-information-protection\mandatory-settings-for-wip.md) |Updated based on Windows 10, version 1703. |
|[Limitations while using Windows Information Protection (WIP)](windows-information-protection\limitations-with-wip.md) |Added additional limitations for Windows 10, version 1703.|
|[Windows Defender SmartScreen overview](windows-defender-smartscreen\windows-defender-smartscreen-overview.md)|New |
diff --git a/windows/threat-protection/docfx.json b/windows/threat-protection/docfx.json
index 1078120934..2989cbeaa7 100644
--- a/windows/threat-protection/docfx.json
+++ b/windows/threat-protection/docfx.json
@@ -33,7 +33,10 @@
"globalMetadata": {
"uhfHeaderId": "MSDocsHeader-WindowsIT",
"breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json",
- "ms.technology": "windows"
+ "ms.technology": "windows",
+ "ms.topic": "article",
+ "ms.author": "justinha",
+ "ms.date": "04/05/2017"
},
"fileMetadata": {},
"template": [],
diff --git a/windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md b/windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md
new file mode 100644
index 0000000000..15e17ff463
--- /dev/null
+++ b/windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md
@@ -0,0 +1,72 @@
+---
+title: Associate and deploy a VPN policy for Windows Information Protection (WIP) using the Azure portal for Microsoft Intune (Windows 10)
+description: After you've created and deployed your Windows Information Protection (WIP) policy, you can use Microsoft Intune to associate and deploy your Virtual Private Network (VPN) policy, linking it to your WIP policy.
+keywords: WIP, Enterprise Data Protection
+ms.prod: w10
+ms.mktglfcycl: explore
+ms.sitesec: library
+ms.pagetype: security
+author: eross-msft
+localizationpriority: high
+---
+
+# Associate and deploy a VPN policy for Windows Information Protection (WIP) using the Azure portal for Microsoft Intune
+**Applies to:**
+
+- Windows 10, version 1607 and later
+- Windows 10 Mobile, version 1607 and later (except Microsoft Azure Rights Management, which is only available on the desktop)
+
+After you've created and deployed your Windows Information Protection (WIP) policy, you can use Microsoft Intune to associate and deploy your Virtual Private Network (VPN) policy, linking it to your WIP policy.
+
+## Associate your WIP policy to your VPN policy by using Microsoft Intune
+Follow these steps to associate your WIP policy with your organization's existing VPN policy.
+
+**To associate your policies**
+
+1. Create your VPN profile. For info about how to do this, see [How to configure VPN settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune-azure/configure-devices/how-to-configure-vpn-settings) and [How to create custom VPN profiles in Microsoft Intune](https://docs.microsoft.com/en-us/intune-azure/configure-devices/create-custom-vpn-profiles#create-a-custom-configuration).
+
+2. Open the Microsoft Intune mobile application management console, click **Device configuration**, and then click **Create Profile**.
+
+ 
+
+3. In the **Create Profile** blade, type a name for your profile, such as *Contoso_VPN_Win10*, into the **Name** box, add an optional description for your policy into the **Description** box, select **Windows 10 and later** from the **Platform** dropdown box, select **Custom** from the **Profile type** dropdown box, and then click **Configure**.
+
+ 
+
+4. In the **Custom OMA-URI Settings** blade, click **Add**.
+
+5. In the **Add Row** blade, type:
+
+ - **Name.** Type a name for your setting, such as *EDPModeID*.
+
+ - **Description.** Type an optional description for your setting.
+
+ - **OMA-URI.** Type _./Vendor/MSFT/VPNv2/<VPNProfileName>/EDPModeId_ into the box.
+
+ - **Data type.** Select **String** from the dropdown box
+
+ - **Value.** Type your fully-qualified domain that should be used by the OMA-URI setting. For example, _corp.contoso.com_.
+
+ 
+
+6. Click **OK** to save your setting info in the **Add Row** blade, and then click **OK** in the **Custom OMA-URI Settings** blade to save the setting with your policy.
+
+7. Click **Create** to create the policy, including your OMA_URI info.
+
+## Deploy your VPN policy using Microsoft Intune
+After you’ve created your VPN policy, you'll need to deploy it to the same group you deployed your Windows Information Protection (WIP) policy.
+
+**To deploy your Custom VPN policy**
+
+1. On the **App policy** blade, click your newly-created policy, click **User groups** from the menu that appears, and then click **Add user group**.
+
+ A list of user groups, made up of all of the security groups in your Azure Active Directory, appear in the **Add user group** blade.
+
+2. Choose the group you want your policy to apply to, and then click **Select** to deploy the policy.
+
+ The policy is deployed to the selected users' devices.
+
+ 
+
+>[!NOTE]
+>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).
\ No newline at end of file
diff --git a/windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune.md b/windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune.md
index 64602d97ae..043f638474 100644
--- a/windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune.md
+++ b/windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune.md
@@ -1,5 +1,5 @@
---
-title: Create and deploy a VPN policy for Windows Information Protection (WIP) using Microsoft Intune (Windows 10)
+title: Associate and deploy a VPN policy for Windows Information Protection (WIP) using the classic console for Microsoft Intune (Windows 10)
description: After you've created and deployed your Windows Information Protection (WIP) policy, you can use Microsoft Intune to create and deploy your Virtual Private Network (VPN) policy, linking it to your WIP policy.
ms.assetid: d0eaba4f-6d7d-4ae4-8044-64680a40cf6b
keywords: WIP, Enterprise Data Protection
@@ -11,11 +11,11 @@ author: eross-msft
localizationpriority: high
---
-# Create and deploy a VPN policy for Windows Information Protection (WIP) using Microsoft Intune
+# Associate and deploy a VPN policy for Windows Information Protection (WIP) using the classic console for Microsoft Intune
**Applies to:**
-- Windows 10, version 1607
-- Windows 10 Mobile
+- Windows 10, version 1607 and later
+- Windows 10 Mobile, version 1607 and later
After you've created and deployed your Windows Information Protection (WIP) policy, you can use Microsoft Intune to create and deploy your Virtual Private Network (VPN) policy, linking it to your WIP policy.
diff --git a/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune-azure.md b/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune-azure.md
new file mode 100644
index 0000000000..5726426cf1
--- /dev/null
+++ b/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune-azure.md
@@ -0,0 +1,532 @@
+---
+title: Create a Windows Information Protection (WIP) with enrollment policy using the Azure portal for Microsoft Intune (Windows 10)
+description: Microsoft Intune helps you create and deploy your Windows Information Protection (WIP) policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network.
+ms.prod: w10
+ms.mktglfcycl: explore
+ms.sitesec: library
+ms.pagetype: security
+author: eross-msft
+localizationpriority: high
+---
+
+# Create a Windows Information Protection (WIP) with enrollment policy using the Azure portal for Microsoft Intune
+
+**Applies to:**
+
+- Windows 10, version 1607 and later
+- Windows 10 Mobile, version 1607 and later (except Microsoft Azure Rights Management, which is only available on the desktop)
+
+Microsoft Intune helps you create and deploy your Windows Information Protection (WIP) policy, including letting you choose your allowed apps, your WIP-protection level, and how to find enterprise data on the network.
+
+>[!Important]
+>This topic covers creating a Windows Information Protection (WIP) policy for organizations already managing devices by using Mobile Device Management (MDM) solutions. If your organization uses a mobile application management (MAM) solution to deploy your WIP policy to Intune apps without managing devices, you must follow the instructions in the [Create and deploy Windows Information Protection (WIP) app protection policy with Intune](https://docs.microsoft.com/en-us/intune/deploy-use/create-windows-information-protection-policy-with-intune) topic.
+
+## Add a WIP policy
+After you’ve set up Intune for your organization, you must create a WIP-specific policy.
+
+**To add a WIP policy**
+1. Open the Microsoft Intune mobile application management console, click **All settings**, and then click **App policy**.
+
+ 
+
+2. In the **App policy** screen, click **Add a policy**, and then fill out the fields:
+ - **Name.** Type a name (required) for your new policy.
+
+ - **Description.** Type an optional description.
+
+ - **Platform.** Choose **Windows 10** as the supported platform for your policy.
+
+ - **Enrollment state.** Choose **With enrollment** as the enrollment state for your policy.
+
+ 
+
+ >[!Important]
+ >Choosing **With enrollment** only applies for organizations using MDM. If you're using MAM, you must use these instructions, [Create and deploy Windows Information Protection (WIP) app protection policy with Intune](https://docs.microsoft.com/en-us/intune/deploy-use/create-windows-information-protection-policy-with-intune), instead.
+
+3. Click **Create**.
+
+ The policy is created and appears in the table on the **App Policy** screen.
+
+ >[!NOTE]
+ >Optionally, you can also add your apps and set your settings from the **Add a policy** blade, but for the purposes of this documentation, we recommend instead that you create the policy first, and then use the subsequent menus that become available.
+
+### Add apps to your Allowed apps list
+During the policy-creation process in Intune, you can choose the apps you want to give access to your enterprise data through WIP. Apps included in this list can protect data on behalf of the enterprise and are restricted from copying or moving enterprise data to unprotected apps.
+
+The steps to add your apps are based on the type of template being applied. You can add a recommended app, a store app (also known as a Universal Windows Platform (UWP) app), or a signed Windows desktop app.
+
+>[!Important]
+>Enlightened apps are expected to prevent enterprise data from going to unprotected network locations and to avoid encrypting personal data. On the other hand, WIP-unaware apps might not respect the corporate network boundary, and WIP-unaware apps will encrypt all files they create or modify. This means that they could encrypt personal data and cause data loss during the revocation process.
Care must be taken to get a support statement from the software provider that their app is safe with WIP before adding it to your **Allowed apps** list. If you don’t get this statement, it’s possible that you could experience app compat issues due to an app losing the ability to access a necessary file after revocation.
+
+#### Add a Recommended app to your Allowed apps list
+For this example, we’re going to add Microsoft Edge, a recommended app, to the **Allowed apps** list.
+
+**To add a recommended app**
+1. From the **App policy** blade, click the name of your policy, and then click **Allowed apps** from the menu that appears.
+
+ The **Allowed apps** blade appears, showing you any apps that are already included in the list for this policy.
+
+ 
+
+2. From the **Allowed apps** blade, click **Add apps**.
+
+ The **Add apps** blade appears, showing you all **Recommended apps**.
+
+ 
+
+3. Select each app you want to access your enterprise data, and then click **OK**.
+
+ The **Allowed apps** blade updates to show you your selected apps.
+
+ 
+
+#### Add a Store app to your Allowed apps list
+For this example, we’re going to add Microsoft Power BI, a store app, to the **Allowed apps** list.
+
+**To add a Store app**
+1. From the **App policy** blade, click the name of your policy, and then click **Allowed apps** from the menu that appears.
+
+ The **Allowed apps** blade appears, showing you any apps that are already included in the list for this policy.
+
+2. From the **Allowed apps** blade, click **Add apps**.
+
+3. On the **Add apps** blade, click **Store apps** from the dropdown list.
+
+ The blade changes to show boxes for you to add a publisher and app name.
+
+4. Type the name of the app and the name of its publisher, and then click **OK**. For this UWP app example, the **Publisher** is `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US` and the Product **name** is `Microsoft.MicrosoftPowerBIForWindows`.
+
+5. After you’ve entered the info into the fields, click **OK** to add the app to your **Allowed apps** list.
+
+ >[!NOTE]
+ >To add multiple Store apps at the same time, you can click the menu **(…)** at the end of the app row, and then continue to add more apps. When you’re done, click **OK**.
+
+ 
+
+If you don't know the publisher or product name, you can find them for both desktop devices and Windows 10 Mobile phones by following these steps.
+
+**To find the publisher and product name values for Store apps without installing them**
+1. Go to the [Windows Store for Business](https://go.microsoft.com/fwlink/p/?LinkID=722910) website, and find your app. For example, *Microsoft Power BI*.
+
+2. Copy the ID value from the app URL. For example, Microsoft Power BI ID URL is https://www.microsoft.com/en-us/store/p/microsoft-power-bi/9nblgggzlxn1, and you'd copy the ID value, `9nblgggzlxn1`.
+
+3. In a browser, run the Store for Business portal web API, to return a JavaScript Object Notation (JSON) file that includes the publisher and product name values. For example, run https://bspmts.mp.microsoft.com/v1/public/catalog/Retail/Products/9nblgggzlxn1/applockerdata, where `9nblgggzlxn1` is replaced with your ID value.
+
+ The API runs and opens a text editor with the app details.
+
+ ```json
+ {
+ "packageIdentityName": "Microsoft.MicrosoftPowerBIForWindows",
+ "publisherCertificateName": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US"
+ }
+ ```
+
+4. Copy the `publisherCertificateName` value into the **Publisher** box and copy the `packageIdentityName` value into the **Name** box of Intune.
+
+ >[!Important]
+ >The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as `CN=` followed by the `windowsPhoneLegacyId`.
For example:
+ {
+
+**To find the publisher and product name values for apps installed on Windows 10 mobile phones**
+1. If you need to add mobile apps that aren't distributed through the Store for Business, you must use the **Windows Device Portal** feature.
+
+ >**Note**
"windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d",
}
Your PC and phone must be on the same wireless network.
+
+2. On the Windows Phone, go to **Settings**, choose **Update & security**, and then choose **For developers**.
+
+3. In the **For developers** screen, turn on **Developer mode**, turn on **Device Discovery**, and then turn on **Device Portal**.
+
+4. Copy the URL in the **Device Portal** area into your device's browser, and then accept the SSL certificate.
+
+5. In the **Device discovery** area, press **Pair**, and then enter the PIN into the website from the previous step.
+
+6. On the **Apps** tab of the website, you can see details for the running apps, including the publisher and product names.
+
+7. Start the app for which you're looking for the publisher and product name values.
+
+8. Copy the `publisherCertificateName` value and paste it into the **Publisher Name** box and the `packageIdentityName` value into the **Product Name** box of Intune.
+
+ >[!Important]
+ >The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as `CN=` followed by the `windowsPhoneLegacyId`.
For example:
+ {
+
+#### Add a Desktop app to your Allowed apps list
+For this example, we’re going to add WordPad, a desktop app, to the **Allowed apps** list.
+
+**To add a Desktop app**
+1. From the **App policy** blade, click the name of your policy, and then click **Allowed apps** from the menu that appears.
+
+ The **Allowed apps** blade appears, showing you any apps that are already included in the list for this policy.
+
+2. From the **Allowed apps** blade, click **Add apps**.
+
+3. On the **Add apps** blade, click **Desktop apps** from the dropdown list.
+
+ The blade changes to show boxes for you to add the following, based on what results you want returned:
+
+
"windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d",
}
+
+
+4. After you’ve entered the info into the fields, click **OK** to add the app to your **Allowed apps** list.
+
+ >[!Note]
+ >To add multiple Desktop apps at the same time, you can click the menu **(…)** at the end of the app row, and then continue to add more apps. When you’re done, click **OK**.
+
+ 
+
+ **To find the Publisher values for Desktop apps**
+ If you’re unsure about what to include for the publisher, you can run this PowerShell command:
+
+ ```ps1
+ Get-AppLockerFileInformation -Path "
+
+ Field
+ Manages
+
+
+ All fields marked as “*”
+ All files signed by any publisher. (Not recommended)
+
+
+ Publisher only
+ If you only fill out this field, you’ll get all files signed by the named publisher.
+
This might be useful if your company is the publisher and signer of internal line-of-business apps.
+
+ Publisher and Name only
+ If you only fill out these fields, you’ll get all files for the specified product, signed by the named publisher.
+
+
+ Publisher, Name, and File only
+ If you only fill out these fields, you’ll get any version of the named file or package for the specified product, signed by the named publisher.
+
+
+ Publisher, Name, File, and Min version only
+ If you only fill out these fields, you’ll get the specified version or newer releases of the named file or package for the specified product, signed by the named publisher.
+
This option is recommended for enlightened apps that weren't previously enlightened.
+
+ Publisher, Name, File, and Max version only
+ If you only fill out these fields, you’ll get the specified version or older releases of the named file or package for the specified product, signed by the named publisher.
+
+
+ All fields completed
+ If you fill out all fields, you’ll get the specified version of the named file or package for the specified product, signed by the named publisher.
+
+ This is the XML file that AppLocker creates for Microsoft Dynamics 365.
+
+ ```xml
+
+
After you turn off WIP, an attempt is made to decrypt any WIP-tagged files on the locally attached drives. Be aware that your previous decryption and policy info isn’t automatically reapplied if you turn WIP protection back on.|
+
+2. Click **Save**.
+
+### Define your enterprise-managed corporate identity
+Corporate identity, usually expressed as your primary Internet domain (for example, contoso.com), helps to identify and tag your corporate data from apps you’ve marked as protected by WIP. For example, emails using contoso.com are identified as being corporate and are restricted by your Windows Information Protection policies.
+
+Starting with Windows 10, version 1703, Intune automatically determines your corporate identity and adds it to the Corporate identity field. You can specify multiple domains owned by your enterprise by separating them with the "|" character. For example, (`contoso.com|newcontoso.com`). With multiple domains, the first one is designated as your corporate identity and all of the additional ones as being owned by the first one. We strongly recommend that you include all of your email address domains in this list.
+
+**To change your corporate identity**
+
+1. From the **App policy** blade, click the name of your policy, and then click **Required settings** from the menu that appears.
+
+ The **Required settings** blade appears.
+
+2. If the identity isn’t correct, or if you need to add additional domains, type info into the **Corporate identity** field. For example, `contoso.com|newcontoso.com`.
+
+ 
+
+### Choose where apps can access enterprise data
+After you've added a protection mode to your apps, you'll need to decide where those apps can access enterprise data on your network.
+
+There are no default locations included with WIP, you must add each of your network locations. This area applies to any network endpoint device that gets an IP address in your enterprise’s range and is also bound to one of your enterprise domains, including SMB shares. Local file system locations should just maintain encryption (for example, on local NTFS, FAT, ExFAT).
+
+>[!Important]
+>Every WIP policy should include policy that defines your enterprise network locations.
Classless Inter-Domain Routing (CIDR) notation isn’t supported for WIP configurations.
+
+**To define where your allowed apps can find and send enterprise data on you network**
+
+1. From the **App policy** blade, click the name of your policy, and then click **Advanced settings** from the menu that appears.
+
+ The **Advanced settings** blade appears.
+
+2. Click **Add network boundary** from the Network perimeter area.
+
+ The **Add network boundary** blade appears.
+
+ 
+
+3. Select the type of network boundary to add from the **Boundary type** box.
+
+4. Type a name for your boundary into the **Name** box, add your values to the **Value** box, based on the following options, and then click **OK**.
+
+
+
+
+5. Repeat steps 1-4 to add any additional network boundaries.
+
+6. Decide if you want to Windows to look for additional network settings:
+
+ 
+
+ - **Enterprise Proxy Servers list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the proxy servers you specified in the network boundary definition as the complete list of proxy servers available on your network. If you clear this box, Windows will search for additional proxy servers in your immediate network.
+
+ - **Enterprise IP Ranges list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the IP ranges you specified in the network boundary definition as the complete list of IP ranges available on your network. If you clear this box, Windows will search for additional IP ranges on any domain-joined devices connected to your network.
+
+### Upload your Data Recovery Agent (DRA) certificate
+After you create and deploy your WIP policy to your employees, Windows begins to encrypt your corporate data on the employees’ local device drive. If somehow the employees’ local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the Data Recovery Agent (DRA) certificate lets Windows use an included public key to encrypt the local data while you maintain the private key that can unencrypt the data.
+
+>[!Important]
+>Using a DRA certificate isn’t mandatory. However, we strongly recommend it. For more info about how to find and export your data recovery certificate, see the [Data Recovery and Encrypting File System (EFS)](https://go.microsoft.com/fwlink/p/?LinkId=761462) topic. For more info about creating and verifying your EFS DRA certificate, see the [Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](https://tnstage.redmond.corp.microsoft.com/en-us/itpro/windows/keep-secure/create-and-verify-an-efs-dra-certificate) topic.
+
+**To upload your DRA certificate**
+1. From the **App policy** blade, click the name of your policy, and then click **Advanced settings** from the menu that appears.
+
+ The **Advanced settings** blade appears.
+
+2. In the **Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data** box, click **Browse** to add a data recovery certificate for your policy.
+
+ 
+
+### Choose your optional WIP-related settings
+After you've decided where your protected apps can access enterprise data on your network, you’ll be asked to decide if you want to add any optional WIP settings.
+
+**To set your optional settings**
+
+1. Choose to set any or all optional settings:
+
+ 
+
+ - **Prevent corporate data from being accessed by apps when the device is locked. Applies only to Windows 10 Mobile.** Determines whether to encrypt enterprise data using a key that's protected by an employee's PIN code on a locked device. Apps won't be able to read corporate data when the device is locked. The options are:
+
+ - **On (recommended).** Turns on the feature and provides the additional protection.
+
+ - **Off, or not configured.** Doesn't enable this feature.
+
+ - **Revoke encryption keys on unenroll.** Determines whether to revoke a user’s local encryption keys from a device when it’s unenrolled from Windows Information Protection. If the encryption keys are revoked, a user no longer has access to encrypted corporate data. The options are:
+
+ - **On, or not configured (recommended).** Revokes local encryption keys from a device during unenrollment.
+
+ - **Off.** Stop local encryption keys from being revoked from a device during unenrollment. For example if you’re migrating between Mobile Device Management (MDM) solutions.
+
+ - **Show the Windows Information Protection icon overlay.** Determines whether the Windows Information Protection icon overlay appears on corporate files in the Save As and File Explorer views. The options are:
+
+ - **On.** Allows the Windows Information Protection icon overlay to appear on corporate files in the Save As and File Explorer views. Additionally, for unenlightened but allowed apps, the icon overlay also appears on the app tile and with Managed text on the app name in the **Start** menu.
+
+ - **Off, or not configured (recommended).** Stops the Windows Information Protection icon overlay from appearing on corporate files or unenlightened, but allowed apps. Not configured is the default option.
+
+ - **Use Azure RMS for WIP.** Determines whether to use Azure Rights Management encryption with Windows Information Protection.
+
+ - **On.** Starts using Azure Rights Management encryption with WIP. By turning this option on, you can also add a TemplateID GUID to specify who can access the Azure Rights Management protected files, and for how long. For more info about setting up Azure Rights management and using a template ID with WIP, see the [Choose to set up Azure Rights Management with WIP](#choose-to-set-up-azure-rights-management-with-wip) section of this topic.
+
+ - **Off, or not configured.** Stops using Azure Rights Management encryption with WIP.
+
+### Choose to set up Azure Rights Management with WIP
+WIP can integrate with Microsoft Azure Rights Management to enable secure sharing of files by using removable drives such as USB drives. For more info about Azure Rights Management, see [Microsoft Azure Rights Management](https://products.office.com/en-us/business/microsoft-azure-rights-management). To integrate Azure Rights Management with WIP, you must already have Azure Rights Management set up.
+
+To configure WIP to use Azure Rights Management, you must set the **AllowAzureRMSForEDP** MDM setting to **1** in Microsoft Intune. This setting tells WIP to encrypt files copied to removable drives with Azure Rights Management, so they can be shared amongst your employees on computers running at least Windows 10, version 1703.
+
+Optionally, if you don’t want everyone in your organization to be able to share your enterprise data, you can set the **RMSTemplateIDForEDP** MDM setting to the **TemplateID** of the Azure Rights Management template used to encrypt the data. You must make sure to mark the template with the **EditRightsData** option.
+
+>[!NOTE]
+>For more info about setting the **AllowAzureRMSForEDP** and the **RMSTemplateIDForEDP** MDM settings, see the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/enterprisedataprotection-csp) topic. For more info about setting up and using a custom template, see [Configuring custom templates for the Azure Rights Management service](https://docs.microsoft.com/en-us/information-protection/deploy-use/configure-custom-templates) topic.
+
+## Related topics
+- [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md)
+
+- [Deploy your Windows Information Protection (WIP) policy](deploy-wip-policy-using-intune.md)
+
+- [Associate and deploy your Windows Information Protection (WIP) and VPN policies by using Microsoft Intune](create-vpn-and-wip-policy-using-intune.md)
+
+- [General guidance and best practices for Windows Information Protection (WIP)](guidance-and-best-practices-wip.md)
+
+- [What is Azure Rights Management?]( https://docs.microsoft.com/en-us/information-protection/understand-explore/what-is-azure-rms)
+
+- [Create and deploy Windows Information Protection (WIP) app protection policy with Intune and MAM](https://docs.microsoft.com/en-us/intune/deploy-use/create-windows-information-protection-policy-with-intune)
+
+- [Intune MAM Without Enrollment](https://blogs.technet.microsoft.com/configmgrdogs/2016/02/04/intune-mam-without-enrollment/)
+
+- [Azure RMS Documentation Update for May 2016](https://blogs.technet.microsoft.com/enterprisemobility/2016/05/31/azure-rms-documentation-update-for-may-2016/)
+
+>[!NOTE]
+>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).
\ No newline at end of file
diff --git a/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune.md b/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune.md
index 2b277e056a..cbdd0a70de 100644
--- a/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune.md
+++ b/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune.md
@@ -1,5 +1,5 @@
---
-title: Create a Windows Information Protection (WIP) policy using Microsoft Intune (Windows 10)
+title: Create a Windows Information Protection (WIP) with enrollment policy using the classic console for Microsoft Intune (Windows 10)
description: Microsoft Intune helps you create and deploy your Windows Information Protection (WIP) policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network.
ms.assetid: 4b307c99-3016-4d6a-9ae7-3bbebd26e721
ms.prod: w10
@@ -10,12 +10,12 @@ author: eross-msft
localizationpriority: high
---
-# Create a Windows Information Protection (WIP) policy using Microsoft Intune
+# Create a Windows Information Protection (WIP) using the classic console for Microsoft Intune
**Applies to:**
-- Windows 10, version 1703
-- Windows 10 Mobile (except Microsoft Azure Rights Management, which is only available on the desktop)
+- Windows 10, version 1607 and later
+- Windows 10 Mobile, version 1607 and later
Microsoft Intune helps you create and deploy your Windows Information Protection (WIP) policy, including letting you choose your allowed apps, your WIP-protection level, and how to find enterprise data on the network.
@@ -39,7 +39,7 @@ During the policy-creation process in Intune, you can choose the apps you want t
The steps to add your app rules are based on the type of rule template being applied. You can add a store app (also known as a Universal Windows Platform (UWP) app), a signed Windows desktop app, or an AppLocker policy file.
>[!Important]
->WIP-aware apps are expected to prevent enterprise data from going to unprotected network locations and to avoid encrypting personal data. On the other hand, WIP-unaware apps might not respect the corporate network boundary, and WIP-unaware apps will encrypt all files they create or modify. This means that they could encrypt personal data and cause data loss during the revocation process.
+
+ Boundary type
+ Value format
+ Description
+
+
+ Cloud Resources
+ With proxy: contoso.sharepoint.com,contoso.internalproxy1.com|
+
contoso.visualstudio.com,contoso.internalproxy2.com
Without proxy: contoso.sharepoint.com|contoso.visualstudio.comSpecify the cloud resources to be treated as corporate and protected by WIP.
+
For each cloud resource, you may also optionally specify a proxy server from your Internal proxy servers list to route traffic for this cloud resource. Be aware that all traffic routed through your Internal proxy servers is considered enterprise.
If you have multiple resources, you must separate them using the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example: URL <,proxy>|URL <,proxy>
.
Important
In some cases, such as when an app connects directly to a cloud resource through an IP address, Windows can’t tell whether it’s attempting to connect to an enterprise cloud resource or to a personal site. In this case, Windows blocks the connection by default. To stop Windows from automatically blocking these connections, you can add the /*AppCompat*/
string to the setting. For example: URL <,proxy>|URL <,proxy>|/*AppCompat*/
.
When using this string, we recommend that you also turn on [Azure Active Directory Conditional Access](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-conditional-access), using the Domain joined or marked as compliant option, which blocks apps from accessing any enterprise cloud resources that are protected by conditional access.
+
+ Network domain names
+ corp.contoso.com,region.contoso.com
+ Starting with Windows 10, version 1703, this field is optional.
+
Specify the DNS suffixes used in your environment. All traffic to the fully-qualified domains appearing in this list will be protected.
If you have multiple resources, you must separate them using the "," delimiter.
+
+ Proxy servers
+ proxy.contoso.com:80;proxy2.contoso.com:443
+ Specify the proxy servers your devices will go through to reach your cloud resources. Using this server type indicates that the cloud resources you’re connecting to are enterprise resources.
+
This list shouldn’t include any servers listed in your Internal proxy servers list. Internal proxy servers must be used only for WIP-protected (enterprise) traffic.
If you have multiple resources, you must separate them using the ";" delimiter.
+
+ Internal proxy servers
+ contoso.internalproxy1.com;contoso.internalproxy2.com
+ Specify the internal proxy servers your devices will go through to reach your cloud resources. Using this server type indicates that the cloud resources you’re connecting to are enterprise resources.
+
This list shouldn’t include any servers listed in your Proxy servers list. Proxy servers must be used only for non-WIP-protected (non-enterprise) traffic.
If you have multiple resources, you must separate them using the ";" delimiter.
+
+ IPv4 ranges
+ **Starting IPv4 Address:** 3.4.0.1
+
**Ending IPv4 Address:** 3.4.255.254
**Custom URI:** 3.4.0.1-3.4.255.254,
10.0.0.1-10.255.255.254Starting with Windows 10, version 1703, this field is optional.
+
Specify the addresses for a valid IPv4 value range within your intranet. These addresses, used with your Network domain names, define your corporate network boundaries.
If you have multiple ranges, you must separate them using the "," delimiter.
+
+ IPv6 ranges
+ **Starting IPv6 Address:** 2a01:110::
+
**Ending IPv6 Address:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff
**Custom URI:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff,
fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffffStarting with Windows 10, version 1703, this field is optional.
+
Specify the addresses for a valid IPv6 value range within your intranet. These addresses, used with your Network domain names, define your corporate network boundaries.
If you have multiple ranges, you must separate them using the "," delimiter.
+
+ Neutral resources
+ sts.contoso.com,sts.contoso2.com
+ Specify your authentication redirection endpoints for your company.
+
These locations are considered enterprise or personal, based on the context of the connection before the redirection.
If you have multiple resources, you must separate them using the "," delimiter.
If your app is already installed on desktop devices, you can use the AppLocker local security policy MMC snap-in to gather the info for adding the app to the protected apps list. For info about how to do this, see the steps in the [Add an AppLocker policy file](#add-an-applocker-policy-file) section.
+ >[!NOTE]
+
+ >If your app is already installed on desktop devices, you can use the AppLocker local security policy MMC snap-in to gather the info for adding the app to the protected apps list. For info about how to do this, see the steps in the [Add an AppLocker policy file](#add-an-applocker-policy-file) section.
2. Copy the ID value from the app URL. For example, Microsoft OneNote's ID URL is https://www.microsoft.com/store/apps/onenote/9wzdncrfhvjl, and you'd copy the ID value, `9wzdncrfhvjl`.
@@ -111,7 +113,8 @@ If you don't know the publisher or product name, you can find them for both desk
4. Copy the `publisherCertificateName` value and paste them into the **Publisher Name** box, copy the `packageIdentityName` value into the **Product Name** box of Intune.
- >**Important**
The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as “CN=” followed by the `windowsPhoneLegacyId`.
Your PC and phone must be on the same wireless network.
+ >[!NOTE]
+ >Your PC and phone must be on the same wireless network.
2. On the Windows Phone, go to **Settings**, choose **Update & security**, and then choose **For developers**.
@@ -137,7 +141,8 @@ If you don't know the publisher or product name, you can find them for both desk
8. Copy the `publisherCertificateName` value and paste it into the **Publisher Name** box and the `packageIdentityName` value into the **Product Name** box of Intune.
- >**Important**
The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as “CN=” followed by the `windowsPhoneLegacyId`.
+ >[!IMPORTANT]
+ >The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as “CN=” followed by the `windowsPhoneLegacyId`.
>For example:
**Product Name:** Microsoft.Office.PowerPoint
**App Type:** Universal app |
|OneNote |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Product Name:** Microsoft.Office.OneNote
**App Type:** Universal app |
|Outlook Mail and Calendar |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Product Name:** microsoft.windowscommunicationsapps
**App Type:** Universal app |
+|Office 365 ProPlus|Office 365 ProPlus apps are set up as a suite. You must use the [O365 ProPlus - Allow and Exempt AppLocker policy files (.zip files)](http://download.microsoft.com/download/7/0/D/70D72459-D72D-4673-B309-F480E3BEBCC9/O365%20ProPlus%20-%20WIP%20Enterprise%20AppLocker%20Policy%20Files.zip) to turn the suite on for WIP.
We don't recommend setting up Office by using individual paths or publisher rules.|
|Microsoft Photos |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Product Name:** Microsoft.Windows.Photos
**App Type:** Universal app |
|Groove Music |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Product Name:** Microsoft.ZuneMusic
**App Type:** Universal app |
|Microsoft Movies & TV |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Product Name:** Microsoft.ZuneVideo
**App Type:** Universal app |
|Microsoft Messaging |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Product Name:** Microsoft.Messaging
**App Type:** Universal app |
|IE11 |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Binary Name:** iexplore.exe
**App Type:** Desktop app |
-|Microsoft OneDrive |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Binary Name:** onedrive.exe
**App Type:** Desktop app|
+|OneDrive Sync Client|**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Binary Name:** onedrive.exe
**App Type:** Desktop app|
+|OneDrive app|**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Product Name:** Microsoft.Microsoftskydrive
**Product Version:**Product version: 17.21.0.0 (and later)
**App Type:** Universal app |
|Notepad |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Binary Name:** notepad.exe
**App Type:** Desktop app |
|Microsoft Paint |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Binary Name:** mspaint.exe
**App Type:** Desktop app |
|Microsoft Remote Desktop |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
**Binary Name:** mstsc.exe
**App Type:** Desktop app |
diff --git a/windows/threat-protection/windows-information-protection/mandatory-settings-for-wip.md b/windows/threat-protection/windows-information-protection/mandatory-settings-for-wip.md
index d8d0fb1910..dfd5630dc2 100644
--- a/windows/threat-protection/windows-information-protection/mandatory-settings-for-wip.md
+++ b/windows/threat-protection/windows-information-protection/mandatory-settings-for-wip.md
@@ -24,7 +24,7 @@ This list provides all of the tasks and settings that are required for the opera
|Task|Description|
|----|-----------|
|Add at least one app to the **Allowed apps** list in your WIP policy.|You must have at least one app added to your **Allowed apps** list. For more info about where this area is and how to add apps, see the **Add apps to your Allowed apps list** section of the policy creation topics.|
-|Choose your WIP protection level.|You must choose the level of protection you want to apply to your WIP-protected content, including **Override**, **Silent**, or **Block**. For more info about where this area is and how to decide on your protection level, see the **Manage the WIP protection mode for your enterprise data** section of the policy creation topics. For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md).|
+|Choose your WIP protection level.|You must choose the level of protection you want to apply to your WIP-protected content, including **Allow Overrides**, **Silent**, or **Hide Overrides**. For more info about where this area is and how to decide on your protection level, see the **Manage the WIP protection mode for your enterprise data** section of the policy creation topics. For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md).|
|Specify your corporate identity.|This field is automatically filled out for you by Microsoft Intune. However, you must manually correct it if it’s incorrect or if you need to add additional domains. For more info about where this area is and what it means, see the **Define your enterprise-managed corporate identity** section of the policy creation topics.
|Specify your network domain names.|Starting with Windows 10, version 1703, this field is optional.
Specify the DNS suffixes used in your environment. All traffic to the fully-qualified domains appearing in this list will be protected. For more info about where this area is and how to add your suffixes, see the table that appears in the **Choose where apps can access enterprise data** section of the policy creation topics.|
|Specify your enterprise IPv4 or IPv6 ranges.|Starting with Windows 10, version 1703, this field is optional.
Specify the addresses for a valid IPv4 or IPv6 value range within your intranet. These addresses, used with your Network domain names, define your corporate network boundaries. For more info about where this area is and what it means, see the table that appears in the **Define your enterprise-managed corporate identity** section of the policy creation topics.|
diff --git a/windows/threat-protection/windows-information-protection/overview-create-wip-policy.md b/windows/threat-protection/windows-information-protection/overview-create-wip-policy.md
index eb659e55c3..caf17860ce 100644
--- a/windows/threat-protection/windows-information-protection/overview-create-wip-policy.md
+++ b/windows/threat-protection/windows-information-protection/overview-create-wip-policy.md
@@ -21,7 +21,8 @@ Microsoft Intune and System Center Configuration Manager helps you create and de
## In this section
|Topic |Description |
|------|------------|
-|[Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune.md) |Intune helps you create and deploy your WIP policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. |
+|[Create a Windows Information Protection (WIP) policy using the classic console for Microsoft Intune](create-wip-policy-using-intune.md) |Details about how to use the classic console for Microsoft Intune to create and deploy your WIP policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. |
+|[Create a Windows Information Protection (WIP) with enrollment policy using the Azure portal for Microsoft Intune](create-wip-policy-using-intune-azure.md)|Details about how to use the Azure portal for Microsoft Intune to create and deploy your WIP policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. |
|[Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager](create-wip-policy-using-sccm.md) |System Center Configuration Manager helps you create and deploy your WIP policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. |
|[Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md) |Steps to create, verify, and perform a quick recovery using a Encrypting File System (EFS) Data Recovery Agent (DRA) certificate. |
|[Determine the Enterprise Context of an app running in Windows Information Protection (WIP)](wip-app-enterprise-context.md) |Use the Task Manager to determine whether an app is considered work, personal or exempt by Windows Information Protection (WIP). |
diff --git a/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip.md b/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip.md
index fe8a354526..19071542aa 100644
--- a/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip.md
+++ b/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip.md
@@ -76,13 +76,13 @@ WIP gives you a new way to manage data policy enforcement for apps and documents
- **Copying or downloading enterprise data.** When an employee or an app downloads content from a location like SharePoint, a network share, or an enterprise web location, while using a WIP-protected device, WIP encrypts the data on the device.
- - **Using allowed apps.** Managed apps (apps that you've included on the **Allowed apps** list in your WIP policy) are allowed to access your enterprise data and will interact differently when used with unallowed, non-enterprise aware, or personal-only apps. For example, if WIP management is set to **Block**, your employees can copy and paste from one protected app to another allowed app, but not to personal apps. Imagine an HR person wants to copy a job description from an allowed app to the internal career website, an enterprise-protected location, but goofs and tries to paste into a personal app instead. The paste action fails and a notification pops up, saying that the app couldn’t paste because of a policy restriction. The HR person then correctly pastes to the career website without a problem.
+ - **Using allowed apps.** Managed apps (apps that you've included on the **Allowed apps** list in your WIP policy) are allowed to access your enterprise data and will interact differently when used with unallowed, non-enterprise aware, or personal-only apps. For example, if WIP management is set to **Hide overrides**, your employees can copy and paste from one protected app to another allowed app, but not to personal apps. Imagine an HR person wants to copy a job description from an allowed app to the internal career website, an enterprise-protected location, but goofs and tries to paste into a personal app instead. The paste action fails and a notification pops up, saying that the app couldn’t paste because of a policy restriction. The HR person then correctly pastes to the career website without a problem.
- **Managed apps and restrictions.** With WIP you can control which apps can access and use your enterprise data. After adding an app to your allowed apps list, the app is trusted with enterprise data. All apps not on this list are stopped from accessing your enterprise data, depending on your WIP management-mode.
You don’t have to modify line-of-business apps that never touch personal data to list them as allowed apps; just include them in the allowed apps list.
- - **Deciding your level of data access.** WIP lets you block overrides, allow overrides, or audit employees' data sharing actions. Blocking overrides stops the action immediately. Allowing overrides lets the employee know there's a risk, but lets him or her continue to share the data while recording and auditing the action. Silent just logs the action without stopping anything that the employee could've overridden while using that setting; collecting info that can help you to see patterns of inappropriate sharing so you can take educative action or find apps that should be added to your allowed apps list. For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md).
+ - **Deciding your level of data access.** WIP lets you hide overrides, allow overrides, or audit employees' data sharing actions. Hiding overrides stops the action immediately. Allowing overrides lets the employee know there's a risk, but lets him or her continue to share the data while recording and auditing the action. Silent just logs the action without stopping anything that the employee could've overridden while using that setting; collecting info that can help you to see patterns of inappropriate sharing so you can take educative action or find apps that should be added to your allowed apps list. For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md).
- **Data encryption at rest.** WIP helps protect enterprise data on local files and on removable media.
@@ -131,8 +131,8 @@ You can set your WIP policy to use 1 of 4 protection and management modes:
|Mode|Description|
|----|-----------|
-|Block |WIP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing enterprise data to non-enterprise-protected apps in addition to sharing enterprise data between apps or attempting to share outside of your organization’s network.|
-|Override |WIP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log.|
+|Hide overrides |WIP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing enterprise data to non-enterprise-protected apps in addition to sharing enterprise data between apps or attempting to share outside of your organization’s network.|
+|Allow overrides |WIP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log.|
|Silent |WIP runs silently, logging inappropriate data sharing, without stopping anything that would’ve been prompted for employee interaction while in Allow overrides mode. Unallowed actions, like apps inappropriately trying to access a network resource or WIP-protected data, are still stopped.|
|Off |WIP is turned off and doesn't help to protect or audit your data.
For more info about setting your WIP-protection modes, see either [Create a Windows Information Protection (WIP) policy using Intune](create-wip-policy-using-intune.md) or [Create and deploy a Windows Information Protection (WIP) policy using Configuration Manager](create-wip-policy-using-sccm.md), depending on your management solution. |
diff --git a/windows/threat-protection/windows-information-protection/recommended-network-definitions-for-wip.md b/windows/threat-protection/windows-information-protection/recommended-network-definitions-for-wip.md
index 0d5eb4ca6f..f07d6ab555 100644
--- a/windows/threat-protection/windows-information-protection/recommended-network-definitions-for-wip.md
+++ b/windows/threat-protection/windows-information-protection/recommended-network-definitions-for-wip.md
@@ -24,7 +24,7 @@ We recommend that you add the following URLs to the Enterprise Cloud Resources a
## Recommended Enterprise Cloud Resources
This table includes the recommended URLs to add to your Enterprise Cloud Resources network setting, based on the apps you use in your organization.
-|If your organization uses... |Add these entries to your Enterprise Cloud Resources network setting
(Replace "contoso" with your domain name(s) |
+|If your organization uses... |Add these entries to your Enterprise Cloud Resources network setting
(Replace "contoso" with your domain name(s)|
|-----------------------------|---------------------------------------------------------------------|
|Office 365 for Business |
|
|Yammer |
|
diff --git a/windows/whats-new/contribute-to-a-topic.md b/windows/whats-new/contribute-to-a-topic.md
index 6b8301ccab..c963eb975e 100644
--- a/windows/whats-new/contribute-to-a-topic.md
+++ b/windows/whats-new/contribute-to-a-topic.md
@@ -1,6 +1,6 @@
---
title: Edit an existing topic using the Edit link
-description: Instructions about how to edit an existing topic by using the Contribute link on TechNet.
+description: Instructions about how to edit an existing topic by using the Edit link on TechNet.
keywords: contribute, edit a topic
ms.prod: w10
ms.mktglfcycl: explore
@@ -10,13 +10,13 @@ ms.sitesec: library
# Editing existing Windows IT professional documentation
You can now make suggestions and update existing, public content with a GitHub account and a simple click of a link.
->**Note**
+>[!NOTE]
>At this time, only the English (en-us) content is available for editing.
**To edit a topic**
-1. All contributors who are ***not*** a Microsoft employee must [sign a Microsoft Contribution Licensing Agreement (CLA)](https://cla.microsoft.com/) before contributing to any Microsoft repositories.
-If you've already contributed to Microsoft repositories in the past, congratulations! You've already completed this step.
+1. All contributors who are ***not*** a Microsoft employee must [sign a Microsoft Contribution Licensing Agreement (CLA)](https://cla.microsoft.com/) before updating or adding to any Microsoft repositories.
+If you've previously contributed to topics in the Microsoft repositories, congratulations! You've already completed this step.
2. Go to the page on TechNet that you want to update, and then click **Edit**.
diff --git a/windows/whats-new/docfx.json b/windows/whats-new/docfx.json
index 3c9739ce2e..590b6d84d5 100644
--- a/windows/whats-new/docfx.json
+++ b/windows/whats-new/docfx.json
@@ -33,7 +33,10 @@
"globalMetadata": {
"uhfHeaderId": "MSDocsHeader-WindowsIT",
"breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json",
- "ms.technology": "windows"
+ "ms.technology": "windows",
+ "ms.topic": "article",
+ "ms.author": "trudyha",
+ "ms.date": "04/05/2017"
},
"fileMetadata": {},
"template": [],
diff --git a/windows/whats-new/index.md b/windows/whats-new/index.md
index b64a85a590..e0bd472d86 100644
--- a/windows/whats-new/index.md
+++ b/windows/whats-new/index.md
@@ -1,6 +1,6 @@
---
title: What's new in Windows 10 (Windows 10)
-description: Learn about new features in Windows 10 for IT professionals, such as Enterprise Data Protection, Windows Hello, Device Guard, and more.
+description: Learn about new features in Windows 10 for IT professionals, such as Windows Information Protection, Windows Hello, Device Guard, and more.
ms.assetid: F1867017-76A1-4761-A200-7450B96AEF44
keywords: ["What's new in Windows 10", "Windows 10", "anniversary update", "contribute", "edit topic"]
ms.prod: w10
@@ -20,7 +20,7 @@ Windows 10 provides IT professionals with advanced protection against modern sec
- [What's new in Windows 10, versions 1507 and 1511](whats-new-windows-10-version-1507-and-1511.md)
-- [Edit an existing topic using the Contribute link](contribute-to-a-topic.md)
+- [Edit an existing topic using the Edit link](contribute-to-a-topic.md)
## Learn more