diff --git a/windows/client-management/mdm/federated-authentication-device-enrollment.md b/windows/client-management/mdm/federated-authentication-device-enrollment.md
index 5a31b4587a..3a32b79699 100644
--- a/windows/client-management/mdm/federated-authentication-device-enrollment.md
+++ b/windows/client-management/mdm/federated-authentication-device-enrollment.md
@@ -89,37 +89,37 @@ https://EnterpriseEnrollment.Contoso.com/EnrollmentServer/Discovery.svc
The following example shows the discovery service request.
```xml
-
-
-
-
- http://schemas.microsoft.com/windows/management/2012/01/enrollment/IDiscoveryService/Discover
-
- urn:uuid: 748132ec-a575-4329-b01b-6171a9cf8478
-
- http://www.w3.org/2005/08/addressing/anonymous
-
-
- https://ENROLLTEST.CONTOSO.COM/EnrollmentServer/Discovery.svc
-
-
-
-
-
- user@contoso.com
- 3
- 3.0
- WindowsPhone
- 10.0.0.0
-
- OnPremise
- Federated
-
-
-
-
-
+
+
+
+
+ http://schemas.microsoft.com/windows/management/2012/01/enrollment/IDiscoveryService/Discover
+
+ urn:uuid: 748132ec-a575-4329-b01b-6171a9cf8478
+
+ http://www.w3.org/2005/08/addressing/anonymous
+
+
+ https://ENROLLTEST.CONTOSO.COM/EnrollmentServer/Discovery.svc
+
+
+
+
+
+ user@contoso.com
+ 3
+ 3.0
+ WindowsPhone
+ 10.0.0.0
+
+ OnPremise
+ Federated
+
+
+
+
+
```
The discovery response is in the XML format and includes the following fields:
@@ -196,37 +196,37 @@ The server has to send a POST to a redirect URL of the form ms-app://string (the
The following example shows a response received from the discovery web service which requires authentication via WAB.
```xml
-
-
-
- http://schemas.microsoft.com/windows/management/2012/01/enrollment/IDiscoveryService/DiscoverResponse
-
-
- d9eb2fdd-e38a-46ee-bd93-aea9dc86a3b8
-
- urn:uuid: 748132ec-a575-4329-b01b-6171a9cf8478
-
-
-
-
- Federated
- 3.0
-
- https://enrolltest.contoso.com/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC
-
-
- https://enrolltest.contoso.com/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC
-
-
- https://portal.manage.contoso.com/LoginRedirect.aspx
-
-
-
-
-
+
+
+
+ http://schemas.microsoft.com/windows/management/2012/01/enrollment/IDiscoveryService/DiscoverResponse
+
+
+ d9eb2fdd-e38a-46ee-bd93-aea9dc86a3b8
+
+ urn:uuid: 748132ec-a575-4329-b01b-6171a9cf8478
+
+
+
+
+ Federated
+ 3.0
+
+ https://enrolltest.contoso.com/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC
+
+
+ https://enrolltest.contoso.com/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC
+
+
+ https://portal.manage.contoso.com/LoginRedirect.aspx
+
+
+
+
+
```
## Enrollment policy web service
@@ -251,44 +251,44 @@ The <wsse:BinarySecurityToken> element contains a base64-encoded string. T
The following is an enrollment policy request example with a received security token as client credential.
```xml
-
-
-
- http://schemas.microsoft.com/windows/pki/2009/01/enrollmentpolicy/IPolicy/GetPolicies
-
- urn:uuid:72048B64-0F19-448F-8C2E-B4C661860AA0
-
- http://www.w3.org/2005/08/addressing/anonymous
-
-
- https://enrolltest.contoso.com/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC
-
-
-
- B64EncodedSampleBinarySecurityToken
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+ http://schemas.microsoft.com/windows/pki/2009/01/enrollmentpolicy/IPolicy/GetPolicies
+
+ urn:uuid:72048B64-0F19-448F-8C2E-B4C661860AA0
+
+ http://www.w3.org/2005/08/addressing/anonymous
+
+
+ https://enrolltest.contoso.com/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC
+
+
+
+ B64EncodedSampleBinarySecurityToken
+
+
+
+
+
+
+
+
+
+
+
+
+
```
After the user is authenticated, the web service retrieves the certificate template that the user should enroll with and creates enrollment policies based on the certificate template properties. A sample of the response can be found on MSDN.
@@ -301,80 +301,80 @@ MS-XCEP supports very flexible enrollment policies using various Complex Types a
The following snippet shows the policy web service response.
```xml
-
-
-
- http://schemas.microsoft.com/windows/pki/2009/01/enrollmentpolicy/IPolicy/GetPoliciesResponse
-
- urn:uuid: 69960163-adad-4a72-82d2-bb0e5cff5598
-
-
-
-
-
-
-
-
-
-
- 0
-
-
- CEPUnitTest
- 3
-
- 1209600
- 172800
-
-
- true
- false
-
-
- 2048
-
-
-
-
-
-
-
- 101
- 0
-
-
-
-
-
-
- 0
-
-
-
-
-
-
-
+
+
+
+ http://schemas.microsoft.com/windows/pki/2009/01/enrollmentpolicy/IPolicy/GetPoliciesResponse
+
+ urn:uuid: 69960163-adad-4a72-82d2-bb0e5cff5598
+
+
+
+
+
+
+
+
+
+
+ 0
-
-
- 1.3.14.3.2.29
- 1
- 0
- szOID_OIWSEC_sha1RSASign
-
-
-
-
-
+
+ CEPUnitTest
+ 3
+
+ 1209600
+ 172800
+
+
+ true
+ false
+
+
+ 2048
+
+
+
+
+
+
+
+ 101
+ 0
+
+
+
+
+
+
+ 0
+
+
+
+
+
+
+
+
+
+
+ 1.3.14.3.2.29
+ 1
+ 0
+ szOID_OIWSEC_sha1RSASign
+
+
+
+
+
```
## Enrollment web service
@@ -393,83 +393,84 @@ The RST may also specify a number of AdditionalContext items, such as DeviceType
The following example shows the enrollment web service request for federated authentication.
```xml
-
-
-
- http://schemas.microsoft.com/windows/pki/2009/01/enrollment/RST/wstep
-
- urn:uuid:0d5a1441-5891-453b-becf-a2e5f6ea3749
-
- http://www.w3.org/2005/08/addressing/anonymous
-
-
- https://enrolltest.contoso.com:443/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC
-
-
-
- B64EncodedSampleBinarySecurityToken
-
-
-
-
-
-
- http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentToken
-
-
- http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue
-
-
- DER format PKCS#10 certificate request in Base64 encoding Insterted Here
-
-
-
- 4
-
-
- 10.0.9999.0
-
-
- MY_WINDOWS_DEVICE
-
-
- FF:FF:FF:FF:FF:FF
-
-
- CC:CC:CC:CC:CC:CC
-
- 49015420323756
-
-
- 30215420323756
-
-
- Full
-
-
- CIMClient_Windows
-
-
- 10.0.9999.0
-
-
- 7BA748C8-703E-4DF2-A74A-92984117346A
-
-
- True
-
-
-
-
+
+
+
+ http://schemas.microsoft.com/windows/pki/2009/01/enrollment/RST/wstep
+
+ urn:uuid:0d5a1441-5891-453b-becf-a2e5f6ea3749
+
+ http://www.w3.org/2005/08/addressing/anonymous
+
+
+ https://enrolltest.contoso.com:443/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC
+
+
+
+ B64EncodedSampleBinarySecurityToken
+
+
+
+
+
+
+ http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentToken
+
+
+ http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue
+
+
+ DER format PKCS#10 certificate request in Base64 encoding Insterted Here
+
+
+
+ 4
+
+
+ 10.0.9999.0
+
+
+ MY_WINDOWS_DEVICE
+
+
+ FF:FF:FF:FF:FF:FF
+
+
+ CC:CC:CC:CC:CC:CC
+
+ 49015420323756
+
+
+ 30215420323756
+
+
+ Full
+
+
+ CIMClient_Windows
+
+
+ 10.0.9999.0
+
+
+ 7BA748C8-703E-4DF2-A74A-92984117346A
+
+
+ True
+
+
+
+
+
```
After validating the request, the web service looks up the assigned certificate template for the client, update it if needed, sends the PKCS\#10 requests to the CA, processes the response from the CA, constructs an OMA Client Provisioning XML format, and returns it in the RequestSecurityTokenResponse (RSTR).
@@ -495,43 +496,43 @@ Here is a sample RSTR message and a sample of OMA client provisioning XML within
The following example shows the enrollment web service response.
```xml
-
-
-
- http://schemas.microsoft.com/windows/pki/2009/01/enrollment/RSTRC/wstep
-
- urn:uuid:81a5419a-496b-474f-a627-5cdd33eed8ab
-
-
- 2012-08-02T00:32:59.420Z
- 2012-08-02T00:37:59.420Z
-
-
-
-
-
-
-
- http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentToken
-
-
-
-
- B64EncodedSampleBinarySecurityToken
-
-
- 0
-
-
-
-
+
+
+
+ http://schemas.microsoft.com/windows/pki/2009/01/enrollment/RSTRC/wstep
+
+ urn:uuid:81a5419a-496b-474f-a627-5cdd33eed8ab
+
+
+ 2012-08-02T00:32:59.420Z
+ 2012-08-02T00:37:59.420Z
+
+
+
+
+
+
+
+ http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentToken
+
+
+
+
+ B64EncodedSampleBinarySecurityToken
+
+
+ 0
+
+
+
+
```
The following code shows sample provisioning XML (presented in the preceding package as a security token):