diff --git a/windows/configuration/kiosk/assigned-access-examples.md b/windows/configuration/kiosk/assigned-access-examples.md deleted file mode 100644 index d98e34a1c5..0000000000 --- a/windows/configuration/kiosk/assigned-access-examples.md +++ /dev/null @@ -1,372 +0,0 @@ ---- -title: Assigned Access configuration XML examples -description: Practical examples of Assigned Access XML configuration files. -ms.topic: reference -ms.date: 02/15/2024 ---- - -# Assigned Access configuration XML examples - -This article provides practical examples of Assigned Access XML configuration files. - -For more details, review the Assigned Access XSD reference article. - -## Kiosk example 1 - -```xml - - - - - - - - - - - - ... - - - - - - - - domain\account - - - - AzureAD\john@contoso.onmicrosoft.com - - - - localaccount - - - - - - - - - - - - - - - - - - - - -``` - -## Kiosk only sample XML - -```xml - - - - - - - - - - singleappuser - - - - -``` - -## Auto Launch Sample XML - -This sample demonstrates that both UWP and Win32 apps can be configured to automatically launch, when assigned access account logs in. One profile can have at most one app configured for auto launch. AutoLaunchArguments are passed to the apps as is and the app needs to handle the arguments explicitly. - -```xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - aauser1 - - - - aauser2 - - - - - -``` - -## Microsoft Edge Kiosk XML Sample - -```xml - - - - - - - - - - - - EdgeKioskUser - - - - -``` - -## Global Profile Sample XML - -Global Profile is supported on: - -- Windows 11 -- Windows 10, version 2004 and later - -Global Profile is designed for scenarios where a user doesn't have a designated profile, yet you still want the user to run in lockdown mode. It's also used as mitigation when a profile can't be determined for a user. - -This sample demonstrates that only a global profile is used, with no active user configured. Global Profile will be applied when every non-admin account signs in. - -```xml - - - - - - - - - - - - - - - - - - - -``` - -Below sample shows dedicated profile and global profile mixed usage, a user would use one profile, everyone else that's non-admin will use another profile. - -```xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - aauser - - - - - -``` - -## Folder Access sample xml - -Starting with Windows 10 version 1809 +, folder access is locked down so that when common file dialog is opened, IT Admin can specify if the user has access to the Downloads folder, or no access to any folder at all. This restriction has been redesigned for finer granularity and easier use, and is available in Windows 10 version 2009+. - -IT Admin now can specify user access to Downloads folder, Removable drives, or no restrictions at all. Downloads and Removable Drives can be allowed at the same time. - -```xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - multi1 - - - - multi2 - - - - multi3 - - - - multi4 - - - - multi5 - - - - multi6 - - - - - -``` - -To authorize a compatible configuration XML that includes elements and attributes from Windows 10 version 1809 or newer / Windows 11, always include the namespace of these add-on schemas, and decorate the attributes and elements accordingly with the namespace alias. - -For example, to configure the autolaunch feature that was added in Windows 10 version 1809 / Windows 11, use the following sample. Notice an alias r1809 is given to the 201810 namespace for Windows 10 version 1809 / Windows 11, and the alias is tagged on AutoLaunch and AutoLaunchArguments inline. diff --git a/windows/configuration/kiosk/create-assigned-access-configuration.md b/windows/configuration/kiosk/create-assigned-access-configuration.md index 3cc343a485..d01b50ea6f 100644 --- a/windows/configuration/kiosk/create-assigned-access-configuration.md +++ b/windows/configuration/kiosk/create-assigned-access-configuration.md @@ -1,5 +1,5 @@ --- -title: Create an Assigned Access configuration XML file +title: Create an Assigned Access configuration file description: Learn how to create an XML file to configure a kiosk device. ms.date: 02/12/2024 ms.topic: how-to @@ -404,3 +404,370 @@ These locations contain the latest "evaluated" configuration for each sign-in us "HKCU\SOFTWARE\Microsoft\Windows\AssignedAccessConfiguration" (If it doesn't exist, it means no Assigned Access to be enforced for this user.) --> + + +## Assigned Access configuration XML examples + +This article provides practical examples of Assigned Access XML configuration files. + +For more details, review the Assigned Access XSD reference article. + +## Kiosk example 1 + +```xml + + + + + + + + + + + + ... + + + + + + + + domain\account + + + + AzureAD\john@contoso.onmicrosoft.com + + + + localaccount + + + + + + + + + + + + + + + + + + + + +``` + +## Kiosk only sample XML + +```xml + + + + + + + + + + singleappuser + + + + +``` + +## Auto Launch Sample XML + +This sample demonstrates that both UWP and Win32 apps can be configured to automatically launch, when assigned access account logs in. One profile can have at most one app configured for auto launch. AutoLaunchArguments are passed to the apps as is and the app needs to handle the arguments explicitly. + +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + aauser1 + + + + aauser2 + + + + + +``` + +## Microsoft Edge Kiosk XML Sample + +```xml + + + + + + + + + + + + EdgeKioskUser + + + + +``` + +## Global Profile Sample XML + +Global Profile is supported on: + +- Windows 11 +- Windows 10, version 2004 and later + +Global Profile is designed for scenarios where a user doesn't have a designated profile, yet you still want the user to run in lockdown mode. It's also used as mitigation when a profile can't be determined for a user. + +This sample demonstrates that only a global profile is used, with no active user configured. Global Profile will be applied when every non-admin account signs in. + +```xml + + + + + + + + + + + + + + + + + + + +``` + +Below sample shows dedicated profile and global profile mixed usage, a user would use one profile, everyone else that's non-admin will use another profile. + +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + aauser + + + + + +``` + +## Folder Access sample xml + +Starting with Windows 10 version 1809 +, folder access is locked down so that when common file dialog is opened, IT Admin can specify if the user has access to the Downloads folder, or no access to any folder at all. This restriction has been redesigned for finer granularity and easier use, and is available in Windows 10 version 2009+. + +IT Admin now can specify user access to Downloads folder, Removable drives, or no restrictions at all. Downloads and Removable Drives can be allowed at the same time. + +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + multi1 + + + + multi2 + + + + multi3 + + + + multi4 + + + + multi5 + + + + multi6 + + + + + +``` + +To authorize a compatible configuration XML that includes elements and attributes from Windows 10 version 1809 or newer / Windows 11, always include the namespace of these add-on schemas, and decorate the attributes and elements accordingly with the namespace alias. + +For example, to configure the autolaunch feature that was added in Windows 10 version 1809 / Windows 11, use the following sample. Notice an alias r1809 is given to the 201810 namespace for Windows 10 version 1809 / Windows 11, and the alias is tagged on AutoLaunch and AutoLaunchArguments inline. diff --git a/windows/configuration/kiosk/shell-launcher-examples.md b/windows/configuration/kiosk/create-shell-launcher-configuration.md similarity index 100% rename from windows/configuration/kiosk/shell-launcher-examples.md rename to windows/configuration/kiosk/create-shell-launcher-configuration.md diff --git a/windows/configuration/kiosk/toc.yml b/windows/configuration/kiosk/toc.yml index 6fc6ba670b..d582fb0398 100644 --- a/windows/configuration/kiosk/toc.yml +++ b/windows/configuration/kiosk/toc.yml @@ -35,21 +35,11 @@ items: href: /troubleshoot/windows-client/shell-experience/kiosk-mode-issues-troubleshooting - name: Reference items: + - name: Assigned Access CSP + href: /windows/client-management/mdm/assignedaccess-csp - name: Assigned Access XSD href: assigned-access-xsd.md - name: Shell Launcher XSD href: shell-launcher-xsd.md - name: Policies enforced on kiosk devices - href: kiosk-policies.md - - name: Assigned access XML examples - href: assigned-access-examples.md -- name: On the way to 🪦 - items: - - name: _lock-down-windows-10-to-specific-apps - href: _lock-down-windows-10-to-specific-apps.md - - name: _lock-down-windows-11-to-specific-apps - href: _lock-down-windows-11-to-specific-apps.md - - name: _setup-digital-signage - href: _setup-digital-signage.md - - name: _kiosk-single-app - href: _kiosk-single-app.md \ No newline at end of file + href: kiosk-policies.md \ No newline at end of file