From eb6714ee921ae11f6a5cfe43a9025bcf8abfb8b2 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 27 Feb 2024 15:34:43 -0500 Subject: [PATCH] Add troubleshooting information for Assigned Access feature --- .../assigned-access-configuration-file.md | 281 +++++------------- .../assigned-access-example-usergroup.md | 50 ++++ .../configuration/assigned-access/index.md | 20 ++ 3 files changed, 152 insertions(+), 199 deletions(-) create mode 100644 windows/configuration/assigned-access/includes/assigned-access-example-usergroup.md diff --git a/windows/configuration/assigned-access/assigned-access-configuration-file.md b/windows/configuration/assigned-access/assigned-access-configuration-file.md index e0e131e7e0..b41e1a395b 100644 --- a/windows/configuration/assigned-access/assigned-access-configuration-file.md +++ b/windows/configuration/assigned-access/assigned-access-configuration-file.md @@ -397,199 +397,61 @@ Before applying the multi-app configuration, make sure the specified user accoun Group accounts are specified using ``. Nested groups aren't supported. For example, if user A is member of Group 1, Group 1 is member of Group 2, and Group 2 is used in ``, user A won't have the kiosk experience. -- Local group: Specify the group type as **LocalGroup** and put the group name in Name attribute. Any Microsoft Entra accounts that are added to the local group won't have the kiosk settings applied. - - ```xml - - - - - ``` - -- Domain group: Both security and distribution groups are supported. Specify the group type as ActiveDirectoryGroup. Use the domain name as the prefix in the name attribute. - - ```xml - - - - - ``` - -- Microsoft Entra group: Use the group object ID from the Azure portal to uniquely identify the group in the Name attribute. You can find the object ID on the overview page for the group in **Users and groups** > **All groups**. Specify the group type as **AzureActiveDirectoryGroup**. The kiosk device must have internet connectivity when users that belong to the group sign-in. - - ```xml - - - - - ``` - - > [!NOTE] - > If a Microsoft Entra group is configured with a lockdown profile on a device, a user in the Microsoft Entra group must change their password (after the account has been created with default password on the portal) before they can sign in to this device. If the user uses the default password to sign in to the device, the user will be immediately signed out. - - -## Full XML example - -::: zone pivot="windows-11" +:::row::: +:::column span="1"::: +**Scenario** +:::column-end::: +:::column span="3"::: +**XML snippet** +:::column-end::: +:::row-end::: +:::row::: +:::column span="1"::: +**Local group** +:::column-end::: +:::column span="3"::: +Specify the group type as **LocalGroup** and put the group name in Name attribute. Any Microsoft Entra accounts that are added to the local group won't have the kiosk settings applied. ```xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + ``` - -::: zone-end - - - - +:::column-end::: +:::row-end::: +:::row::: +:::column span="1"::: +**Active Directory group** +:::column-end::: +:::column span="3"::: +Both security and distribution groups are supported. Specify the group type as ActiveDirectoryGroup. Use the domain name as the prefix in the name attribute. +```xml + + + + +``` +:::column-end::: +:::row-end::: +:::row::: +:::column span="1"::: +**Microsoft Entra group** +:::column-end::: +:::column span="3"::: +Use the object ID of the Microsoft Entra group. You can find the object ID on the overview page for the group in **Users and groups** > **All groups**. Specify the group type as `AzureActiveDirectoryGroup`. The kiosk device must have internet connectivity when users that belong to the group sign-in. +```xml + + + + +``` +:::column-end::: +:::row-end::: ## Assigned Access configuration XML examples -This article provides practical examples of Assigned Access XML configuration files. - -For more details, review the Assigned Access XSD reference article. - -## Kiosk example 1 - -```xml - - - - - - - - - - - - ... - - - - - - - - domain\account - - - - AzureAD\john@contoso.onmicrosoft.com - - - - localaccount - - - - - - - - - - - - - - - - - - - - -``` - -## Kiosk only sample XML - -```xml - - - - - - - - - - singleappuser - - - - -``` - -## Auto Launch Sample XML +### Auto Launch This sample demonstrates that both UWP and Win32 apps can be configured to automatically launch, when Assigned Access account logs in. One profile can have at most one app configured for auto launch. AutoLaunchArguments are passed to the apps as is and the app needs to handle the arguments explicitly. @@ -634,13 +496,9 @@ This sample demonstrates that both UWP and Win32 apps can be configured to autom ``` -## Examples +## Configs -### Kiosk - Microsoft Edge - -[!INCLUDE [assigned-access-example-kiosk-edge](includes/assigned-access-example-kiosk-edge.md)] - -### Kiosk - Global profile +### Global profile With `GlobalProfile` you can define an Assigned Access profile that is applied to every non-admin account that signs in. This can be useful in scenarios like front line workers or student devices, where you want to ensure that every user has a consistent experience. @@ -650,14 +508,9 @@ With `GlobalProfile` you can define an Assigned Access profile that is applied t ``` -The following configuration demonstrates that only a global profile is used, with no user configured. - -[!INCLUDE [assigned-access-example-global-profile](includes/assigned-access-example-global-profile.md)] - > [!NOTE] > You can combine a global profile with other profiles. If you assign a user a non-global profile, the global profile won't be applied to that user. - ::: zone pivot="windows-10" ## File Explorer restrictions @@ -746,6 +599,36 @@ Either don't use the node or leave it empty: > [!TIP] > To grant access to File Explorer in a restricted user experience, add `Explorer.exe` to the list of allowed apps, and pin a shortcut to the Start menu. +::: zone-end + +--- + +## Practical examples + +### Kiosk experience with Microsoft Edge example + +[!INCLUDE [assigned-access-example-kiosk-edge](includes/assigned-access-example-kiosk-edge.md)] + +### Kiosk experience with UWP app example + +[!INCLUDE [assigned-access-example-kiosk-uwp](includes/assigned-access-example-kiosk-uwp.md)] + +::: zone pivot="windows-10" + +### File Explorer restrictions example + [!INCLUDE [assigned-access-example-file-explorer-restrictions](includes/assigned-access-example-file-explorer-restrictions.md)] -::: zone-end \ No newline at end of file +::: zone-end + +### Global Profile example + +The following configuration demonstrates that only a global profile is used, with no user configured. + +[!INCLUDE [assigned-access-example-global-profile](includes/assigned-access-example-global-profile.md)] + +### User Group example + +The following configuration demonstrates how to assign profiles to different users and groups, including a user configured to automatically sign in. + +[!INCLUDE [assigned-access-example-usergroup](includes/assigned-access-example-usergroup.md)] diff --git a/windows/configuration/assigned-access/includes/assigned-access-example-usergroup.md b/windows/configuration/assigned-access/includes/assigned-access-example-usergroup.md new file mode 100644 index 0000000000..620456e59a --- /dev/null +++ b/windows/configuration/assigned-access/includes/assigned-access-example-usergroup.md @@ -0,0 +1,50 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 02/05/2024 +ms.topic: include +--- + + + +```xml + + + + + ... + + + + + domain\account + + + + AzureAD\john@contoso.onmicrosoft.com + + + + localaccount + + + + + + + + + + + + + + + + + + + + +``` diff --git a/windows/configuration/assigned-access/index.md b/windows/configuration/assigned-access/index.md index 19ee5f8831..d25eeb36d5 100644 --- a/windows/configuration/assigned-access/index.md +++ b/windows/configuration/assigned-access/index.md @@ -113,3 +113,23 @@ A kiosk device typically runs a single application, and users are prevented from The Assigned Access feature is intended for dedicated devices, like kiosks. When the multi-app Assigned Access configuration is applied on the device, [certain policies](kiosk-policies.md) are enforced system-wide, impacting other users on the device. Deleting the kiosk configuration removes the Assigned Access lockdown profiles associated with the users, but it can't revert all the enforced policies (for example, the Start layout). To clear all the policy settings enforced by Assigned Access, you must reset Windows. + \ No newline at end of file