mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-25 15:23:40 +00:00
Acrolinx enhancement
This commit is contained in:
Siddarth Mandalika
committed by
Thomas Raya
Thomas Raya
parent
4f056cb1ea
commit
f282e2e388
@ -1,7 +1,10 @@
|
||||
---
|
||||
title: Guidelines for choosing an app for assigned access (Windows 10/11)
|
||||
description: The following guidelines may help you choose an appropriate Windows app for your assigned access experience.
|
||||
keywords: ["kiosk", "lockdown", "assigned access"]
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
author: aczechowski
|
||||
ms.localizationpriority: medium
|
||||
ms.author: aaroncz
|
||||
@ -28,9 +31,9 @@ The following guidelines may help you choose an appropriate Windows app for your
|
||||
|
||||
- Windows apps must be provisioned or installed for the assigned access account before they can be selected as the assigned access app. [Learn how to provision and install apps](/windows/client-management/mdm/enterprise-app-management#install_your_apps).
|
||||
|
||||
- Updating a Windows app can sometimes change the Application User Model ID (AUMID) of the app. If this happens, you must update the assigned access settings to launch the updated app, because assigned access uses the AUMID to determine which app to launch.
|
||||
- Updating a Windows app can sometimes change the Application User Model ID (AUMID) of the app. If this change happens, you must update the assigned access settings to launch the updated app, because assigned access uses the AUMID to determine which app to launch.
|
||||
|
||||
- Apps that are generated using the [Desktop App Converter (Desktop Bridge)](/windows/uwp/porting/desktop-to-uwp-run-desktop-app-converter) cannot be used as kiosk apps.
|
||||
- Apps that are generated using the [Desktop App Converter (Desktop Bridge)](/windows/uwp/porting/desktop-to-uwp-run-desktop-app-converter) can't be used as kiosk apps.
|
||||
|
||||
|
||||
|
||||
@ -43,16 +46,14 @@ Avoid selecting Windows apps that are designed to launch other apps as part of t
|
||||
|
||||
## Guidelines for web browsers
|
||||
|
||||
In Windows 10, version 1909, assigned access adds support for the new Microsoft Edge kiosk mode. [Learn how to deploy Microsoft Edge kiosk mode](/DeployEdge/microsoft-edge-configure-kiosk-mode).
|
||||
Starting with Windows 10 version 1809+, Microsoft Edge includes support for kiosk mode. [Learn how to deploy Microsoft Edge kiosk mode.](/microsoft-edge/deploy/microsoft-edge-kiosk-mode-deploy)
|
||||
|
||||
In Windows 10, version 1809, Microsoft Edge Legacy includes support for kiosk mode. [Learn how to deploy Microsoft Edge kiosk mode](/microsoft-edge/deploy/microsoft-edge-kiosk-mode-deploy).
|
||||
|
||||
In Windows client, you can install the **Kiosk Browser** app from Microsoft to use as your kiosk app. For digital signage scenarios, you can configure **Kiosk Browser** to navigate to a URL and show only that content -- no navigation buttons, no address bar, etc. For kiosk scenarios, you can configure additional settings, such as allowed and blocked URLs, navigation buttons, and end session buttons. For example, you could configure your kiosk to show the online catalog for your store, where customers can navigate between departments and items, but aren’t allowed to go to a competitor's website.
|
||||
In Windows client, you can install the **Kiosk Browser** app from Microsoft to use as your kiosk app. For digital signage scenarios, you can configure **Kiosk Browser** to navigate to a URL and show only that content -- no navigation buttons, no address bar, etc. For kiosk scenarios, you can configure more settings, such as allowed and blocked URLs, navigation buttons, and end session buttons. For example, you could configure your kiosk to show the online catalog for your store, where customers can navigate between departments and items, but aren’t allowed to go to a competitor's website.
|
||||
|
||||
>[!NOTE]
|
||||
>Kiosk Browser supports a single tab. If a website has links that open a new tab, those links will not work with Kiosk Browser. Kiosk Browser does not support .pdfs.
|
||||
>
|
||||
>Kiosk Browser cannot access intranet websites.
|
||||
>Kiosk Browser can't access intranet websites.
|
||||
|
||||
|
||||
**Kiosk Browser** must be downloaded for offline licensing using Microsoft Store For Business. You can deploy **Kiosk Browser** to devices running Windows 10, version 1803 (Pro, Business, Enterprise, and Education) and Windows 11.
|
||||
@ -81,8 +82,7 @@ Restart on Idle Time | Specify when Kiosk Browser should restart in a fresh stat
|
||||
>
|
||||
> 1. Create the provisioning package. When ready to export, close the project in Windows Configuration Designer.
|
||||
> 2. Open the customizations.xml file in the project folder (e.g C:\Users\name\Documents\Windows Imaging and Configuration Designer (WICD)\Project_18).
|
||||
> 3. Insert the null character string in between each URL
|
||||
(e.g `www.bing.com` and `www.contoso.com`).
|
||||
> 3. Insert the null character string in between each URL (e.g www.bing.com``www.contoso.com).
|
||||
> 4. Save the XML file.
|
||||
> 5. Open the project again in Windows Configuration Designer.
|
||||
> 6. Export the package. Ensure you do not revisit the created policies under Kiosk Browser or else the null character will be removed.
|
||||
@ -104,10 +104,10 @@ URLs can include:
|
||||
- The path to the resource.
|
||||
- Query parameters.
|
||||
|
||||
Additional guidelines for URLs:
|
||||
More guidelines for URLs:
|
||||
|
||||
- If a period precedes the host, the policy filters exact host matches only.
|
||||
- You cannot use user:pass fields.
|
||||
- You can't use user:pass fields.
|
||||
- When both blocked URL and blocked URL exceptions apply with the same path length, the exception takes precedence.
|
||||
- The policy searches wildcards (*) last.
|
||||
- The optional query is a set of key-value and key-only tokens delimited by '&'.
|
||||
@ -120,8 +120,8 @@ The following table describes the results for different combinations of blocked
|
||||
|
||||
Blocked URL rule | Block URL exception rule | Result
|
||||
--- | --- | ---
|
||||
`*` | `contoso.com`<br>`fabrikam.com` | All requests are blocked unless it is to `contoso.com, fabrikam.com,` or any of their subdomains.
|
||||
`contoso.com` | `mail.contoso.com`<br>`.contoso.com`<br>`.www.contoso.com` | Block all requests to `contoso.com,` except for the main page and its mail subdomain.
|
||||
`*` | `contoso.com`<br>`fabrikam.com` | All requests are blocked unless it's to contoso.com, fabrikam.com, or any of their subdomains.
|
||||
`contoso.com` | `mail.contoso.com`<br>`.contoso.com`<br>`.www.contoso.com` | Block all requests to contoso.com, except for the main page and its mail subdomain.
|
||||
`youtube.com` | `youtube.com/watch?v=v1`<br>`youtube.com/watch?v=v2` | Blocks all access to youtube.com except for the specified videos (v1 and v2).
|
||||
|
||||
The following table gives examples for blocked URLs.
|
||||
@ -129,16 +129,16 @@ The following table gives examples for blocked URLs.
|
||||
|
||||
| Entry | Result |
|
||||
|--------------------------|-------------------------------------------------------------------------------|
|
||||
| `contoso.com` | Blocks all requests to contoso.com, `www.contoso.com,` and sub.www.contoso.com |
|
||||
| `contoso.com` | Blocks all requests to contoso.com, www.contoso.com, and sub.www.contoso.com |
|
||||
| `https://*` | Blocks all HTTPS requests to any domain. |
|
||||
| `mail.contoso.com` | Blocks requests to mail.contoso.com but not to `www.contoso.com` or `contoso.com` |
|
||||
| `mail.contoso.com` | Blocks requests to mail.contoso.com but not to www.contoso.com or contoso.com |
|
||||
| `.contoso.com` | Blocks contoso.com but not its subdomains, like subdomain.contoso.com. |
|
||||
| `.www.contoso.com` | Blocks `www.contoso.com` but not its subdomains. |
|
||||
| `.www.contoso.com` | Blocks www.contoso.com but not its subdomains. |
|
||||
| `*` | Blocks all requests except for URLs in the Blocked URL Exceptions list. |
|
||||
| `*:8080` | Blocks all requests to port 8080. |
|
||||
| `contoso.com/stuff` | Blocks all requests to contoso.com/stuff and its subdomains. |
|
||||
| `192.168.1.2` | Blocks requests to 192.168.1.2. |
|
||||
| `youtube.com/watch?v=V1` | Blocks youtube video with id V1. |
|
||||
| `youtube.com/watch?v=V1` | Blocks Youtube video with id V1. |
|
||||
|
||||
### Other browsers
|
||||
|
||||
@ -155,24 +155,18 @@ You can create your own web browser Windows app by using the WebView class. Lear
|
||||
|
||||
Avoid selecting Windows apps that may expose the information you don’t want to show in your kiosk, since kiosk usually means anonymous access and locates in a public setting like a shopping mall. For example, an app that has a file picker allows the user to gain access to files and folders on the user's system, avoid selecting these types of apps if they provide unnecessary data access.
|
||||
|
||||
## Customize your breakout sequence
|
||||
|
||||
Assigned access allows for the specification of a new breakout sequence. A breakout sequence is a keyboard shortcut that stops the kiosk experience and brings the user back to the lock screen. By default the breakout sequence is configured to be ctrl+alt+delete, a common Windows keyboard shortcut. It is recommended that this is set to a non-standard Windows shortcut to prevent disruptions in the kiosk experience.
|
||||
|
||||
There is currently no user interface for customizing the breakout sequence in Windows settings, so it would need to be specified in a provisioning method where an XML format such as MDM is used.
|
||||
|
||||
## App configuration
|
||||
|
||||
Some apps may require additional configurations before they can be used appropriately in assigned access. For example, Microsoft OneNote requires you to set up a Microsoft account for the assigned access user account before OneNote will open in assigned access.
|
||||
Some apps may require more configurations before they can be used appropriately in assigned access. For example, Microsoft OneNote requires you to set up a Microsoft account for the assigned access user account before OneNote will open in assigned access.
|
||||
|
||||
Check the guidelines published by your selected app and set up accordingly.
|
||||
|
||||
## Develop your kiosk app
|
||||
|
||||
Assigned access in Windows client leverages the new lock framework. When an assigned access user signs in, the selected kiosk app is launched above the lock screen. The kiosk app is running as an above lock screen app.
|
||||
Assigned access in Windows client uses the new lock framework. When an assigned access user signs in, the selected kiosk app is launched above the lock screen. The kiosk app is running as an above lock screen app.
|
||||
|
||||
Follow the [best practices guidance for developing a kiosk app for assigned access](/windows-hardware/drivers/partnerapps/create-a-kiosk-app-for-assigned-access).
|
||||
|
||||
## Test your assigned access experience
|
||||
|
||||
The above guidelines may help you select or develop an appropriate Windows app for your assigned access experience. Once you have selected your app, we recommend that you thoroughly test the assigned access experience to ensure that your device provides a good customer experience.
|
||||
The above guidelines may help you select or develop an appropriate Windows app for your assigned access experience. Once you've selected your app, we recommend that you thoroughly test the assigned access experience to ensure that your device provides a good customer experience.
|
||||
|
||||
Reference in New Issue
Block a user