+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
diff --git a/windows/client-management/mdm/policy-csp-windowssandbox.md b/windows/client-management/mdm/policy-csp-windowssandbox.md
index f3fd70ab14..c8066ba2b0 100644
--- a/windows/client-management/mdm/policy-csp-windowssandbox.md
+++ b/windows/client-management/mdm/policy-csp-windowssandbox.md
@@ -48,38 +48,14 @@ ms.date: 10/14/2020
Available in the latest Windows 10 insider preview build.
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
No
-
No
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|No|No|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -142,38 +118,14 @@ The following are the supported values:
Available in the latest Windows 10 insider preview build.
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
No
-
No
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|No|No|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -233,38 +185,14 @@ The following are the supported values:
Available in the latest Windows 10 insider preview build.
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
No
-
No
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|No|No|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -322,38 +250,14 @@ The following are the supported values:
Available in the latest Windows 10 insider preview build.
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
No
-
No
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|No|No|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -412,38 +316,14 @@ The following are the supported values:
Available in the latest Windows 10 insider preview build.
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
No
-
No
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|No|No|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -505,38 +385,14 @@ The following are the supported values:
Available in the latest Windows 10 insider preview build.
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -117,38 +93,14 @@ The following list shows the supported values:
**WirelessDisplay/AllowMdnsDiscovery**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -181,38 +133,14 @@ The following list shows the supported values:
**WirelessDisplay/AllowProjectionFromPC**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -245,38 +173,14 @@ The following list shows the supported values:
**WirelessDisplay/AllowProjectionFromPCOverInfrastructure**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -309,38 +213,14 @@ The following list shows the supported values:
**WirelessDisplay/AllowProjectionToPC**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -385,38 +265,14 @@ The following list shows the supported values:
**WirelessDisplay/AllowProjectionToPCOverInfrastructure**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -449,38 +305,14 @@ The following list shows the supported values:
**WirelessDisplay/AllowUserInputFromWirelessDisplayReceiver**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -513,38 +345,14 @@ The following list shows the supported values:
**WirelessDisplay/RequirePinForPairing**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
diff --git a/windows/client-management/mdm/pxlogical-csp.md b/windows/client-management/mdm/pxlogical-csp.md
index 1b7b94e690..5535a11feb 100644
--- a/windows/client-management/mdm/pxlogical-csp.md
+++ b/windows/client-management/mdm/pxlogical-csp.md
@@ -17,7 +17,8 @@ ms.date: 06/26/2017
The PXLOGICAL configuration service provider is used to add, remove, or modify WAP logical and physical proxies by using WAP or the standard Windows techniques.
-> **Note** This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION and ID\_CAP\_NETWORKING\_ADMIN capabilities to be accessed from a network configuration application.
+> [!NOTE]
+> This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION and ID\_CAP\_NETWORKING\_ADMIN capabilities to be accessed from a network configuration application.
The following shows the PXLOGICAL configuration service provider management object in tree format as used by OMA Client Provisioning for initial bootstrapping of the device. The OMA DM protocol is not supported by this configuration service provider.
@@ -151,36 +152,12 @@ The following table shows the Microsoft custom elements that this configuration
These features are available only for the device technique. In addition, the parameter-query and characteristic-query features are not supported for all PXPHYSICAL proxy parameters for all PXADDR types. All parameters can be queried when the PXPHYSICAL proxy PXADDRType is IPv4. For example, if a mobile operator queries the TO-NAPID parameter of a PXPHYSICAL proxy and the PXADDR Type is E164, a noparm is returned.
-
-
-
-
-
-
-
-
Feature
-
Available
-
-
-
-
-
parm-query
-
Yes
-
-
-
noparm
-
Yes
-
-
-
nocharacteristic
-
Yes
-
-
-
characteristic-query
-
Yes
-
-
-
+|Feature|Available|
+|--- |--- |
+|parm-query|Yes|
+|noparm|Yes|
+|nocharacteristic|Yes|
+|characteristic-query|Yes|
@@ -189,12 +166,3 @@ These features are available only for the device technique. In addition, the par
[Configuration service provider reference](configuration-service-provider-reference.md)
-
-
-
-
-
-
-
-
-
diff --git a/windows/client-management/mdm/reclaim-seat-from-user.md b/windows/client-management/mdm/reclaim-seat-from-user.md
index 3beb6993e3..35928407be 100644
--- a/windows/client-management/mdm/reclaim-seat-from-user.md
+++ b/windows/client-management/mdm/reclaim-seat-from-user.md
@@ -18,120 +18,31 @@ The **Reclaim seat from user** operation returns reclaimed seats for a user in t
## Request
-
+|Method|Request URI|
+|--- |--- |
+|DELETE|`https://bspmts.mp.microsoft.com/V1/Inventory/{productId}/{skuId}/Seats/{username}`|
### URI parameters
The following parameters may be specified in the request URI.
-
-
-
-
-
-
-
-
-
Parameter
-
Type
-
Description
-
-
-
-
-
productId
-
string
-
Required. Product identifier for an application that is used by the Store for Business.
-
-
-
skuId
-
string
-
Required. Product identifier that specifies a specific SKU of an application.
-
-
-
username
-
string
-
Requires UserPrincipalName (UPN). User name of the target user account.
-
-
-
+|Parameter|Type|Description|
+|--- |--- |--- |
+|productId|string|Required. Product identifier for an application that is used by the Store for Business.|
+|skuId|string|Required. Product identifier that specifies a specific SKU of an application.|
+|username|string|Requires UserPrincipalName (UPN). User name of the target user account.|
-
## Response
### Response body
The response body contain [SeatDetails](data-structures-windows-store-for-business.md#seatdetails).
-
+|Error code|Description|Retry|Data field|Details|
+|--- |--- |--- |--- |--- |
+|400|Invalid parameters|No|Parameter name Reason: Invalid parameter Details: String|Invalid can include productId, skuId or userName|
+|404|Not found||Item type: Inventory, User, Seat Values: ProductId/SkuId, UserName, ProductId/SkuId/UserName|ItemType: Inventory, User, Seat Values: ProductId/SkuId, UserName, ProductId/SkuId/UserName|
+|409|Conflict||Reason: Not online||
-
-
-
-
-
-
-
diff --git a/windows/client-management/mdm/registry-csp.md b/windows/client-management/mdm/registry-csp.md
index 4978cc70e0..d678652ec7 100644
--- a/windows/client-management/mdm/registry-csp.md
+++ b/windows/client-management/mdm/registry-csp.md
@@ -33,7 +33,7 @@ For OMA Client Provisioning, the follows notes apply:
- This documentation describes the default characteristics. Additional characteristics may be added.
-- Because the **Registry** configuration service provider uses the backslash (\\) character as a separator between key names, backslashes which occur in the name of a registry key must be escaped. Backslashes can be escaped by using two sequential backslashes (\\\\).
+- Because the **Registry** configuration service provider uses the backslash (\\) character as a separator between key names, backslashes, which occur in the name of a registry key must be escaped. Backslashes can be escaped by using two sequential backslashes (\\\\).
The default security role maps to each subnode unless specific permission is granted to the subnode. The security role for subnodes is implementation specific, and can be changed by OEMs and mobile operators.
@@ -41,38 +41,12 @@ The default security role maps to each subnode unless specific permission is gra
The following table shows the Microsoft custom elements that this configuration service provider supports for OMA Client Provisioning.
-
Top-level query: No|
Use these elements to build standard OMA Client Provisioning configuration XML. For information about specific elements, see MSPROV DTD elements.
@@ -82,62 +56,16 @@ Use these elements to build standard OMA Client Provisioning configuration XML.
The following table shows the data types this configuration service provider supports.
-
-
-
-
-
-
-
-
-
XML Data Type
-
Native Registry Type
-
XML Format
-
-
-
-
-
integer
-
REG_DWORD
-
Integer. A query of this parameter returns an integer type.
-
-
-
boolean
-
REG_DWORD
-
Integer value of 1 or 0. A query of this parameter returns an integer type.
-
-
-
float
-
REG_SZ
-
Float. A query of this parameter returns a string type.
-
-
-
string
-
REG_SZ
-
String. A query of this parameter returns a string type.
-
-
-
multiplestring
-
REG_MULTI_SZ
-
Multiple strings are separated by  and ended with two  - A query of this parameter returns a multistring type.
-
-
-
binary
-
REG_BINARY
-
Base64 encoded. A query of this parameter returns a binary type.
-
-
-
time
-
FILETIME in REG_BINARY
-
The time format conforms to the ISO8601 standard, with the date portion optional. If the date portion is omitted, also omit the "T" delimiter. A query of this parameter returns a binary type.
-
-
-
date
-
FILETIME in REG_BINARY
-
The date format conforms to the ISO8601 standard, with the time portion optional. If the time portion is omitted, also omit the "T" delimiter. A query of this parameter returns a binary type.
-
-
-
+|XML Data Type|Native Registry Type|XML Format|
+|--- |--- |--- |
+|Integer|REG_DWORD|Integer. A query of this parameter returns an integer type.|
+|Boolean|REG_DWORD|Integer value of 1 or 0. A query of this parameter returns an integer type.|
+|Float|REG_SZ|Float. A query of this parameter returns a string type.|
+|String|REG_SZ|String. A query of this parameter returns a string type.|
+|multiple string|REG_MULTI_SZ|Multiple strings are separated by **** and ended with two **** - A query of this parameter returns a multi-string type.|
+|Binary|REG_BINARY|Base64 encoded. A query of this parameter returns a binary type.|
+|Time|FILETIME in REG_BINARY|The time format conforms to the ISO8601 standard, with the date portion optional. If the date portion is omitted, also omit the "T" delimiter. A query of this parameter returns a binary type.|
+|Date|FILETIME in REG_BINARY|The date format conforms to the ISO8601 standard, with the time portion optional. If the time portion is omitted, also omit the "T" delimiter. A query of this parameter returns a binary type.|
@@ -147,13 +75,3 @@ It is not possible to access registry keys nested under the current path by usin
[Configuration service provider reference](configuration-service-provider-reference.md)
-
-
-
-
-
-
-
-
-
-
diff --git a/windows/client-management/mdm/remotelock-csp.md b/windows/client-management/mdm/remotelock-csp.md
index 47ee3981e4..86f5a419c8 100644
--- a/windows/client-management/mdm/remotelock-csp.md
+++ b/windows/client-management/mdm/remotelock-csp.md
@@ -26,71 +26,21 @@ The RemoteLock CSP supports the ability to lock a device that has a PIN set on t
**Lock**
Required. The setting accepts requests to lock the device screen. The device screen will lock immediately if a PIN has been set. If no PIN is set, the lock request is ignored and the OMA DM (405) Forbidden error is returned over the management channel. All OMA DM errors are listed [here](https://go.microsoft.com/fwlink/p/?LinkId=522607) in the protocol specification. The supported operations are Get and Exec.
-
-
-
-
-
-
-
-
-
Status
-
Description
-
Meaning [Standard]
-
-
-
-
-
(200) OK
-
The device was successfully locked.
-
The command and the associated Alert action are completed successfully.
-
-
-
(405)
-
The device could not be locked because there is no PIN currently set on the device.
-
The requested command is not allowed on the target.
-
-
-
(500) Command failed
-
The device was not locked for some unknown reason.
-
Non-specific errors were created by the recipient while attempting to complete the command.
-
-
-
-
-
+|Status|Description|Meaning [Standard]|
+|--- |--- |--- |
+|(200) OK|The device was successfully locked.|The command and the associated Alert action are completed successfully.|
+|(405)|The device could not be locked because there is no PIN currently set on the device.|The requested command is not allowed on the target.|
+|(500) Command failed|The device was not locked for some unknown reason.|Non-specific errors were created by the recipient while attempting to complete the command.|
**LockAndResetPIN**
This setting can be used to lock and reset the PIN on the device. It is used in conjunction with the NewPINValue node. After the **Exec** operation is called successfully on this node, the previous PIN will no longer work and cannot be recovered. The supported operation is Exec.
This node will return the following status. All OMA DM errors are listed [here](https://go.microsoft.com/fwlink/p/?LinkId=522607) in the protocol specification.
-
-
-
-
-
-
-
-
-
Status
-
Description
-
Meaning
-
-
-
-
-
(200) OK
-
The device has been locked with a new password which has been reset.
-
The command and the associated Alert action are completed successfully.
-
-
-
(500) Command failed
-
N/A
-
Non-specific errors were created by the recipient while attempting to complete the command.
-
-
-
+|Status|Description|Meaning|
+|--- |--- |--- |
+|(200) OK|The device has been locked with a new password which has been reset.|The command and the associated Alert action are completed successfully.|
+|(500) Command failed|N/A|Non-specific errors were created by the recipient while attempting to complete the command.|
**LockAndRecoverPIN**
Added in Windows 10, version 1703. This setting performs a similar function to the LockAndResetPIN node. With LockAndResetPIN any Windows Hello keys associated with the PIN gets deleted, but with LockAndRecoverPIN those keys are saved. After the Exec operation is called successfully on this setting, the new PIN can be retrieved from the NewPINValue setting. The previous PIN will no longer work.
diff --git a/windows/client-management/mdm/securitypolicy-csp.md b/windows/client-management/mdm/securitypolicy-csp.md
index fbc7a1ec31..a08448947e 100644
--- a/windows/client-management/mdm/securitypolicy-csp.md
+++ b/windows/client-management/mdm/securitypolicy-csp.md
@@ -17,7 +17,8 @@ ms.date: 06/26/2017
The SecurityPolicy configuration service provider is used to configure security policy settings for WAP push, OMA Client Provisioning, OMA DM, Service Indication (SI), Service Loading (SL), and MMS.
-> **Note** This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION and ID\_CAP\_DEVICE\_MANAGEMENT\_SECURITY\_POLICIES capabilities to be accessed from a network configuration application.
+> [!NOTE]
+> This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION and ID\_CAP\_DEVICE\_MANAGEMENT\_SECURITY\_POLICIES capabilities to be accessed from a network configuration application.
@@ -36,122 +37,78 @@ Defines the security policy identifier as a decimal value.
The following security policies are supported.
-
-
-
-
-
-
-
-
-
PolicyID
-
Policy name
-
Policy description
-
-
-
-
-
4104
-
Hex: 1008
-
TPS Policy
-
This setting indicates whether mobile operators can be assigned the Trusted Provisioning Server (TPS) SECROLE_OPERATOR_TPS role.
-
Default value: 1
-
Supported values:
-
0: The TPS role assignment is disabled.
-
1: The TPS role assignment is enabled, and can be assigned to mobile operators.
-
-
-
4105
-
Hex: 1009
-
Message Authentication Retry Policy
-
This setting specifies the maximum number of times the user is allowed to try authenticating a Wireless Application Protocol (WAP) PIN-signed message.
-
Default value: 3
-
Possible values: 0 through 256.
-
-
-
4108
-
Hex: 100c
-
Service Loading Policy
-
This setting indicates whether SL messages are accepted, by specifying the security roles that can accept SL messages. An SL message downloads new services or provisioning XML to the device.
This setting indicates whether SI messages are accepted, by specifying the security roles that can accept SI messages. An SI message is sent to the device to notify users of new services, service updates, and provisioning services.
This setting determines whether PIN signed OMA Client Provisioning messages will be processed. This policy's value specifies a role mask. If a message contains at least one of the following roles in the role mask, then the message is processed. To ensure properly signed OMA Client Provisioning messages are accepted by the configuration client, all of the roles that are set in 4141, 4142, and 4143 policies must also be set in this policy. For example, to ensure properly signed USERNETWPIN signed OMA Client Provisioning messages are accepted by the device, if policy 4143 is set to 4096 (SECROLE_ANY_PUSH_SOURCE) for an carrier-unlocked device, policy 4111 must also have the SECROLE_ANY_PUSH_SOURCE role set.
This setting indicates whether Wireless Session Protocol (WSP) notifications from the WAP stack are routed.
-
Default value: 1
-
Supported values:
-
0: Routing of WSP notifications is not allowed.
-
1: Routing of WSP notifications is allowed.
-
-
-
4132
-
Hex:1024
-
Network PIN signed OTA Provision Message User Prompt Policy
-
This policy specifies whether the device will prompt a UI to get the user confirmation before processing a pure network pin signed OTA Provisioning message. If prompt, the user has the ability to discard the OTA provisioning message.
-
Default value: 0
-
Supported values:
-
0: The device prompts a UI to get user confirmation when the OTA WAP provisioning message is signed purely with network pin.
-
1: There is no user prompt.
-
-
-
4141
-
Hex:102d
-
OMA CP NETWPIN Policy
-
This setting determines whether the OMA network PIN signed message will be accepted. The message's role mask and the policy's role mask are combined using the AND operator. If the result is non-zero, then the message is accepted.
This setting determines whether the OMA user PIN or user MAC signed message will be accepted. The message's role mask and the policy's role mask are combined using the AND operator. If the result is non-zero, then the message is accepted.
This setting determines whether the OMA user network PIN signed message will be accepted. The message's role mask and the policy's role mask are combined using the AND operator. If the result is non-zero, then the message is accepted.
This setting determines whether MMS messages will be processed. This policy's value specifies a role mask. If a message contains at least one of the roles in the role mask, then the message is processed.
+- **PolicyID**: 4104 | Hex: 1008
+ - **Policy name**: TPS Policy
+ - **Policy description**: This setting indicates whether mobile operators can be assigned the Trusted Provisioning Server (TPS) SECROLE_OPERATOR_TPS role.
+ - Default value: 1
+ - Supported values:
+ - 0: The TPS role assignment is disabled.
+ - 1: The TPS role assignment is enabled, and can be assigned to mobile operators.
+
+- **PolicyID**: 4105 | Hex: 1009
+ - **Policy name**: Message Authentication Retry Policy
+ - **Policy description**: This setting specifies the maximum number of times the user is allowed to try authenticating a Wireless Application Protocol (WAP) PIN-signed message.
+ - Default value: 3
+ - Supported values: 0 through 256
+
+- **PolicyID**: 4108 | Hex: 100c
+ - **Policy name**: Service Loading Policy
+ - **Policy description**: This setting indicates whether SL messages are accepted, by specifying the security roles that can accept SL messages. An SL message downloads new services or provisioning XML to the device.
+ - Default value: 256 (SECROLE_KNOWN_PPG)
+ - Supported values: SECROLE_ANY_PUSH_SOURCE, SECROLE_KNOWN_PPG
+
+- **PolicyID**: 4109 | Hex:100d
+ - **Policy name**: Service Indication Policy
+ - **Policy description**: This setting indicates whether SI messages are accepted, by specifying the security roles that can accept SI messages. An SI message is sent to the device to notify users of new services, service updates, and provisioning services.
+ - Default value: 256 (SECROLE_KNOWN_PPG)
+ - Supported values: SECROLE_ANY_PUSH_SOURCE, SECROLE_KNOWN_PPG
+
+- **PolicyID**: 4111 | Hex:100f
+ - **Policy name**: OTA Provisioning Policy
+ - **Policy description**: This setting determines whether PIN signed OMA Client Provisioning messages will be processed. This policy's value specifies a role mask. If a message contains at least one of the following roles in the role mask, then the message is processed. To ensure properly signed OMA Client Provisioning messages are accepted by the configuration client, all of the roles that are set in 4141, 4142, and 4143 policies must also be set in this policy. For example, to ensure properly signed USERNETWPIN signed OMA Client Provisioning messages are accepted by the device, if policy 4143 is set to 4096 (SECROLE_ANY_PUSH_SOURCE) for an carrier-unlocked device, policy 4111 must also have the SECROLE_ANY_PUSH_SOURCE role set.
+ - Default value: 384 (SECROLE_OPERATOR_TPS | SECROLE_KNOWN_PPG)
+ - Supported values: SECROLE_KNOWN_PPG, SECROLE_ANY_PUSH_SOURCE, SECROLE_OPERATOR_TPS
+
+- **PolicyID**: 4113 | Hex:1011
+ - **Policy name**: WSP Push Policy
+ - **Policy description**: This setting indicates whether Wireless Session Protocol (WSP) notifications from the WAP stack are routed.
+ - Default value: 1
+ - Supported values:
+ - 0: Routing of WSP notifications is not allowed.
+ - 1: Routing of WSP notifications is allowed.
+
+- **PolicyID**: 4132 | Hex:1024
+ - **Policy name**: Network PIN signed OTA Provision Message User Prompt Policy
+ - **Policy description**: This policy specifies whether the device will prompt a UI to get the user confirmation before processing a pure network pin signed OTA Provisioning message. If prompt, the user has the ability to discard the OTA provisioning message.
+ - Default value: 0
+ - Supported values:
+ - 0: The device prompts a UI to get user confirmation when the OTA WAP provisioning message is signed purely with network pin.
+ - 1: There is no user prompt.
+
+- **PolicyID**: 4141 | Hex:102d
+ - **Policy name**: OMA CP NETWPIN Policy
+ - **Policy description**: This setting determines whether the OMA network PIN signed message will be accepted. The message's role mask and the policy's role mask are combined using the AND operator. If the result is non-zero, then the message is accepted.
+ - Default value: 0
+ - Supported values: SECROLE_KNOWN_PPG, SECROLE_ANY_PUSH_SOURCE , SECROLE_OPERATOR_TPS
+
+- **PolicyID**: 4142 | Hex:102e
+ - **Policy name**: OMA CP USERPIN Policy
+ - **Policy description**: This setting determines whether the OMA user PIN or user MAC signed message will be accepted. The message's role mask and the policy's role mask are combined using the AND operator. If the result is non-zero, then the message is accepted.
+ - Default value: 256
+ - Supported values: SECROLE_OPERATOR_TPS, SECROLE_ANY_PUSH_SOURCE, SECROLE_KNOWN_PPG
+
+- **PolicyID**: 4143 | Hex:102f
+ - **Policy name**: OMA CP USERNETWPIN Policy
+ - **Policy description**: This setting determines whether the OMA user network PIN signed message will be accepted. The message's role mask and the policy's role mask are combined using the AND operator. If the result is non-zero, then the message is accepted.
+ - Default value: 256
+ - Supported values: SECROLE_KNOWN_PPG, SECROLE_ANY_PUSH_SOURCE, SECROLE_OPERATOR_TPS
+
+- **PolicyID**: 4144 | Hex:1030
+ - **Policy name**: MMS Message Policy
+ - **Policy description**: This setting determines whether MMS messages will be processed. This policy's value specifies a role mask. If a message contains at least one of the roles in the role mask, then the message is processed.
+ - Default value: 256 (SECROLE_KNOWN_PPG)
+ - Supported values: SECROLE_KNOWN_PPG, SECROLE_ANY_PUSH_SOURCE
-
## Remarks
@@ -160,41 +117,11 @@ Security roles allow or restrict access to device resources. The security role i
The following security roles are supported.
-
-
-
-
-
-
-
-
-
Security role
-
Decimal value
-
Description
-
-
-
-
-
SECROLE_OPERATOR_TPS
-
128
-
Trusted Provisioning Server.
-
Assigned to WAP messages that come from a Push Initiator that is authenticated (SECROLE_PPG_AUTH) by a trusted Push Proxy Gateway (SECROLE_TRUSTED_PPG), and where the Uniform Resource Identifier (URI) of the Push Initiator corresponds to the URI of the Trusted Provisioning Server (TPS) on the device.
-
The mobile operator can determine whether this role and the SECROLE_OPERATOR role require the same permissions.
-
-
-
SECROLE_KNOWN_PPG
-
256
-
Known Push Proxy Gateway.
-
Messages assigned this role indicate that the device knows the address to the Push Proxy Gateway.
-
-
-
SECROLE_ANY_PUSH_SOURCE
-
4096
-
Push Router.
-
Messages received by the push router will be assigned to this role.
-
-
-
+|Security role|Decimal value|Description|
+|--- |--- |--- |
+|SECROLE_OPERATOR_TPS|128|Trusted Provisioning Server. Assigned to WAP messages that come from a Push Initiator that is authenticated (SECROLE_PPG_AUTH) by a trusted Push Proxy Gateway (SECROLE_TRUSTED_PPG), and where the Uniform Resource Identifier (URI) of the Push Initiator corresponds to the URI of the Trusted Provisioning Server (TPS) on the device. The mobile operator can determine whether this role and the SECROLE_OPERATOR role require the same permissions.|
+|SECROLE_KNOWN_PPG|256|Known Push Proxy Gateway. Messages assigned this role indicate that the device knows the address to the Push Proxy Gateway.|
+|SECROLE_ANY_PUSH_SOURCE|4096|Push Router. Messages received by the push router will be assigned to this role.|
@@ -271,28 +198,10 @@ Querying a security policy:
The following table shows the Microsoft custom elements that this Configuration Service Provider supports for OMA Client Provisioning.
-
-
-
-
-
-
-
-
Elements
-
Available
-
-
-
-
-
parm-query
-
Yes
-
-
-
noparm
-
Yes. If this is used, then the policy is set to 0 by default (corresponding to the most restrictive of policy values).
-
-
-
+|Elements|Available|
+|--- |--- |
+|parm-query|Yes|
+|noparm|Yes. If this is used, then the policy is set to 0 by default (corresponding to the most restrictive of policy values).|
@@ -300,13 +209,3 @@ The following table shows the Microsoft custom elements that this Configuration
[Configuration service provider reference](configuration-service-provider-reference.md)
-
-
-
-
-
-
-
-
-
-
diff --git a/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md b/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md
index 2b482383bd..00da69a8cb 100644
--- a/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md
+++ b/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md
@@ -22,32 +22,10 @@ Each message is composed of a header, specified by the SyncHdr element, and a me
The following table shows the OMA DM versions that are supported.
-
</SyncML>|
+|OMA DM version 1.2|<SyncML xmlns='SYNCML:SYNCML1.2'>
</SyncML>|
## File format
@@ -103,7 +81,8 @@ This information is used to by the client device to properly manage the DM sessi
The following example shows the header component of a DM message. In this case, OMA DM version 1.2 is used as an example only.
-> **Note** The <LocURI> node value for the <Source> element in the SyncHdr of the device-generated DM package should be the same as the value of ./DevInfo/DevID. For more information about DevID, see [DevInfo configuration service provider](devinfo-csp.md).
+> [!NOTE]
+> The `` node value for the `` element in the SyncHdr of the device-generated DM package should be the same as the value of ./DevInfo/DevID. For more information about DevID, see [DevInfo configuration service provider](devinfo-csp.md).
@@ -147,7 +126,7 @@ The following example shows the body component of a DM message. In this example,
When using SyncML for OMA DM provisioning, a LocURI in SyncBody can have a "." as a valid segment name only in the first segment. However, a "." is not a valid segment name for the other segments. For example, the following LocURI is not valid because the segment name of the seventh segment is a ".".
-```
+```xml
./Vendor/MSFT/Registry/HKLM/Security/./Test
```
@@ -188,11 +167,3 @@ The following example illustrates how to use the Replace command to update a dev
```
-
-
-
-
-
-
-
-
diff --git a/windows/client-management/mdm/supl-csp.md b/windows/client-management/mdm/supl-csp.md
index e41a8c2374..d2df672d1e 100644
--- a/windows/client-management/mdm/supl-csp.md
+++ b/windows/client-management/mdm/supl-csp.md
@@ -16,56 +16,30 @@ ms.date: 09/12/2019
The SUPL configuration service provider is used to configure the location client, as shown in the following table:
-
-
-
-
-
-
-
-
-
Location Service
-
SUPL
-
V2 UPL
-
-
-
-
-
Connection type
-
All connections other than CDMA
-
CDMA
-
-
-
Configuration
-
-
Settings that need to get pushed to the GNSS driver to configure the SUPL behavior:
-
-
Address of the Home SUPL (H-SLP) server.
-
H-SLP server certificate.
-
Positioning method.
-
Version of the protocol to use by default.
-
-
MCC/MNC value pairs which are used to specify which networks' UUIC the SUPL account matches.
-
-
-
Address of the server — a mobile positioning center for non-trusted mode.
-
The positioning method used by the MPC for non-trusted mode.
-
-
-
-
+- **Location Service**: Connection type
+ - **SUPL**: All connections other than CDMA
+ - **V2 UPL**: CDMA
-
+- **Location Service**: Configuration
+ - **SUPL**:
+ - Settings that need to get pushed to the GNSS driver to configure the SUPL behavior:
+ - Address of the Home SUPL (H-SLP) server.
+ - H-SLP server certificate.
+ - Positioning method.
+ - Version of the protocol to use by default.
+ - MCC/MNC value pairs which are used to specify which networks' UUIC the SUPL account matches.
+ - **V2 UPL**:
+ - Address of the server — a mobile positioning center for non-trusted mode.
+ - The positioning method used by the MPC for non-trusted mode.
The SUPL or V2 UPL connection will be reconfigured every time the device is rebooted, a new UICC is inserted, or new settings are provisioned by using OMA Client Provisioning, OMA DM, or test tools. When the device is in roaming mode, it reverts to Mobile Station Standalone mode, in which only the built–in Microsoft location components are used.
The following shows the SUPL configuration service provider management object in tree format as used by OMA DM and OMA Client Provisioning.
-> **Note** This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION capability to be accessed from a network configuration application.
+> [!NOTE]
+> This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION capability to be accessed from a network configuration application.
-
-
-```
+```console
./Vendor/MSFT/
SUPL
----SUPL1
@@ -97,6 +71,7 @@ SUPL
--------NIDefaultTimeout
--------ServerAccessInterval
```
+
**SUPL1**
Required for SUPL. Defines the account for the SUPL Enabled Terminal (SET) node. Only one SUPL account is supported at a given time.
@@ -126,50 +101,21 @@ For OMA DM, if the format for this node is incorrect the entry will be ignored a
**HighAccPositioningMethod**
Optional. Specifies the positioning method that the SUPL client will use for mobile originated position requests. The value can be one of the following integers:
-
-
-
-
-
-
-
-
Value
-
Description
-
-
-
-
-
0
-
None: The device uses the default positioning method. In this default mode, the GNSS obtains assistance (time injection, coarse position injection and ephemeris data) from the Microsoft Positioning Service.
-
-
-
1
-
Mobile Station Assisted: The device contacts the H-SLP server to obtain a position. The H-SLP does the calculation of the position and returns it to the device.
-
-
-
2
-
Mobile Station Based: The device obtains location-aiding data (almanac, ephemeris data, time and coarse initial position of the device) from the H-SLP server, and the device uses this information to help GPS obtain a fix. All position calculations are done in the device.
-
-
-
3
-
Mobile Station Standalone: The device obtains assistance as required from the Microsoft location services.
-
-
-
4
-
OTDOA
-
-
-
5
-
AFLT
-
-
-
+|Value|Description|
+|--- |--- |
+|0|None: The device uses the default positioning method. In this default mode, the GNSS obtains assistance (time injection, coarse position injection and ephemeris data) from the Microsoft Positioning Service.|
+|1|Mobile Station Assisted: The device contacts the H-SLP server to obtain a position. The H-SLP does the calculation of the position and returns it to the device.|
+|2|Mobile Station Based: The device obtains location-aiding data (almanac, ephemeris data, time and coarse initial position of the device) from the H-SLP server, and the device uses this information to help GPS obtain a fix. All position calculations are done in the device.|
+|3|Mobile Station Standalone: The device obtains assistance as required from the Microsoft location services.|
+|4|OTDOA|
+|5|AFLT|
The default is 0. The default method in Windows devices provides high-quality assisted GNSS positioning for mobile originated position requests without loading the mobile operator’s network or location services.
-> **Important** The Mobile Station Assisted, OTDOA, and AFLT positioning methods must only be configured for test purposes.
+> [!IMPORTANT]
+> The Mobile Station Assisted, OTDOA, and AFLT positioning methods must only be configured for test purposes.
@@ -180,44 +126,13 @@ Optional. Boolean. Specifies whether the location toggle on the **location** scr
This value manages the settings for both SUPL and v2 UPL. If a device is configured for both SUPL and V2 UPL and these values differ, the SUPL setting will always be used.
-
-
-
-
-
-
-
-
-
Location toggle setting
-
LocMasterSwitchDependencyNII setting
-
NI request processing allowed
-
-
-
-
-
On
-
0
-
Yes
-
-
-
On
-
1
-
Yes
-
-
-
Off
-
0
-
Yes
-
-
-
Off
-
1
-
No (unless privacyOverride is set)
-
-
-
+|Location toggle setting|LocMasterSwitchDependencyNII setting|NI request processing allowed|
+|--- |--- |--- |
+|On|0|Yes|
+|On|1|Yes|
+|Off|0|Yes|
+|Off|1|No (unless privacyOverride is set)|
-
When the location toggle is set to Off and this value is set to 1, the following application requests will fail:
@@ -309,46 +224,18 @@ Optional. The address of the Position Determination Entity (PDE), in the format
**PositioningMethod\_MR**
Optional. Specifies the positioning method that the SUPL client will use for mobile originated position requests. The value can be one of the following integers:
-
-
-
-
-
-
-
-
Value
-
Description
-
-
-
-
-
0
-
None: The device uses the default positioning method. In this default mode, the GNSS obtains assistance (time injection, coarse position injection, and ephemeris data) from the Microsoft Positioning Service.
-
-
-
1
-
Mobile Station Assisted: The device contacts the H-SLP server to obtain a position. The H-SLP does the calculation of the position and returns it to the device.
-
-
-
2
-
Mobile Station Based: The device obtains location-aiding data (almanac, ephemeris data, time and coarse initial position of the device) from the H-SLP server, and the device uses this information to help GPS obtain a fix. All position calculations are done in the device.
-
-
-
3
-
Mobile Station Standalone: The device obtains assistance as required from the Microsoft location services.
-
-
-
4
-
AFLT
-
-
-
-
-
+|Value|Description|
+|--- |--- |
+|0|None: The device uses the default positioning method. In this default mode, the GNSS obtains assistance (time injection, coarse position injection, and ephemeris data) from the Microsoft Positioning Service.|
+|1|Mobile Station Assisted: The device contacts the H-SLP server to obtain a position. The H-SLP does the calculation of the position and returns it to the device.|
+|2|Mobile Station Based: The device obtains location-aiding data (almanac, ephemeris data, time and coarse initial position of the device) from the H-SLP server, and the device uses this information to help GPS obtain a fix. All position calculations are done in the device.|
+|3|Mobile Station Standalone: The device obtains assistance as required from the Microsoft location services.|
+|4|AFLT|
The default is 0. The default method provides high-quality assisted GNSS positioning for mobile originated position requests without loading the mobile operator’s network or location services.
-> **Important** The Mobile Station Assisted and AFLT positioning methods must only be configured for test purposes.
+> [!IMPORTANT]
+> The Mobile Station Assisted and AFLT positioning methods must only be configured for test purposes.
@@ -359,44 +246,12 @@ Optional. Boolean. Specifies whether the location toggle on the **location** scr
This value manages the settings for both SUPL and v2 UPL. If a device is configured for both SUPL and V2 UPL and these values differ, the SUPL setting will always be used.
-
-
-
-
-
-
-
-
-
Location toggle setting
-
LocMasterSwitchDependencyNII setting
-
NI request processing allowed
-
-
-
-
-
On
-
0
-
Yes
-
-
-
On
-
1
-
Yes
-
-
-
Off
-
0
-
Yes
-
-
-
Off
-
1
-
No (unless privacyOverride is set)
-
-
-
-
-
+|Location toggle setting|LocMasterSwitchDependencyNII setting|NI request processing allowed|
+|--- |--- |--- |
+|On|0|Yes|
+|On|1|Yes|
+|Off|0|Yes|
+|Off|1|No (unless privacyOverride is set)|
When the location toggle is set to Off and this value is set to 1, the following application requests will fail:
@@ -584,32 +439,12 @@ Adding a SUPL account to a device. Values in italic must be replaced with correc
The following table shows the Microsoft custom elements that this configuration service provider supports for OMA Client Provisioning.
-
Top level query: No|
## Related topics
-[Configuration service provider reference](configuration-service-provider-reference.md)
\ No newline at end of file
+[Configuration service provider reference](configuration-service-provider-reference.md)
diff --git a/windows/client-management/mdm/surfacehub-csp.md b/windows/client-management/mdm/surfacehub-csp.md
index 147c460f3b..8c596e748e 100644
--- a/windows/client-management/mdm/surfacehub-csp.md
+++ b/windows/client-management/mdm/surfacehub-csp.md
@@ -206,63 +206,22 @@ SurfaceHub
The data type is boolean. Supported operation is Get and Replace.
**DeviceAccount/ErrorContext**
-
If there is an error calling ValidateAndCommit, there is additional context for that error in this node. Here are the possible error values:
-
-
-
-
-
-
-
-
-
ErrorContext value
-
Stage where error occurred
-
Description and suggestions
-
-
-
-
-
1
-
Unknown
-
-
-
-
2
-
Populating account
-
Unable to retrieve account details using the username and password you provided.
-
-
For Azure AD accounts, ensure that UserPrincipalName and Password are valid.
-
For AD accounts, ensure that DomainName, UserName, and Password are valid.
-
Ensure that the specified account has an Exchange server mailbox.
-
-
-
-
3
-
Populating Exchange server address
-
Unable to auto-discover your Exchange server address. Try to manually specify the Exchange server address using the ExchangeServer field.
-
-
-
4
-
Validating Exchange server address
-
Unable to validate the Exchange server address. Ensure that the ExchangeServer field is valid.
-
-
-
5
-
Saving account information
-
Unable to save account details to the system.
-
-
-
6
-
Validating EAS policies
-
The device account uses an unsupported EAS policy. Make sure the EAS policy is configured correctly according to the admin guide.
-
-
-
-
-
The data type is integer. Supported operation is Get.
+If there is an error calling ValidateAndCommit, there is additional context for that error in this node. Here are the possible error values:
+
+| ErrorContext value | Stage where error occurred | Description and suggestions |
+| --- | --- | --- |
+| 1 | Unknown | |
+| 2 | Populating account | Unable to retrieve account details using the username and password you provided.
-For Azure AD accounts, ensure that UserPrincipalName and Password are valid. -For AD accounts, ensure that DomainName, UserName, and Password are valid. -Ensure that the specified account has an Exchange server mailbox. |
+| 3 | Populating Exchange server address | Unable to auto-discover your Exchange server address. Try to manually specify the Exchange server address using the ExchangeServer field. |
+| 4 | Validating Exchange server address | Unable to validate the Exchange server address. Ensure that the ExchangeServer field is valid. |
+| 5 | Saving account information | Unable to save account details to the system. |
+| 6 | Validating EAS policies | The device account uses an unsupported EAS policy. Make sure the EAS policy is configured correctly according to the admin guide. |
+
+The data type is integer. Supported operation is Get.
**MaintenanceHoursSimple/Hours**
+
Wireless channel to use for Miracast operation. The supported channels are defined by the Wi-Fi Alliance Wi-Fi Direct specification.
-
-
-
-
-
-
-
-
Works with all Miracast senders in all regions
-
1, 3, 4, 5, 6, 7, 8, 9, 10, 11
-
-
-
Works with all 5ghz band Miracast senders in all regions
-
36, 40, 44, 48
-
-
-
Works with all 5ghz band Miracast senders in all regions except Japan
-
149, 153, 157, 161, 165
-
-
-
+|Compatibility|Values|
+|--- |--- |
+|Works with all Miracast senders in all regions|1, 3, 4, 5, 6, 7, 8, 9, 10, 11|
+|Works with all 5ghz band Miracast senders in all regions|36, 40, 44, 48|
+|Works with all 5ghz band Miracast senders in all regions except Japan|149, 153, 157, 161, 165|
The default value is 255. Outside of regulatory concerns, if the channel is configured incorrectly the driver will either not boot, or will broadcast on the wrong channel (which senders won't be looking for).
@@ -397,50 +341,19 @@ SurfaceHub