Merge branch 'master' of https://cpubwin.visualstudio.com/_git/it-client into DHAppLogin

store-for-business/distribute-apps-from-your-private-store.md

@@ -8,7 +8,7 @@ ms.sitesec: library
 ms.pagetype: store
 author: TrudyHa
 ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 3/19/2018
 ---
 
 # Distribute apps using your private store
@@ -47,6 +47,9 @@ Microsoft Store adds the app to **Apps & software**. Click **Manage**, **Apps &
 
 The value under **Private store** for the app will change to pending. It will take approximately thirty-six hours before the app is available in the private store.
 
+>[!Note]
+ > If you are working with a new Line-of-Business (LOB) app, you have to wait for the app to be avilable in **Products & services** before adding it to your private store. For more information, see [Working with line of business apps](working-with-line-of-business-apps.md). 
+
 Employees can claim apps that admins added to the private store by doing the following.
 
 **To claim an app from the private store**
@@ -57,6 +60,7 @@ Employees can claim apps that admins added to the private store by doing the fol
 
 ## Related topics
 - [Manage access to private store](manage-access-to-private-store.md)
+- [Manage private store settings](manage-private-store-settings.md)
 - [Configure access to Microsoft Store](/windows/configuration/stop-employees-from-using-microsoft-store)
 
  

store-for-business/working-with-line-of-business-apps.md

@@ -8,7 +8,7 @@ ms.sitesec: library
 ms.pagetype: store
 author: TrudyHa
 ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 3/19/2018
 ---
 
 # Working with line-of-business apps
@@ -38,8 +38,10 @@ You'll need to set up:
 -   LOB publishers need to have an active developer account. To learn more about account options, see [Ready to sign up](https://go.microsoft.com/fwlink/p/?LinkId=623432).
 -   LOB publishers need to have an app in Microsoft Store, or have an app ready to submit to the Store.
 
-## <a href="" id="add-lob-publisher"></a>Add an LOB publisher (Admin)
+The process and timing look like this:
+![Process showing LOB workflow in Microsoft Store for Business. Includes workflow for MSFB admin, LOB publisher, and Developer](images/lob-workflow.png)
 
+## <a href="" id="add-lob-publisher"></a>Add an LOB publisher (Admin)
 Admins need to invite developer or ISVs to become an LOB publisher.
 
 **To invite a developer to become an LOB publisher**
@@ -47,6 +49,7 @@ Admins need to invite developer or ISVs to become an LOB publisher.
 1.  Sign in to [Microsoft Store for Business](https://businessstore.microsoft.com).
 2.  Click **Manage**, click **Permissions**, and then choose **Line-of-business publishers**.
 3.  On the Line-of business publishers page, click **Invite** to send an email invitation to a developer.
+ 
  >[!Note]
  > This needs to be the email address listed in contact info for the developer account.
   

windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md

@@ -1658,6 +1658,15 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
 <li>Connectivity/AllowPhonePCLinking</li>
 <li>RestrictedGroups/ConfigureGroupMembership</li>
 </ul>
+<p>The following existing policies were updated:</p>
+<ul>
+<li>InternetExplorer/AllowSiteToZoneAssignmentList - updated the description and added an example SyncML</li>
+<li>TextInput/AllowIMENetworkAccess - introduced new suggestion services in Japanese IME in addition to cloud suggestion.</li>
+</ul>
+</td></tr>
+<tr>
+<td style="vertical-align:top">[Policy CSP - Bluetooth](policy-csp-bluetooth.md)</td>
+<td style="vertical-align:top"><p>Added new section [ServicesAllowedList usage guide](policy-csp-bluetooth.md#servicesallowedlist-usage-guide).</p>
 </td></tr>
 </tbody>
 </table>

windows/client-management/mdm/policy-csp-bluetooth.md

@@ -282,7 +282,7 @@ If this policy is not set or it is deleted, the default local radio name is used
 <!--Description-->
 Set a list of allowable services and profiles. String hex formatted array of Bluetooth service UUIDs in canonical format, delimited by semicolons. For example, {782AFCFC-7CAA-436C-8BF0-78CD0FFBD4AF}.
 
-The default value is an empty string.
+The default value is an empty string. For more information, see [ServicesAllowedList usage guide](#servicesallowedlist-usage-guide)
 
 <!--/Description-->
 <!--/Policy-->
@@ -297,6 +297,95 @@ Footnote:
 
 <!--/Policies-->
 
+## ServicesAllowedList usage guide
+
+When the Bluetooth/ServicesAllowedList policy is provisioned, it will only allow pairing and connections of Windows PCs and phones to explicitly define Bluetooth profiles and services. It is an allowed list, enabling admins to still allow custom Bluetooth profiles that are not defined by the Bluetooth Special Interests Group (SIG).
+
+To define which profiles and services are allowed, enter the profile or service Universally Unique Identifiers (UUID) using semicolon delimiter. To get a profile UUID, refer to the [Service Discovery](https://www.bluetooth.com/specifications/assigned-numbers/service-discovery) page on the Bluetooth SIG website. 
+
+These UUIDs all use the same base UUID with the profile identifiers added to the beginning of the base UUID.
+
+Here are some examples:
+
+**Bluetooth Headsets for Voice (HFP)**
+
+BASE_UUID = 0x00000000-0000-1000-8000-00805F9B34FB
+
+|UUID name  |Protocol specification  |UUID  |
+|---------|---------|---------|
+|HFP(Hands Free Profile)     |Hands-Free Profile (HFP) *         |0x111E         |
+
+Footnote: * Used as both Service Class Identifier and Profile Identifier.
+
+Hands Free Profile UUID = base UUID + 0x111E to the beginning = 0000111E-0000-1000-8000-00805F9B34FB
+
+**Allow Audio Headsets only (Voice)**
+
+|Profile  |Reasoning  |UUID  |
+|---------|---------|---------|
+|HFP (Hands Free Profile)     |For voice enabled headsets         |0x111E        |
+|GAP (Generic Access Profile)*     |Generic service used by Bluetooth         |0x1800         |
+|DID (Device ID)*     |Generic service used by Bluetooth         |0x180A         |
+|Scan Parameters*     |Generic service used by Bluetooth         |0x1813         |
+
+Footnote: * *GAP, DID, and Scan Parameter are required, as these are underlying profiles and services used by all Bluetooth devices.
+
+This means that if you only want Bluetooth headsets, the UUIDs are:
+
+{0000111E-0000-1000-8000-00805F9B34FB};{00001800-0000-1000-8000-00805F9B34FB};{0000180A-0000-1000-8000-00805F9B34FB};{00001813-0000-1000-8000-00805F9B34FB}
+
+**Allow Audio Headsets and Speakers (Voice & Music)**
+
+|Profile  |Reasoning  |UUID  |
+|---------|---------|---------|
+|HFP (Hands Free Profile)     |For voice enabled headsets         |0x111E         |
+|A2DP Source (Advance Audio Distribution)|For streaming to Bluetooth speakers         |0x110A         |
+|GAP (Generic Access Profile)     |Generic service used by Bluetooth         |0x1800         |
+|Device ID (DID)     |Generic service used by Bluetooth         |0x180A         |
+|Scan Parameters     |Generic service used by Bluetooth         |0x1813         |
+
+{0000111E-0000-1000-8000-00805F9B34FB};{0000110A-0000-1000-8000-00805F9B34FB};{00001800-0000-1000-8000-00805F9B34FB};{0000180A-0000-1000-8000-00805F9B34FB};{00001813-0000-1000-8000-00805F9B34FB}
+
+**Classic Keyboards and Mice**
+
+|Profile  |Reasoning  |UUID  |
+|---------|---------|---------|
+|HID (Human Interface Device)     |For classic BR/EDR keyboards and mice         |0x1124         |
+|GAP (Generic Access Profile)     |Generic service used by Bluetooth         |0x1800         |
+|DID (Device ID)     |Generic service used by Bluetooth         |0x180A         |
+|Scan Parameters     |Generic service used by Bluetooth         |0x1813         |
+
+{00001801-0000-1000-8000-00805F9B34FB};{00001812-0000-1000-8000-00805F9B34FB};{00001800-0000-1000-8000-00805F9B34FB};{0000180A-0000-1000-8000-00805F9B34FB};{00001813-0000-1000-8000-00805F9B34FB}
+
+> [!Note]  
+> For both Classic and LE use a super set of the two formula’s UUIDs
+
+**LE Keyboards and Mice**  
+
+|Profile  |Reasoning  |UUID  |
+|---------|---------|---------|
+|Generic Access Atribute     |For the LE Protocol         |0x1801         |
+|HID Over GATT *     |For LE keyboards and mice         |0x1812         |
+|GAP (Generic Access Profile)     |Generic service used by Bluetooth         |0x1800         |
+|DID (Device ID)     |Generic service used by Bluetooth         |0x180A         |
+|Scan Parameters     |Generic service used by Bluetooth         |0x1813         |
+
+Footnote: * The Surface pen uses the HID over GATT profile
+
+{00001801-0000-1000-8000-00805F9B34FB};{00001812-0000-1000-8000-00805F9B34FB};{00001800-0000-1000-8000-00805F9B34FB};{0000180A-0000-1000-8000-00805F9B34FB};{00001813-0000-1000-8000-00805F9B34FB}
+
+**Allow File Transfer**
+
+|Profile  |Reasoning  |UUID  |
+|---------|---------|---------|
+|OBEX Object Push (OPP)     |For file transfer         |0x1105         |
+|Object Exchange (OBEX)     |Protocol for file transfer         |0x0008         |
+|Generic Access Profile (GAP)     |Generic service used by Bluetooth         |0x1800         |
+|Device ID (DID)     |Generic service used by Bluetooth         |0x180A         |
+|Scan Parameters     |Generic service used by Bluetooth         |0x1813         |
+
+{00001105-0000-1000-8000-00805F9B34FB};{00000008-0000-1000-8000-00805F9B34FB};{0000111E-0000-1000-8000-00805F9B34FB};{00001800-0000-1000-8000-00805F9B34FB};{0000180A-0000-1000-8000-00805F9B34FB};{00001813-0000-1000-8000-00805F9B34FB}
+
 <!--StartHoloLens-->
 ## <a href="" id="hololenspolicies"></a>Bluetooth policies supported by Windows Holographic for Business  
 

windows/client-management/mdm/policy-csp-internetexplorer.md

@@ -2129,6 +2129,11 @@ Value - A number indicating the zone with which this site should be associated f
 
 If you disable or do not configure this policy, users may choose their own site-to-zone assignments.
 
+> [!Note]  
+> This policy is a list that contains the site and index value.
+
+The list is a set of pairs of strings. Each string is seperated by F000. Each pair of string are stored as a registry name and value.  The registry name is the site and the value is an index. The index has to be sequential. See an example below.
+
 <!--/Description-->
 > [!TIP]
 > This is an ADMX-backed policy and requires a special SyncML format to enable or disable.  For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -2145,6 +2150,31 @@ ADMX Info:
 -   GP ADMX file name: *inetres.admx*
 
 <!--/ADMXBacked-->
+<!--Example-->
+```syntax
+  <SyncBody>
+      <Replace>
+          <CmdID>2</CmdID>
+           <Item>
+               <Meta>
+                  <Format>chr</Format>
+                  <Type>text/plain</Type>
+              </Meta>
+              <Target>
+                  <LocURI>./Device/Vendor/MSFT/Policy/Config/InternetExplorer/AllowSiteToZoneAssignmentList</LocURI>
+              </Target>
+               <Data>&lt;Enabled/&gt;&lt;Data id=&quot;IZ_ZonemapPrompt&quot; value=&quot;http://adfs.contoso.org&#xF000;1&#xF000;http://microsoft.com&#xF000;2&quot;/&gt;</Data>
+          </Item>
+      </Replace>
+      <Final/>
+  </SyncBody>
+```
+
+Value and index pairs in the SyncML example:  
+- http://adfs.contoso.org 1
+- http://microsoft.com 2
+
+<!--/Example-->
 <!--/Policy-->
 
 <hr/>

windows/client-management/mdm/policy-csp-textinput.md

@@ -54,6 +54,9 @@ ms.date: 03/12/2018
   <dd>
     <a href="#textinput-allowlanguagefeaturesuninstall">TextInput/AllowLanguageFeaturesUninstall</a>
   </dd>
+  <dd>
+    <a href="#textinput-allowlinguisticdatacollection">TextInput/AllowLinguisticDataCollection</a>
+  </dd>
   <dd>
     <a href="#textinput-enabletouchkeyboardautoinvokeindesktopmode">TextInput/EnableTouchKeyboardAutoInvokeInDesktopMode</a>
   </dd>
@@ -218,7 +221,7 @@ The following list shows the supported values:
 <tr>
 	<td><img src="images/crossmark.png" alt="cross mark" /></td>
 	<td><img src="images/checkmark.png" alt="check mark" /></td>
-	<td></td>
+	<td><img src="images/checkmark.png" alt="check mark" /></td>
 	<td><img src="images/checkmark.png" alt="check mark" /></td>
 	<td><img src="images/checkmark.png" alt="check mark" /></td>
 	<td><img src="images/crossmark.png" alt="cross mark" /></td>
@@ -237,20 +240,18 @@ The following list shows the supported values:
 
 <!--/Scope-->
 <!--Description-->
-> [!NOTE]
-> The policy is only enforced in Windows 10 for desktop.
-
-
 Allows the user to turn on Open Extended Dictionary, Internet search integration, or cloud candidate features to provide input suggestions that do not exist in the device's local dictionary.
 
 Most restricted value is 0.
 
+In Windows 10, version 1803, we introduced new suggestion services in Japanese IME in addition to cloud suggestion. When AllowIMENetworkAccess is set to 1, all suggestion services are available as predictive input.
+
 <!--/Description-->
 <!--SupportedValues-->
 The following list shows the supported values:
 
 -   0 – Not allowed.
--   1 (default) – Allowed.
+-   1 (default) – Allowed. In Windows 10, version 1803, suggestion services are also available in Japanese IME.
 
 <!--/SupportedValues-->
 <!--/Policy-->
@@ -676,6 +677,65 @@ The following list shows the supported values:
 
 <hr/>
 
+<!--Policy-->
+<a href="" id="textinput-allowlinguisticdatacollection"></a>**TextInput/AllowLinguisticDataCollection**  
+
+<!--SupportedSKUs-->
+<table>
+<tr>
+	<th>Home</th>
+	<th>Pro</th>
+	<th>Business</th>
+	<th>Enterprise</th>
+	<th>Education</th>
+	<th>Mobile</th>
+	<th>Mobile Enterprise</th>
+</tr>
+<tr>
+	<td></td>
+	<td></td>
+	<td></td>
+	<td></td>
+	<td></td>
+	<td></td>
+	<td></td>
+</tr>
+</table>
+
+<!--/SupportedSKUs-->
+<!--Scope-->
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+<hr/>
+
+<!--/Scope-->
+<!--Description-->
+
+<!--/Description-->
+<!--ADMXMapped-->
+ADMX Info:  
+-   GP name: *AllowLinguisticDataCollection*
+-   GP ADMX file name: *TextInput.admx*
+
+<!--/ADMXMapped-->
+<!--SupportedValues-->
+This setting supports a range of values between 0 and 1.
+
+
+<!--/SupportedValues-->
+<!--Example-->
+
+<!--/Example-->
+<!--Validation-->
+
+<!--/Validation-->
+<!--/Policy-->
+
+<hr/>
+
 <!--Policy-->
 <a href="" id="textinput-enabletouchkeyboardautoinvokeindesktopmode"></a>**TextInput/EnableTouchKeyboardAutoInvokeInDesktopMode**  
 

windows/deployment/update/device-health-get-started.md

@@ -5,7 +5,7 @@ keywords: Device Health, oms, operations management suite, prerequisites, requir
 ms.prod: w10
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.date: 03/15/2018
+ms.date: 03/20/2018
 ms.pagetype: deploy
 author: jaimeo
 ---
@@ -72,7 +72,7 @@ Once you've added Update Compliance to Microsoft Operations Management Suite, yo
 
 ## Use Device Health to monitor frequency and causes of device crashes
 
-Once your devices are enrolled, you can move on to [Use Device Health](device-health-using.md).
+Once your devices are enrolled, you can move on to [Using Device Health](device-health-using.md).
 
 
 ## Related topics

windows/deployment/update/windows-analytics-FAQ-troubleshooting.md

@@ -8,7 +8,7 @@ ms.sitesec: library
 ms.pagetype: deploy
 author: jaimeo
 ms.author: jaimeo
-ms.date: 03/16/2018
+ms.date: 03/20/2018
 ---
 
 # Frequently asked questions and troubleshooting Windows Analytics
@@ -25,7 +25,7 @@ If you've followed the steps in the [Enrolling devices in Windows Analytics](win
 
 [Upgrade Readiness reports outdated updates](#upgrade-readiness-reports-outdated-updates)
 
-[Upgrade Readiness reports incomplete inventory](#upgrade-readiness-reports-incomplete-inventory)
+[Upgrade Readiness shows many "Computers with outdated KB"](#upgrade-readiness-shows-many-computers-with-outdated-kb)
 
 [Upgrade Readiness doesn't show app inventory data on some devices](#upgrade-readiness-doesnt-show-app-inventory-data-on-some-devices)
 
@@ -176,9 +176,23 @@ Windows Analytics is fully committed to privacy, centering on these tenets:
 - **Security:** Your data is protected with strong security and encryption
 - **Trust:** Windows Analytics supports the Microsoft Online Service Terms
 
+The following illustration shows how diagnostic data flows from individual devices through the Diagnostic Data Service, Azure Log Analytics storage, and to your Log Analytics workspace:
+
+[![Diagram illustrating flow of diagnostic data from devices](images/WA-data-flow-v1.png)](images/WA-data-flow-v1.png)
+
+The data flow sequence is as follows:
+
+1.	Diagnostic data is sent from devices to the Microsoft Diagnostic Data Management service, which is hosted in the US.
+2.	An IT administrator creates an Azure Log Analytics workspace. The administrator chooses the location, copies the Commercial ID (which identifies that workspace), and then pushes Commercial ID to devices they want to monitor. This is the mechanism that specifies which devices appear in which workspaces.
+3.	Each day Microsoft produces a "snapshot" of IT-focused insights for each workspace in the Diagnostic Data Management service.
+4.	These snapshots are copied to transient storage which is used only by Windows Analytics (also hosted in US data centers) where they are segregated by Commercial ID.
+5.	The snapshots are then copied to the appropriate Azure Log Analytics workspace.
+6.	If the IT administrator is using the Upgrade Readiness solution, user input from the IT administrator (specifically, the target operating system release and the importance and upgrade readiness per app) is stored in the Windows Analytics Azure Storage. (Upgrade Readiness is the only Windows Analytics solution that takes such user input.)
+
+
 See these topics for additional background information about related privacy issues:
 
-- [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windowsconfiguration/configure-windows-diagnostic-data-in-your-organization)
+- [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization)
 - [Windows 7, Windows 8, and Windows 8.1 Appraiser Telemetry Events, and Fields](https://go.microsoft.com/fwlink/?LinkID=822965) (link downloads a PDF file)
 - [Windows 10, version 1703 basic level Windows diagnostic events and fields](https://docs.microsoft.com/windows/configuration/basic-level-windows-diagnostic-events-and-fields-1703)
 - [Windows 10, version 1709 enhanced diagnostic data events and fields used by Windows Analytics](https://docs.microsoft.com/windows/configuration/enhanced-diagnostic-data-windows-analytics-events-and-fields)

windows/deployment/upgrade/upgrade-readiness-get-started.md

@@ -6,7 +6,7 @@ ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.pagetype: deploy
 author: jaimeo
-ms.date: 03/18/2018
+ms.date: 03/20/2018
 ---
 
 # Get started with Upgrade Readiness
@@ -30,7 +30,7 @@ When you are ready to begin using Upgrade Readiness, perform the following steps
 
 ## Data collection and privacy 
 
-To enable system, application, and driver data to be shared with Microsoft, you must configure user computers to send data. For information about what diagnostic data Microsoft collects and how that data is used and protected by Microsoft, see the following topics, refer to [Frequently asked questions and troubleshooting Windows Analytics](https://docs.microsoft.com/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md), which discusses the issues and provides links to still more detailed information.
+To enable system, application, and driver data to be shared with Microsoft, you must configure user computers to send data. For information about what diagnostic data Microsoft collects and how that data is used and protected by Microsoft, see the following topics, refer to [Frequently asked questions and troubleshooting Windows Analytics](https://docs.microsoft.com/windows/deployment/update/windows-analytics-FAQ-troubleshooting), which discusses the issues and provides links to still more detailed information.
 
 ## Add Upgrade Readiness to Operations Management Suite
 
@@ -54,7 +54,7 @@ If you are not using OMS:
 
 ## Enroll devices in Windows Analytics
 
-Once you've added Update Compliance to Microsoft Operations Management Suite, you can now start enrolling the devices in your organization. For full instructions, see [Enrolling devices in Windows Analytics](https://docs.microsoft.com/windows/deployment/update/windows-analytics-get-started.md).
+Once you've added Update Compliance to Microsoft Operations Management Suite, you can now start enrolling the devices in your organization. For full instructions, see [Enrolling devices in Windows Analytics](https://docs.microsoft.com/windows/deployment/update/windows-analytics-get-started).