Merge branch 'main' into WDAC-Docs

windows/deployment/do/TOC.yml

@@ -61,8 +61,10 @@
           href: mcc-ent-uninstall-cache-node.md     
       - name: Resources
         items:
-        - name: Frequent Asked Questions
+        - name: Frequently Asked Questions
           href: mcc-ent-faq.yml
+        - name: Connected Cache secure content delivery
+          href: mcc-ent-secure-content-delivery.md
         - name: Troubleshooting
           href: mcc-ent-troubleshooting.md
         - name: Microsoft Connected Cache for Enterprise and Education early preview

windows/deployment/do/mcc-ent-create-resource-and-cache.md

@@ -11,7 +11,7 @@ appliesto:
 - ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
 - ✅ Supported Linux distributions
 - ✅ <a href=https://learn.microsoft.com/windows/deployment/do/waas-microsoft-connected-cache target=_blank>Microsoft Connected Cache for Enterprise</a>	
-ms.date: 10/30/2024
+ms.date: 03/19/2025
 ---
 
 # Create Microsoft Connected Cache Azure resource and cache nodes
@@ -20,7 +20,7 @@ This article outlines how to create and configure your Microsoft Connected Cache
 
 ## Prerequisites
 
-1. **Azure Pay-As-You-Go subscription**: Microsoft Connected Cache is a free-of-charge service hosted in Azure. You'll need a pay-as-you-go Azure subscription in order to onboard to our service. To create a subscription, go to [pay-as-you-go subscription page](https://azure.microsoft.com/offers/ms-azr-0003p/).
+1. **Azure Pay-As-You-Go subscription**: Microsoft Connected Cache is a free-of-charge service hosted in Azure. You need a pay-as-you-go Azure subscription in order to onboard to our service. To create a subscription, go to [pay-as-you-go subscription page](https://azure.microsoft.com/offers/ms-azr-0003p/).
 2. **Hardware to host Connected Cache**: The recommended configuration serves approximately 35,000 managed devices, downloading a 2-GB payload in 24-hour timeframe at a sustained rate of 6.5 Gbps.
 
 For more information on sizing and OS requirements, see [the prerequisites for using Connected Cache](mcc-ent-prerequisites.md).
@@ -28,6 +28,9 @@ For more information on sizing and OS requirements, see [the prerequisites for u
 
 ## Create Connected Cache Azure resource
 
+> [!Note]
+> Resource move isn't currently supported for Connected Cache Azure resources. If you need to move your Connected Cache Azure resource, you can consider deleting the existing resource and creating another one in a different location.
+
 # [Azure portal](#tab/portal)
 
 1. In the [Azure portal](https://portal.azure.com), select **Create a Resource** and search for `Microsoft Connected Cache for Enterprise and Education`.
@@ -56,7 +59,7 @@ For more information on sizing and OS requirements, see [the prerequisites for u
 
     * Run [az version](/cli/azure/reference-index#az-version) to find the version and dependent libraries that are installed. To upgrade to the latest version, run [az upgrade](/cli/azure/reference-index#az-upgrade).
 
-    * Install Azure CLI extension **mcc** by following the instructions [here](/cli/azure/azure-cli-extensions-overview#how-to-install-extensions).
+    * Install Azure CLI extension `mcc` by following the instructions [here](/cli/azure/azure-cli-extensions-overview#how-to-install-extensions). 
 
     * Resource group under which a Connected Cache resource can be created. Use the [az group create](/cli/azure/group#az-group-create) command to create a new Resource group if you don't already have one.
 
@@ -80,7 +83,7 @@ az mcc ent resource create --mcc-resource-name <mymccresource> --resource-group
   1. Open Azure portal and navigate to the Microsoft Connected Cache for Enterprise resource that you created.<br>
   1. Under Cache Node Management, select **Cache Nodes** then **Create Cache Node**.<br>
   
-  1. Provide a name for your cache node and select the host OS you plan to deploy the cache node on, then select **Create**. Note, cache node names have to be unique under the Microsoft Connected Cache resource.
+  1. Provide a name for your cache node and select the host OS you plan to deploy the cache node on, then select **Create**. Note that cache node names have to be unique under the Microsoft Connected Cache resource.
   <!--
     :::image type="content" source="images/mcc-isp-provision-cache-node-numbered.png" alt-text="Screenshot of the Azure portal depicting the cache node configuration page of a cache node. This screenshot shows all of the fields you can choose to configure the cache node." lightbox="./images/mcc-isp-provision-cache-node-numbered.png":::  
     -->
@@ -111,7 +114,7 @@ az mcc ent node create --cache-node-name <mycachenode> --mcc-resource-name <mymc
 >```azurecli-interactive
 >az mcc ent node show --cache-node-name <mycachenode> --mcc-resource-name <mymccresource> --resource-group <myrg>  
 >```
->In the output look for **cacheNodeState**. If ***cacheNodeState = Not Configured***, you can continue with cache node configuration.
+>In the output, look for **cacheNodeState**. If ***cacheNodeState = Not Configured***, you can continue with cache node configuration.
 >If ***cacheNodeState = Registration in Progress***, then the cache node is still in process of being created. Wait a couple of minutes and run the command again.
 >To know more about different cache node state, see [Cache node states](#cache-node-states).
 
@@ -138,7 +141,7 @@ Replace the following placeholders with your own information:
 * *\<size-in-gb>*: The size of cache drive. Must be at least 50 Gb.
 * *\<proxy>*: If proxy needs to be enabled or not.<br>
   Accepted values: `enabled`, `disabled`<br>
-  Proxy should be set to enabled if the cache node will need to pass through a network proxy to download content. The provided proxy will also be used during deployment of the Connected Cache cache node to your host machine.
+  Proxy should be set to enabled if the cache node needs to pass through a network proxy to download content. The provided proxy will also be used during deployment of the Connected Cache cache node to your host machine.
 * *\<proxy-host>*: The proxy host name or ip address. Required if proxy is set to enabled.
 * *\<proxy-port>*: Proxy port number. Required if proxy is set to enabled.
 * *\<auto-update-ring>*: Update ring the cache node should have.<br>
@@ -171,7 +174,7 @@ Replace the following placeholders with your own information:
 * *\<size-in-gb>*: The size of cache drive. Must be at least 50 Gb.
 * *\<proxy>*: If proxy needs to be enabled or not.<br>
   Accepted values: `enabled`, `disabled`<br>
-  Proxy should be set to enabled if the cache node will need to pass through a network proxy to download content. The provided proxy will also be used during deployment of the Connected Cache cache node to your host machine.
+  Proxy should be set to enabled if the cache node needs to pass through a network proxy to download content. The provided proxy will also be used during deployment of the Connected Cache cache node to your host machine.
 * *\<proxy-host>*: The proxy host name or ip address. Required if proxy is set to enabled.
 * *\<proxy-port>*: Proxy port number. Required if proxy is set to enabled.
 * *\<auto-update-ring>*: Update ring the cache node should have.<br>
@@ -215,7 +218,7 @@ To deploy cache nodes using Azure CLI, see
 
 | Field Name |Expected Value |Description|
 |---|---|---|
-|**Cache node name** | Alphanumeric string that contains no spaces| The name of the cache node. You may choose names based on location such as "Seattle-1". This name must be unique and can't be changed later |
+|**Cache node name** | Alphanumeric string that contains no spaces| The name of the cache node. You can choose names based on location such as "Seattle-1". This name must be unique and can't be changed later. |
 |**Host OS** | Linux or Windows| This is the operating system of the host machine that the cache node will be deployed to.|
 
 ### Storage fields
@@ -240,12 +243,12 @@ To deploy cache nodes using Azure CLI, see
 
 #### Proxy settings
 <br>
-You can choose to enable or disable proxy settings on your cache node. Proxy should be set to enabled if the cache node will need to pass through a network proxy to download content. The provided proxy will also be used during deployment of the Connected Cache node to your host machine.
+You can choose to enable or disable proxy settings on your cache node. Proxy should be set to enabled if the cache node needs to pass through a network proxy to download content. The provided proxy will also be used during deployment of the Connected Cache node to your host machine.
 
 <br>
 
 >[!IMPORTANT]
->Enabling or disabling the proxy settings after your cache node has been deployed will require running the provisioning script on the host machine again. This will ensure that proxy changes are in effect on the cache node. 
+>Enabling or disabling the proxy settings after your cache node has been deployed will require running the provisioning script on the host machine again. This ensures that proxy changes are in effect on the cache node. 
 
 | Field Name	|Expected Value	 |Description|
 |---|---|---|

windows/deployment/do/mcc-ent-monitoring.md

@@ -11,7 +11,7 @@ appliesto:
 - ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
 - ✅ Supported Linux distributions
 - ✅ <a href=https://learn.microsoft.com/windows/deployment/do/waas-microsoft-connected-cache target=_blank>Microsoft Connected Cache for Enterprise</a>	
-ms.date: 10/30/2024
+ms.date: 03/19/2025
 ---
 
 # Monitor cache node usage
@@ -30,7 +30,7 @@ Using the two monitoring sections, you can gather essential insights into the he
 
 Below are the metrics found in the **Cache Node Summary** dashboard, along with their descriptions. This dashboard only reflects data received from cache nodes in the last 24 hours.
 
-![Screenshot of cache node summary in the Azure portal interface.](../images/mcc-ent-cache-node-summary.png)
+![Screenshot of cache node summary in the Azure portal interface.](images/mcc-ent-cache-node-summary.png)
 
 | Metric | Description |
 | --- | --- |
@@ -46,7 +46,7 @@ Below are the metrics found in the **Cache Node Summary** dashboard, along with
 
 The two predefined charts on the Overview page visually represent the egress and types of content served by your Connected Cache node. The filters that are displayed below the cache node summary dashboard only affect the data shown in the key metric charts.
 
-![Screenshot of key metric charts in the Azure portal interface.](../images/mcc-ent-key-metric-charts.png)
+![Screenshot of key metric charts in the Azure portal interface.](images/mcc-ent-key-metric-charts.png)
 
 #### Filters
 
@@ -67,9 +67,9 @@ The content types displayed in the chart each have a distinct color and are sort
 
 ### Cache node details
 
-The **Cache Nodes** section under the **Cache Node Management** tab displays cache node information such as Status, Host machine OS, Software Version, and Cache Node ID.
+The **Cache Nodes** section under the **Cache Node Management** tab displays cache node information such as status, host machine OS, software version, and cache node ID.
 
-![Screenshot of cache node details in the Azure portal interface.](../images/mcc-ent-cache-node-details.png)
+![Screenshot of cache node details in the Azure portal interface.](images/mcc-ent-cache-node-details.png)
 
 | Metric | Description |
 | --- | --- |

windows/deployment/do/mcc-ent-secure-content-delivery.md

@@ -0,0 +1,91 @@
+---
+title: Microsoft Connected Cache for Enterprise and Education Secure Content Delivery
+description: Details on how Microsoft Connected Cache for Enterprise and Education securely delivers content to requesting Delivery Optimization clients.
+ms.service: windows-client
+ms.subservice: itpro-updates
+ms.topic: article
+author: chrisjlin
+ms.author: lichris
+manager: naengler
+ms.reviewer: mstewart
+ms.collection:
+  - tier3
+ms.localizationpriority: medium
+appliesto:
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
+- ✅ Supported Linux distributions
+- ✅ <a href=https://learn.microsoft.com/windows/deployment/do/waas-microsoft-connected-cache target=_blank>Microsoft Connected Cache for Enterprise</a>	
+- ✅ <a href=https://learn.microsoft.com/windows/deployment/do/waas-delivery-optimization target=_blank>Delivery Optimization</a>
+ms.date: 03/19/2025
+---
+
+# Microsoft Connected Cache for Enterprise and Education Secure Content Delivery
+
+This article describes how Connected Cache nodes facilitate secure delivery of Microsoft content between Microsoft/CDN endpoints and Delivery Optimization clients.
+
+## How Connected Cache nodes facilitate secure content delivery
+
+Connected Cache nodes act as transparent content caches, meaning any device can request Microsoft content from a Connected Cache node without needing to provide authentication of identity. This allows for efficient discovery and connectivity between devices and Connected Cache nodes on the same network.
+
+Connected Cache nodes only download and store Microsoft content from provisioned Microsoft and Content Delivery Network (CDN) endpoints, so there are no concerns about the cache storing personal or sensitive data.
+
+Connected Cache works in tandem with the [Delivery Optimization (DO) client](waas-delivery-optimization.md), a component of Windows that manages the downloading of Microsoft content. Regardless of download source, the DO client on each Windows device verifies the authenticity and integrity of downloaded content using its metadata hash and content hash. In addition, the downloaded content's signature is verified before it's installed. This process ensures that the Windows device is protected against man-in-the-middle attacks that attempt to tamper with content while it's in transit.
+
+![Diagram of content delivery between CDN, cache node, and DO client](images/mcc-ent-secure-content-delivery-diagram.png)
+
+As shown in the diagram, Connected Cache nodes currently utilize HTTP to communicate with CDN endpoints and Delivery Optimization clients. There's work planned to support HTTPS communication between CDN endpoints, Connected Cache nodes, and Delivery Optimization clients in the future for content that utilizes HTTPS.
+
+## Security considerations for Connected Cache nodes
+
+The security of each Connected Cache node is dependent on the security of its environment.
+
+In order to securely function as designed, Connected Cache expects the user to take steps to secure the different components of their organization's network and devices.
+
+The following section is intended to provide a high-level overview of some of the security aspects the user should consider and resources for learning more.
+
+### Azure resources
+
+One aspect of security lies with the Azure resources that your Microsoft Connected Cache nodes communicate with. You should ensure that your organization's Azure tenant is using role-based access control (RBAC) to apply policies that enforce least-privilege access to the Azure resources for Connected Cache that you provision. Only trusted individuals should have the ability to perform create, read, update, and delete (CRUD) operations on your organization's Connected Cache Azure resources and cache nodes.
+
+You can learn more about the principles of Azure resource security by referring to the [Azure identity management and access control security best practices](/azure/security/fundamentals/identity-management-best-practices) and the [Microsoft cloud security benchmark (MCSB) documentation for Identity management](/security/benchmark/azure/mcsb-identity-management).
+
+### Local network
+
+Another aspect of security lies with your organization's local network. It's recommended that your organization adopts a Zero Trust approach to network security so that your organizational data is protected even if an attacker breaches your network perimeter.
+
+One best practice is to utilize a firewall on your organization's network. When using a network firewall, you should configure it to allow communication between your Connected Cache nodes and the [Microsoft and CDN endpoints](delivery-optimization-endpoints.md) used to install Connected Cache and download Microsoft content.
+
+You can learn more about the principles of network security by referring to the [Azure best practices for network security](/azure/security/fundamentals/network-best-practices) and the [Microsoft cloud security benchmark (MCSB) documentation for Network security](/security/benchmark/azure/mcsb-network-security).
+
+### Cache node host machine OS
+
+Another aspect of security lies with the operating system (OS) of your Connected Cache node's host machine. Your organization can choose to host Microsoft Connected Cache nodes on a [compatible host OS](mcc-ent-prerequisites.md#cache-node-host-machine-requirements) of your choice.
+
+Regardless of which host OS you choose to use, you should ensure that you perform regular OS updates to keep it up to date.
+
+If you're hosting on Windows, your host machine uses Windows Subsystem for Linux (WSL) to run the Connected Cache container. You should ensure that your deployment of WSL meets the [recommended Enterprise set up for WSL](/windows/wsl/enterprise).
+
+### Organization-managed Windows devices
+
+Another aspect of security lies with the organization-managed Windows devices that request Microsoft content from your Connected Cache nodes. The Windows devices that are connecting to the Connected Cache node should be secured according to your organization's security policy.
+
+## Frequently asked questions
+
+Here are some common questions you might have about the security of Microsoft Connected Cache for Enterprise and Education.
+
+### How often is the Connected Cache container updated?
+
+There might be several Connected Cache container updates per year. These updates may contain new features, bug fixes, and security patches. When a new Common Vulnerability and Exposure (CVE) is identified, Microsoft may release a new container update to address the vulnerability.
+
+For more information about Connected Cache container updates and how to schedule their installation, see [Update Microsoft Connected Cache for Enterprise and Education](mcc-ent-update-cache-node.md).
+
+### What security improvements are included in the latest Connected Cache container update?
+
+You can find a list of security improvements and other fixes in the [Connected Cache release notes](mcc-ent-release-notes.md).
+
+## Related content
+
+- [Understand Windows Update security](/windows/deployment/update/windows-update-security)
+- [Understand the Delivery Optimization secure workflow](delivery-optimization-workflow.md#download-request-workflow)
+- [Understand delivery of Win32 apps via Intune](/troubleshoot/mem/intune/app-management/develop-deliver-working-win32-app-via-intune#the-flow-behind-delivery-of-a-win32-app-to-the-client)
+- [Microsoft Win32 Content Prep Tool](https://github.com/Microsoft/Microsoft-Win32-Content-Prep-Tool)

windows/deployment/do/mcc-ent-troubleshooting.md

@@ -38,7 +38,7 @@ As a temporary workaround, the above error doesn't occur by changing the languag
 
 [Connected Cache Azure resource creation](mcc-ent-create-resource-and-cache.md) can be initiated using either the Azure portal user interface or the Azure CLI command set.
 
-If you're encountering an error during resource creation, check that you have the necessary permissions to create Azure resources under your subscription and have filled out all required fields during the resource creation process.
+If you're encountering an error during resource creation, [check that you have the necessary permissions to create Azure resources under your subscription](/azure/role-based-access-control/check-access) and have filled out all required fields during the resource creation process.
 
 ## Troubleshooting cache node configuration