Merge branch 'master' into tmv-secure-score-for-devices

devices/hololens/TOC.md

@@ -65,7 +65,6 @@
 ## [Frequently asked security questions](hololens-faq-security.md)
 ## [Status of the HoloLens services](hololens-status.md)
 ## [Get support](https://support.microsoft.com/supportforbusiness/productselection?sapid=3ec35c62-022f-466b-3a1e-dbbb7b9a55fb)
-## [SCEP whitepaper](scep-whitepaper.md)
 
 # [HoloLens release notes](hololens-release-notes.md)
 # [Give us feedback](hololens-feedback.md)

devices/hololens/hololens-cortana.md

@@ -30,7 +30,7 @@ This article teaches you how to control HoloLens and your holographic world with
 
 ## Built-in voice commands
 
-Get around HoloLens faster with these basic commands. In order to use these you need to enable Speech during first run of the device or in **Settings** > **Privacy** > **Speech**. You can always check whether speech is enabled by looking at the status at the top of Start menu.
+Get around HoloLens faster with these basic commands. In order to use these, you need to enable Speech during the first run of the device or in **Settings** > **Privacy** > **Speech**. You can always check whether speech is enabled by looking at the status at the top of the Start menu. For the best speech recognition results, HoloLens 2 uses the Microsoft cloud-based services. However, you can use Settings to disable this feature. To do this, in Settings, turn off **Online speech recognition**. After you change this setting, HoloLens 2 will only process voice data locally to recognize commands and dictation, and Cortana will not be available.
 
 ### General speech commands
 

devices/hololens/hololens-faq-security.md

@@ -73,8 +73,6 @@ appliesto:
 1. **When a PKI cert is being generated for trusted communication, we want the cert to be generated on the device so that we know it's only on that device, unique to that device, and can't be exported or used to impersonate the device. Is this true on HoloLens? If not is there a potential mitigation?**
     1. CSR for SCEP is generated on the device itself. Intune and the on premise SCEP connector help secure the requests themselves by adding and verifying a challenge string that's sent to the client.
     1. Since HoloLens (1st Gen and 2nd Gen) have a TPM module, these certs would be stored in the TPM module, and are unable to be extracted. Additionally, even if it could be extracted, the challenge strings couldn't be verified on a different device, rendering the certs/key unusable on different devices.
-1. **SCEP is vulnerable. How does Microsoft mitigate the known vulnerabilities of SCEP?**
-    1. This [SCEP Whitepaper](scep-whitepaper.md) addresses how Microsoft mitigates SCEP vulnerabilities.
 
 ## HoloLens 2nd Gen Security Questions
 
@@ -125,5 +123,3 @@ appliesto:
 1. **When a PKI cert is being generated for trusted communication, we want the cert to be generated on the device so that we know it's only on that device, unique to that device, and can't be exported or used to impersonate the device. Is this true on HoloLens? If not is there a potential mitigation?**
     1. CSR for SCEP is generated on the device itself. Intune and the on premise SCEP connector help secure the requests themselves by adding and verifying a challenge string that's sent to the client.
     1. Since HoloLens (1st Gen and 2nd Gen) have a TPM module, these certs would be stored in the TPM module, and are unable to be extracted. Additionally, even if it could be extracted, the challenge strings couldn't be verified on a different device, rendering the certs/key unusable on different devices.
-1. **SCEP is vulnerable. How does Microsoft mitigate the known vulnerabilities of SCEP?**
-    1. This [SCEP Whitepaper](scep-whitepaper.md) addresses how Microsoft mitigates SCEP vulnerabilities.

devices/hololens/scep-whitepaper.md

@@ -1,80 +0,0 @@
----
-title: SCEP Whitepaper
-description: A whitepaper that describes how Microsoft mitigates the vulnerabilities of SCEP.
-ms.assetid: bd55ecd1-697a-4b09-8274-48d1499fcb0b
-author: pawinfie
-ms.author: pawinfie
-ms.date: 02/12/2020
-keywords: hololens, Windows Mixed Reality, security
-ms.prod: hololens
-ms.sitesec: library
-ms.topic: article
-audience: ITPro
-ms.localizationpriority: high
-ms.custom: 
-- CI 111456
-- CSSTroubleshooting
-appliesto:
-- HoloLens 1 (1st gen)
-- HoloLens 2
----
-
-# SCEP whitepaper
-
-## High Level
-
-### How the SCEP Challenge PW is secured
-
-We work around the weakness of the SCEP protocol by generating custom challenges in Intune itself. The challenge string we create is signed/encrypted, and contains the information we've configured in Intune for certificate issuance into the challenge blob. This means the blob used as the challenge string contains the expected CSR information like the Subject Name, Subject Alternative Name, and other attributes.
-
-We then pass that to the device and then the device generates it's CSR and passes it, and the blob to the SCEP URL it received in the MDM profile. On NDES servers running the Intune SCEP module we perform a custom challenge validation that validates the signature on the blob, decrypts the challenge blob itself, compare it to the CSR received, and then determine if we should issue the cert.  If any portion of this check fails then the certificate request is rejected.
-
-## Behind the scenes
-
-### Intune Connector has a number of responsibilities
-
-1. The connector is SCEP policy module which contains a "Certification Registration Point" component which interacts with the Intune service, and is responsible for validating, and securing the SCEP request coming into the NDES server.
-
-1. The connector will install an App Pool on the NDES IIS server > Microsoft Intune CRP service Pool, and a CertificateRegistrationSvc under the "Default Web Site" on IIS.
-
-1. **When the Intune NDES connector is first configured/setup on the NDES server, a certificate is issued from the Intune cloud service to the NDES server. This cert is used to securely communicate with the Intune cloud service - customer tenant. The cert is unique to the customers NDES server. Can be viewed in Certlm.msc issued by SC_Online_Issuing. This certs Public key is used by Intune in the cloud to encrypt the challenge blob. In addition, when the connector is configured, Intune's public key is sent to the NDES server.**
-    >[!NOTE]
-    >The connector communication with Intune is strictly outbound traffic.
-
-1. The Intune cloud service combined with the Intune connector/policy module addresses the SCEP protocol challenge password weakness (in the SCEP protocol) by generating a custom challenge.  The challenge is generated in Intune itself.
-
-    1. In the challenge blob, Intune puts information that we expect in the cert request (CSR - Certificate Signing Request) coming from a mobile device like the following: what we expect the Subject and SAN (validated against AAD attributes/properties of the user/device) to be, and specifics contained in the Intune SCEP profile that is created by an Intune admin, i.e., Request Handling, EKU, Renewal, validity period, key size, renewal period.
-        >[!NOTE]
-        >The Challenge blob is Encrypted with the Connectors Public Key, and Signed with Intune's (cloud service) Private Key.  The device cannot decrypt the challenge
-
-    1. When an Intune admin creates a SCEP profile in their tenant, Intune will send the SCEP profile payload along with the Encrypted and Signed Challenge to the targeted device. The device generates a CSR, and reaches out to NDES URL (contained in the SCEP profile). The device cert request payload contains the CSR, and the encrypted, signed challenge blob.
-
-        1. When the device reaches out to the NDES server (via the NDES/SCEP URL provided in the SCEP Profile payload), the SCEP cert request validation is performed by the policy module running on the NDES server. The challenge signature is verified using Intune's public key (which is on the NDES server, when the connector was installed and configured) and decrypted using the connectors private key. The policy module compares the CSR details against the decrypted challenge and determines if a cert should be issued. If the CSR passes validation, the NDES server requests a certificate from the CA on behalf of the user/device.
-            >[!NOTE]
-            >The above process takes place on the NDES server running the Policy Module.  No interaction with the Intune cloud service takes place.
-
-    1. The NDES connector notification/reporting of cert delivery takes place after NDES sends the issued cert to the device.  This is performed as a separate operation outside the cert request flow. Meaning that once NDES sends the cert to the device via the AAD app proxy (or other publishing firewall/proxy, a log is written with the cert delivery details on the NDES server by the connector (file location \Program Files\Microsoft Intune\CertificateRequestStatus\Succeed\ folder. The connector will look here, and send updates to Intune.
-
-    1. The mobile device must be enrolled in Intune. If not, we reject the request as well
-
-    1. The Intune connector disables the standard NDES challenge password request URL on the NDES server.
-
-    1. The NDES server SCEP URI in most customer deployments is made available to the internet via Azure App Proxy, or an on-prem reverse proxy, i.e. F5.  
-        >[!NOTE]
-        >The Azure App Proxy is an outbound-only connection over Port 443, from the customers onprem network where the App Proxy connector is running on a server. The AAD app proxy can also be hosted on the NDES server. No inbound ports required when using Azure App Proxy.
-
-        1. The mobile device talks only to the NDES URI
-
-        1. Side note: AAD app proxy's role is to make onprem resources (like NDES and other customer onprem web services) securely available to the internet.
-
-    1. The Intune connector must communicate with the Intune cloud service. The connector communication will not go through the Azure App Proxy. The connector will talk with the Intune cloud service via whatever mechanism a customer has onprem to allow outbound traffic to the internet, i.e. Internal proxy service.
-        >[!NOTE]
-        > if a proxy is used by the customer, no SSL packet inspection can take place for the NDES/Connector server going out.
-
-1. Connector traffic with Intune cloud service consists of the following operations:
-
-    1. 1st time configuration of the connector: Authentication to AAD during the initial connector setup.
-
-    1. Connector checks in with Intune, and will process and any cert revocation transactions (i.e, if the Intune tenant admin issues a remote wipe – full or partial,  also If a user unenrolls their device from Intune), reporting on issued certs, renewing the connectors' SC_Online_Issuing  certificate from Intune.  Also note: the NDES Intune connector has shared PKCS cert functionality (if you decide to issue PKCS/PFX based certs) so the connector checks to Intune for PKCS cert requests even though there won't be any requests to process.  We are splitting that functionality out, so this connector just handles SCEP, but no ETA yet.
-
-1. [Here](https://docs.microsoft.com/intune/intune-endpoints#microsoft-intune-certificate-connector) is a reference for Intune NDES connector network communications.

devices/surface/surface-dock-firmware-update.md

@@ -1,5 +1,5 @@
 ---
-title: Microsoft Surface Dock Firmware Update
+title: Microsoft Surface Dock Firmware Update - Technical information for IT administrators
 description: This article explains how to use Microsoft Surface Dock Firmware Update to update Surface Dock firmware. When installed on your Surface device, it will update any Surface Dock attached to your Surface device.
 ms.localizationpriority: medium
 ms.prod: w10
@@ -12,22 +12,31 @@ ms.reviewer: scottmca
 manager: dansimp
 ms.audience: itpro
 ---
-# Microsoft Surface Dock Firmware Update
+# Microsoft Surface Dock Firmware Update: Technical information for IT administrators
-
-This article explains how to use Microsoft Surface Dock Firmware Update to update Surface Dock firmware. When installed on your Surface device, it will update any Surface Dock attached to your Surface device.
-
-Microsoft Surface Dock Firmware Update supersedes the earlier Microsoft Surface Dock Updater tool, previously available for download as part of Surface Tools for IT. It was named Surface_Dock_Updater_vx.xx.xxx.x.msi (where x indicates the version number). The earlier tool is no longer available for download and should not be used.
 
 > [!IMPORTANT]
->Microsoft periodically releases new versions of Surface Dock Firmware Update. The MSI file is not self-updating. If you have deployed the MSI to Surface devices and a new version of the firmware is released, you will need to deploy the new version.
+> This article contains technical instructions for IT administrators. If you are a home user, please see [How to update your Surface Dock Firmware](https://support.microsoft.com/help/4023478/surface-update-your-surface-dock) on the Microsoft Support site. The instructions at the support site are the same as the general installation steps below, but this article has additional information for monitoring, verifying, and deploying the update to multiple devices on a network.
+
+This article explains how to use Microsoft Surface Dock Firmware Update to update Surface Dock firmware. When installed on your Surface device, it will update any Surface Dock attached to your Surface device. 
+
+This tool supersedes the earlier Microsoft Surface Dock Updater tool, previously available for download as part of Surface Tools for IT. The earlier tool was named Surface_Dock_Updater_vx.xx.xxx.x.msi (where x indicates the version number) and is no longer available for download and should not be used.
+
+## Install the Surface Dock Firmware Update
+
+This section describes how to manually install the firmware update.
+
+> [!NOTE]
+> Microsoft periodically releases new versions of Surface Dock Firmware Update. The MSI file is not self-updating. If you have deployed the MSI to Surface devices and a new version of the firmware is released, you will need to deploy the new version.
+
+1. Download and install [Microsoft Surface Dock Firmware Update](https://www.microsoft.com/download/details.aspx?id=46703).
+    - The update requires a Surface device running Windows 10, version 1803 or later.
+    - Installing the MSI file might prompt you to restart Surface. However, restarting is not required to perform the update.
+
+2. Disconnect your Surface device from the Surface Dock (using the power adapter), wait ~5 seconds, and then reconnect. The Surface Dock Firmware Update will update the dock silently in background. The process can take a few minutes to complete and will continue even if interrupted. 
 
 ## Monitor the Surface Dock Firmware Update
 
-This section is optional and provides an overview of how to monitor installation of the firmware update. When you are ready to install the update, see [Install the Surface Dock Firmware Update](#install-the-surface-dock-firmware-update) below. For more detailed information about monitoring the update process, see the following sections in this article: 
+This section is optional and provides an overview of how to monitor installation of the firmware update. 
-  - [How to verify completion of firmware update](#how-to-verify-completion-of-the-firmware-update)
-  - [Event logging](#event-logging)
-  - [Troubleshooting tips](#troubleshooting-tips)
-  - [Versions reference](#versions-reference)
 
 To monitor the update:
 
@@ -39,7 +48,6 @@ To monitor the update:
     Reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WUDF\Services\SurfaceDockFwUpdate\Parameters"
     ```
 3. Install the update as described in the [next section](#install-the-surface-dock-firmware-update) of this article.
-
 4. Event 2007 with the following text indicates a successful update: **Firmware update finished. hr=0 DriverTelementry EventCode = 2007**. 
     - If the update is not successful, then event ID 2007 will be displayed as an **Error** event rather than **Information**. Additionally, the version reported in the Windows Registry will not be current.
 5. When the update is complete, updated DWORD values will be displayed in the Windows Registry, corresponding to the current version of the tool. See the [Versions reference](#versions-reference) section in this article for details. For example:
@@ -49,15 +57,11 @@ To monitor the update:
 >[!TIP]
 >If you see "The description for Event ID xxxx from source SurfaceDockFwUpdate cannot be found" in event text, this is expected and can be ignored.
 
-## Install the Surface Dock Firmware Update
+Also see the following sections in this article: 
-
+  - [How to verify completion of firmware update](#how-to-verify-completion-of-the-firmware-update)
-This section describes how to install the firmware update.
+  - [Event logging](#event-logging)
-
+  - [Troubleshooting tips](#troubleshooting-tips)
-1. Download and install [Microsoft Surface Dock Firmware Update](https://www.microsoft.com/download/details.aspx?id=46703).
+  - [Versions reference](#versions-reference)
-    - The update requires a Surface device running Windows 10, version 1803 or later.
-    - Installing the MSI file might prompt you to restart Surface. However, restarting is not required to perform the update.
-
-2. Disconnect your Surface device from the Surface Dock (using the power adapter), wait ~5 seconds, and then reconnect. The Surface Dock Firmware Update will update the dock silently in background. The process can take a few minutes to complete and will continue even if interrupted. 
 
 ## Network deployment
 

windows/client-management/mdm/policy-csp-restrictedgroups.md

@@ -7,7 +7,7 @@ ms.prod: w10
 ms.technology: windows
 author: manikadhiman
 ms.localizationpriority: medium
-ms.date: 03/24/2020
+ms.date: 04/07/2020
 
 ms.reviewer: 
 manager: dansimp
@@ -149,6 +149,8 @@ where:
 The member SID can be a user account or a group in AD, Azure AD, or on the local machine. Membership is configured using the [NetLocalGroupSetMembers](https://docs.microsoft.com/windows/win32/api/lmaccess/nf-lmaccess-netlocalgroupsetmembers) API.
 - In this example, `Group1` and `Group2` are local groups on the device being configured.
 
+> [!Note]
+> Currently, the RestrictedGroups/ConfigureGroupMembership policy does not have a MemberOf functionality. However, you can add a local group as a member to another local group by using the member portion, as shown in the above example.
 <!--/Example-->
 <!--Validation-->
 

windows/client-management/mdm/policy-csp-start.md

@@ -1025,6 +1025,7 @@ To validate on Desktop, do the following:
 [Scope](./policy-configuration-service-provider.md#policy-scope):
 
 > [!div class = "checklist"]
+> * User
 > * Device
 
 <hr/>

windows/client-management/mdm/reboot-csp.md

@@ -45,12 +45,16 @@ Setting a null (empty) date will delete the existing schedule. In accordance wit
 
 <p style="margin-left: 20px">The supported operations are Get, Add, Replace, and Delete.</p>
 
+<p style="margin-left: 20px">The supported data type is "String".</p>
+
 <a href="" id="schedule-dailyrecurrent"></a>**Schedule/DailyRecurrent**  
 <p style="margin-left: 20px">This node will execute a reboot each day at a scheduled time starting at the configured starting time and date. Setting a null (empty) date will delete the existing schedule. The date and time value is ISO8601, and both the date and time are required. The CSP will return the date time in the following format: 2018-06-29T10:00:00+01:00.  </br>
 Example to configure: 2018-10-25T18:00:00</p>
 
 <p style="margin-left: 20px">The supported operations are Get, Add, Replace, and Delete.</p>
 
+<p style="margin-left: 20px">The supported data type is "String".</p>
+
 ## Related topics
 
 

windows/client-management/mdm/vpnv2-profile-xsd.md

@@ -175,6 +175,7 @@ Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some pro
             <xs:sequence>
               <xs:element name="Address" type="xs:string" minOccurs="1" maxOccurs="1"/>
               <xs:element name="PrefixSize" type="xs:unsignedByte" minOccurs="1" maxOccurs="1"/>
+              <xs:element name="ExclusionRoute" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
             </xs:sequence>
           </xs:complexType>
         </xs:element>

windows/deployment/update/update-compliance-configuration-script.md

@@ -19,7 +19,7 @@ ms.topic: article
 
 The Update Compliance Configuration Script is the recommended method of configuring devices to send data to Microsoft for use with Update Compliance. The script configures device policies via Group Policy, ensures that required services are running, and more.
 
-You can [**download the script here**](https://github.com/cinglis-msft/UpdateComplianceConfigurationScript). Keep reading to learn how to configure the script and interpret error codes that are output in logs for troubleshooting.
+You can [**download the script here**](https://www.microsoft.com/en-us/download/details.aspx?id=101086). Keep reading to learn how to configure the script and interpret error codes that are output in logs for troubleshooting.
 
 ## How the script is organized
 

windows/deployment/update/update-compliance-monitor.md

@@ -19,9 +19,8 @@ ms.topic: article
 
 > [!IMPORTANT]
 > While [Windows Analytics was retired on January 31, 2020](https://docs.microsoft.com/windows/deployment/update/update-compliance-monitor), support for Update Compliance has continued through the Azure Portal; however, please note the following updates:
->
+> As of March 31, 2020, The Windows Defender Antivirus reporting feature of Update Compliance is no longer supported and will soon be retired. You can continue to review malware definition status and manage and monitor malware attacks with Microsoft Endpoint Manager's [Endpoint Protection for Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune). Configuration Manager customers can monitor Endpoint Protection with [Endpoint Protection in Configuration Manager](https://docs.microsoft.com/configmgr/protect/deploy-use/monitor-endpoint-protection).
-> * On March 31, 2020, the Windows Defender Antivirus reporting feature of Update Compliance was retired. You can continue to review malware definition status and manage and monitor malware attacks with Microsoft Endpoint Manager's [Endpoint Protection for Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune). Configuration Manager customers can monitor Endpoint Protection with [Endpoint Protection in Configuration Manager](https://docs.microsoft.com/configmgr/protect/deploy-use/monitor-endpoint-protection).
+> * As of March 31, 2020, The Perspectives feature of Update Compliance is no longer supported and will soon be retired in favor of a better experience. The Perspectives feature is part of the Log Search portal of Log Analytics, which was deprecated on February 15, 2019 in favor of [Azure Monitor Logs](https://docs.microsoft.com/azure/azure-monitor/log-query/log-search-transition). Your Update Compliance solution will be automatically upgraded to Azure Monitor Logs, and the data available in Perspectives will be migrated to a set of queries in the [Needs Attention section](update-compliance-need-attention.md) of Update Compliance.
-> * The Perspectives feature of Update Compliance was retired on March 31, 2020 in favor of a better experience. The Perspectives feature is part of the Log Search portal of Log Analytics, which was deprecated on February 15, 2019 in favor of [Azure Monitor Logs](https://docs.microsoft.com/azure/azure-monitor/log-query/log-search-transition). Your Update Compliance solution will be automatically upgraded to Azure Monitor Logs, and the data available in Perspectives will be migrated to a set of queries in the [Needs Attention section](update-compliance-need-attention.md) of Update Compliance.
 
 ## Introduction
 

windows/deployment/update/update-compliance-schema-wudostatus.md

@@ -36,7 +36,7 @@ These fields are briefly described in this article, to learn more about Delivery
 |**BytesFromGroupPeers** |[long](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/long) |`523132` |Total number of bytes downloaded from Group Peers. |
 |**BytesFromIntPeers** |[long](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/long) |`328350` |Total number of bytes downloaded from Internet Peers. |
 |**BytesFromPeers** |[long](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/long) |`43145` |Total number of bytes downloaded from peers. |
-|**ContentDownloadMode** |[int](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/int) |`0` |Device's Delivery Optimization [Download Mode](https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization-reference#download-mode)**@JAIME** configuration for this content. |
+|**ContentDownloadMode** |[int](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/int) |`0` |Device's Delivery Optimization [Download Mode](https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization-reference#download-mode) configuration for this content. |
 |**ContentType** |[int](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/int) |`Quality Updates` |The type of content being downloaded. |
 |**DOStatusDescription** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) | |A short description of DO's status, if any. |
 |**DownloadMode** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`HTTP+LAN (1)` |Device's Delivery Optimization [Download Mode](https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization-reference#download-mode) configuration for this device. |

windows/deployment/volume-activation/install-vamt.md

@@ -1,80 +1,80 @@
----
+---
-title: Install VAMT (Windows 10)
+title: Install VAMT (Windows 10)
-description: Install VAMT
+description: Install VAMT
-ms.assetid: 2eabd3e2-0a68-43a5-8189-2947e46482fc
+ms.assetid: 2eabd3e2-0a68-43a5-8189-2947e46482fc
-ms.reviewer: 
+ms.reviewer: 
-manager: laurawi
+manager: laurawi
-ms.author: greglin
+ms.author: greglin
-ms.prod: w10
+ms.prod: w10
-ms.mktglfcycl: deploy
+ms.mktglfcycl: deploy
-ms.sitesec: library
+ms.sitesec: library
-ms.pagetype: activation
+ms.pagetype: activation
-audience: itpro
+audience: itpro
-author: greg-lindsay
+author: greg-lindsay
-ms.localizationpriority: medium
+ms.localizationpriority: medium
-ms.date: 03/11/2019
+ms.date: 03/11/2019
-ms.topic: article
+ms.topic: article
----
+---
-
+
-# Install VAMT
+# Install VAMT
-
+
-This topic describes how to install the Volume Activation Management Tool (VAMT).
+This topic describes how to install the Volume Activation Management Tool (VAMT).
-
+
-## Install VAMT
+## Install VAMT
-
+
-You install VAMT as part of the Windows Assessment and Deployment Kit (ADK) for Windows 10.
+You install VAMT as part of the Windows Assessment and Deployment Kit (ADK) for Windows 10.
-
+
->[!IMPORTANT]
+>[!IMPORTANT]
->VAMT requires local administrator privileges on all managed computers in order to deposit confirmation IDs (CIDs), get the client products’ license status, and install product keys. If VAMT is being used to manage products and product keys on the local host computer and you do not have administrator privileges, start VAMT with elevated privileges. For Active Directory-Based Activation use, for best results we recommend running VAMT while logged on as a domain administrator. 
+>VAMT requires local administrator privileges on all managed computers in order to deposit confirmation IDs (CIDs), get the client products’ license status, and install product keys. If VAMT is being used to manage products and product keys on the local host computer and you do not have administrator privileges, start VAMT with elevated privileges. For Active Directory-Based Activation use, for best results we recommend running VAMT while logged on as a domain administrator. 
-
+
->[!NOTE]
+>[!NOTE]
->The VAMT Microsoft Management Console snap-in ships as an x86 package. 
+>The VAMT Microsoft Management Console snap-in ships as an x86 package. 
-
+
-### Requirements
+### Requirements
-
+
-- [Windows Server with Desktop Experience](https://docs.microsoft.com/windows-server/get-started/getting-started-with-server-with-desktop-experience), with internet access (for the main VAMT console) and all updates applied
+- [Windows Server with Desktop Experience](https://docs.microsoft.com/windows-server/get-started/getting-started-with-server-with-desktop-experience), with internet access (for the main VAMT console) and all updates applied
-- [Windows 10, version 1903 ADK](https://go.microsoft.com/fwlink/?linkid=2086042)
+- [Windows 10, version 1903 ADK](https://go.microsoft.com/fwlink/?linkid=2086042)
-- Any supported [SQL Server Express](https://www.microsoft.com/sql-server/sql-server-editions-express) version, the latest is recommended
+- Any supported [SQL Server Express](https://www.microsoft.com/sql-server/sql-server-editions-express) version, the latest is recommended
-- Alternatively, any supported **full** SQL instance
+- Alternatively, any supported **full** SQL instance
-
+
-### Install SQL Server Express / alternatively use any full SQL instance
+### Install SQL Server Express / alternatively use any full SQL instance
-
+
-1. Download and open the [SQL Server Express](https://www.microsoft.com/sql-server/sql-server-editions-express) package.
+1. Download and open the [SQL Server Express](https://www.microsoft.com/sql-server/sql-server-editions-express) package.
-2. Select **Basic**.
+2. Select **Basic**.
-3. Accept the license terms.
+3. Accept the license terms.
-4. Enter an install location or use the default path, and then select **Install**.
+4. Enter an install location or use the default path, and then select **Install**.
-5. On the completion page, note the instance name for your installation, select **Close**, and then select **Yes**. 
+5. On the completion page, note the instance name for your installation, select **Close**, and then select **Yes**. 
-
+
-    ![In this example, the instance name is SQLEXPRESS01](images/sql-instance.png)
+    ![In this example, the instance name is SQLEXPRESS01](images/sql-instance.png)
-
+
-### Install VAMT using the ADK
+### Install VAMT using the ADK
-
+
-1. Download and open the [Windows 10, version 1903 ADK](https://go.microsoft.com/fwlink/?linkid=2086042) package.
+1. Download and open the [Windows 10, version 1903 ADK](https://go.microsoft.com/fwlink/?linkid=2086042) package.
-Reminder: There won't be new ADK release for 1909.
+Reminder: There won't be new ADK release for 1909.
-2. Enter an install location or use the default path, and then select **Next**.
+2. Enter an install location or use the default path, and then select **Next**.
-3. Select a privacy setting, and then select **Next**.
+3. Select a privacy setting, and then select **Next**.
-4. Accept the license terms.
+4. Accept the license terms.
-5. On the **Select the features you want to install** page, select **Volume Activation Management Tool (VAMT)**, and then select **Install**. (You can select additional features to install as well.)
+5. On the **Select the features you want to install** page, select **Volume Activation Management Tool (VAMT)**, and then select **Install**. (You can select additional features to install as well.)
-6. On the completion page, select **Close**.
+6. On the completion page, select **Close**.
-
+
-### Configure VAMT to connect to SQL Server Express or full SQL Server
+### Configure VAMT to connect to SQL Server Express or full SQL Server
-
+
-1. Open **Volume Active Management Tool 3.1** from the Start menu.
+1. Open **Volume Active Management Tool 3.1** from the Start menu.
-2. Enter the server instance name (for a remote SQL use the FQDN) and a name for the database, select **Connect**, and then select **Yes** to create the database. See the following image for an example for SQL.
+2. Enter the server instance name (for a remote SQL use the FQDN) and a name for the database, select **Connect**, and then select **Yes** to create the database. See the following image for an example for SQL.
-
+
-    ![Server name is .\SQLEXPRESS and database name is VAMT](images/vamt-db.png)
+    ![Server name is .\SQLEXPRESS and database name is VAMT](images/vamt-db.png)
-
+
-for remote SQL Server use
+for remote SQL Server use
-servername.yourdomain.com
+servername.yourdomain.com
-
+
-
+
-
+
-## Uninstall VAMT
+## Uninstall VAMT
-
+
-To uninstall VAMT using the **Programs and Features** Control Panel:
+To uninstall VAMT using the **Programs and Features** Control Panel:
-1.  Open **Control Panel** and select **Programs and Features**.
+1.  Open **Control Panel** and select **Programs and Features**.
-2.  Select **Assessment and Deployment Kit** from the list of installed programs and click **Change**. Follow the instructions in the Windows ADK installer to remove VAMT.
+2.  Select **Assessment and Deployment Kit** from the list of installed programs and click **Change**. Follow the instructions in the Windows ADK installer to remove VAMT.
-
+
-
+
- 
+ 
- 
+ 

windows/deployment/windows-autopilot/autopilot-support.md

@@ -10,7 +10,6 @@ ms.pagetype: deploy
 audience: itpro
 author: greg-lindsay
 ms.author: greglin
-ms.date: 10/31/2018
 ms.reviewer: 
 manager: laurawi
 ms.collection: M365-modern-desktop
@@ -25,19 +24,14 @@ The following table displays support information for the Windows Autopilot progr
 
 Before contacting the resources listed below for Windows Autopilot-related issues, check the [Windows Autopilot FAQ](autopilot-faq.md).
 
-
+| Audience   |   Support contact     |
-|                           Audience                            |                                                                                                                                             Support contact                                                                                                                                              |
+|------------|---------------------------------------|
-|---------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| OEM or Channel Partner registering devices as a CSP (via MPC) | Use the help resources available in MPC. Whether you are a named partner or a channel partner (distributor, reseller, SI, etc.), if you’re a CSP registering Autopilot devices through MPC (either manually or through the MPC API), your first-line of support should be the help resources within MPC. |   
-| OEM or Channel Partner registering devices as a CSP (via MPC) | Use the help resources available in MPC. Whether you are a named partner or a channel partner (distributor, reseller, SI, etc.), if you’re a CSP registering Autopilot devices through MPC (either manually or through the MPC API), your first-line of support should be the help resources within MPC. |
+| OEM registering devices using OEM Direct API | Contact MSOEMOPS@microsoft.com. Response time depends on priority: <br>Low – 120 hours <br>Normal – 72 hours <br>High – 24 hours <br>Immediate – 4 hours |
-|         OEM registering devices using OEM Direct API          |                                                                         Contact MSOEMOPS@microsoft.com. Response time depends on priority: <br>Low – 120 hours <br>Normal – 72 hours <br>High – 24 hours <br>Immediate – 4 hours                                                                         |
+| Enterprise customers | Contact your Technical Account Manager (TAM), or Account Technology Strategist (ATS), or Customer Service Support (CSS) representative. |
-|      Partners with a Partner Technology Strategist (PTS)      |                                                                             If you have a PTS (whether you’re a CSP or not), you may first try working through your account’s specific Partner Technology Strategist (PTS).                                                                              |
+| End-user | Contact your IT administrator. |
-|                 Partners with an Ecosystem PM                 |                                                                   If you have an Ecosystem PM (whether you’re a CSP or not), you may first try working through your account’s specific Ecosystem PM, especially for technical issues. To learn more about Ecosystem PMs and the services they offer, contact epsoinfo@microsoft.com.                                                                   |
+| Microsoft Partner Center (MPC) users | Use the [help resources](https://partner.microsoft.com/support) available in MPC. |
-|                     Enterprise customers                      |                                                                                 Contact your Technical Account Manager (TAM), or Account Technology Strategist (ATS), or Customer Service Support (CSS) representative.                                                                                  |
+| Microsoft Store for Business (MSfB) users | Use the help resources available in MSfB. |
-|                           End-user                            |                                                                                                                                      Contact your IT administrator.                                                                                                                                      |
+| Intune users | From the Microsoft Azure portal, click [Help + support](https://portal.azure.com/#blade/Microsoft_Azure_Support/HelpAndSupportBlade/overview). |
-|             Microsoft Partner Center (MPC) users              |                                                                                                            Use the [help resources](https://partner.microsoft.com/support) available in MPC.                                                                                                             |
+| Microsoft 365 Business | Support is accessible directly through the Microsoft 365 Business portal when logged in:  https://support.microsoft.com/en-us. |
-|           Microsoft Store for Business (MSfB) users           |                                                                                                                                Use the help resources available in MSfB.                                                                                                                                 |
+| Queries relating to MDA testing | Contact MDAHelp@microsoft.com. |
-|                         Intune users                          |                                                                              From the Microsoft Azure portal, click [Help + support](https://portal.azure.com/#blade/Microsoft_Azure_Support/HelpAndSupportBlade/overview).                                                                              |
-|                    Microsoft 365 Business                     |                                                                                      Support is accessible directly through the Microsoft 365 Business portal when logged in:  https://support.microsoft.com/en-us.                                                                                      |
-|                Queries relating to MDA testing                |                                                                                                                                      Contact MDAHelp@microsoft.com.                                                                                                                                      |
-|       All other queries, or when unsure who to contact        |                                                                                                                                     Contact msoemops@microsoft.com.                                                                                                                                      |
-

windows/security/identity-protection/TOC.md

@@ -71,4 +71,5 @@
 ### [VPN security features](vpn\vpn-security-features.md)
 ### [VPN profile options](vpn\vpn-profile-options.md)
 ### [How to configure Diffie Hellman protocol over IKEv2 VPN connections](vpn\how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md)
-### [How to use single sign-on (SSO) over VPN and Wi-Fi connections](vpn\how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md)
+### [How to use single sign-on (SSO) over VPN and Wi-Fi connections](vpn\how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md)
+### [Optimizing Office 365 traffic with the Windows 10 VPN client](vpn\vpn-office-365-optimization.md)

windows/security/identity-protection/hello-for-business/hello-planning-guide.md

@@ -329,7 +329,7 @@ If box **1a** on your planning worksheet reads **cloud only** or **hybrid**, wri
 
 If box **1a** on your planning worksheet reads **on-premises**, and box **1f** reads **AD FS with third party**, write **No** in box **6a** on your planning worksheet. Otherwise, write **Yes** in box **6a** as you need an Azure account for per-consumption MFA billing. Write **No** in box **6b** on your planning worksheet—on-premises deployments do not use the cloud directory.
 
-Windows Hello for Business does not require an Azure AD premium subscription.  However, some dependencies do.
+Windows Hello for Business does not require an Azure AD premium subscription.  However, some dependencies, such as [MDM automatic enrollment](https://docs.microsoft.com/mem/intune/enrollment/quickstart-setup-auto-enrollment) and [Conditional Access](https://docs.microsoft.com/azure/active-directory/conditional-access/overview) do.
 
 If box **1a** on your planning worksheet reads **on-premises**, write **No** in box **6c** on your planning worksheet.
 

windows/security/identity-protection/vpn/vpn-office-365-optimization.md

@@ -0,0 +1,676 @@
+---
+title: Optimizing Office 365 traffic for remote workers with the native Windows 10 VPN client
+description: tbd
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security, networking
+audience: ITPro
+ms.topic: article
+author: kelleyvice-msft
+ms.localizationpriority: medium
+ms.date: 04/07/2020
+ms.reviewer: 
+manager: dansimp
+ms.author: jajo
+---
+
+# Optimizing Office 365 traffic for remote workers with the native Windows 10 VPN client
+
+This article describes how to configure the recommendations in the article [Optimize Office 365 connectivity for remote users using VPN split tunneling](https://docs.microsoft.com/office365/enterprise/office-365-vpn-split-tunnel) for the *native Windows 10 VPN client*. This guidance enables VPN administrators to optimize Office 365 usage while still ensuring that all other traffic goes over the VPN connection and through existing security gateways and tooling.
+
+This can be achieved for the native/built-in Windows 10 VPN client using a _Force Tunneling with Exclusions_ approach. This allows you to define IP-based exclusions *even when using force tunneling* in order to "split" certain traffic to use the physical interface while still forcing all other traffic via the VPN interface. Traffic addressed to specifically defined destinations (like those listed in the Office 365 optimize categories) will therefore follow a much more direct and efficient path, without the need to traverse or "hairpin" via the VPN tunnel and back out of the corporate network. For cloud-services like Office 365, this makes a huge difference in performance and usability for remote users.
+
+> [!NOTE]
+> The term _force tunneling with exclusions_ is sometimes confusingly called "split tunnels" by other vendors and in some online documentation. For Windows 10 VPN, the term _split tunneling_ is defined differently as described in the article [VPN routing decisions](https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-routing#split-tunnel-configuration).
+
+## Solution Overview
+
+The solution is based upon the use of a VPN Configuration Service Provider Reference profile ([VPNv2 CSP](https://docs.microsoft.com/windows/client-management/mdm/vpnv2-csp)) and the embedded [ProfileXML](https://docs.microsoft.com/windows/client-management/mdm/vpnv2-profile-xsd). These are used to configure the VPN profile on the device. Various provisioning approaches can be used to create and deploy the VPN profile as discussed in the article [Step 6. Configure Windows 10 client Always On VPN connections](https://docs.microsoft.com/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/vpn-deploy-client-vpn-connections#create-the-profilexml-configuration-files).
+
+Typically, these VPN profiles are distributed using a Mobile Device Management solution like Intune, as described in [VPN profile options](https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-profile-options#apply-profilexml-using-intune) and [Configure the VPN client by using Intune](https://docs.microsoft.com/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/vpn-deploy-client-vpn-connections#configure-the-vpn-client-by-using-intune).
+
+To enable the use of force tunneling in Windows 10 VPN, the `<RoutingPolicyType>` setting is typically configured with a value of _ForceTunnel_ in your existing Profile XML (or script) by way of the following entry, under the `<NativeProfile></NativeProfile>` section:
+
+```xml
+<RoutingPolicyType>ForceTunnel</RoutingPolicyType>
+```
+
+In order to define specific force tunnel exclusions, you then need to add the following lines to your existing Profile XML (or script) for each required exclusion, and place them outside of the `<NativeProfile></NativeProfile>` section as follows:
+
+```xml
+<Route>
+ <Address>[IP addresses or subnet]</Address>
+ <PrefixSize>[IP Prefix]</PrefixSize>
+ <ExclusionRoute>true</ExclusionRoute>
+</Route>
+```
+
+Entries defined by the `[IP Addresses or Subnet]` and `[IP Prefix]` references will consequently be added to the routing table as _more specific route entries_ that will use the Internet-connected interface as the default gateway, as opposed to using the VPN interface. You will need to define a unique and separate `<Route></Route>` section for each required exclusion.
+
+An example of a correctly formatted Profile XML configuration for force tunnel with exclusions is shown below:
+
+```xml
+<VPNProfile>
+ <NativeProfile>
+  <RoutingPolicyType>ForceTunnel</RoutingPolicyType>
+ </NativeProfile>
+ <Route>
+  <Address>203.0.113.0</Address>
+  <PrefixSize>24</PrefixSize>
+  <ExclusionRoute>true</ExclusionRoute>
+ </Route>
+ <Route>
+  <Address>198.51.100.0</Address>
+  <PrefixSize>22</PrefixSize>
+  <ExclusionRoute>true</ExclusionRoute>
+ </Route>
+</VPNProfile>
+```
+
+> [!NOTE]
+> The IP addresses and prefix size values in this example are used purely as examples only and should not be used.
+
+## Solution Deployment
+
+For Office 365, it is therefore necessary to add exclusions for all IP addresses documented within the optimize categories described in [Office 365 URLs and IP address ranges](https://docs.microsoft.com/office365/enterprise/urls-and-ip-address-ranges?redirectSourcePath=%252fen-us%252farticle%252fOffice-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2) to ensure that they are excluded from VPN force tunneling.
+
+This can be achieved manually by adding the IP addresses defined within the *optimize* category entries to an existing Profile XML (or script) file, or alternatively the following script can be used which dynamically adds the required entries to an existing PowerShell script, or XML file, based upon directly querying the REST-based web service to ensure the correct IP address ranges are always used.
+
+An example of a PowerShell script that can be used to update a force tunnel VPN connection with Office 365 exclusions is provided below.
+
+```powershell
+# Copyright (c) Microsoft Corporation.  All rights reserved.
+#  
+# THIS SAMPLE CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND,
+# WHETHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE.
+# IF THIS CODE AND INFORMATION IS MODIFIED, THE ENTIRE RISK OF USE OR RESULTS IN
+# CONNECTION WITH THE USE OF THIS CODE AND INFORMATION REMAINS WITH THE USER.
+
+<#
+.SYNOPSIS
+    Applies or updates recommended Office 365 optimize IP address exclusions to an existing force tunnel Windows 10 VPN profile
+.DESCRIPTION
+    Connects to the Office 365 worldwide commercial service instance endpoints to obtain the latest published IP address ranges
+    Compares the optimized IP addresses with those contained in the supplied VPN Profile (PowerShell or XML file)
+    Adds or updates IP addresses as necessary and saves the resultant file with "-NEW" appended to the file name
+.PARAMETERS
+    Filename and path for a supplied Windows 10 VPN profile file in either PowerShell or XML format
+.NOTES
+    Requires at least Windows 10 Version 1803 with KB4493437, 1809 with KB4490481, or later
+.VERSION
+    1.0
+#>
+
+param (
+    [string]$VPNprofilefile
+)
+
+$usage=@"
+
+This script uses the following parameters:
+
+VPNprofilefile - The full path and name of the VPN profile PowerShell script or XML file
+
+EXAMPLES
+
+To check a VPN profile PowerShell script file:
+
+Update-VPN-Profile-Office365-Exclusion-Routes.ps1 -VPNprofilefile [FULLPATH AND NAME OF POWERSHELL SCRIPT FILE]
+
+To check a VPN profile XML file:
+
+Update-VPN-Profile-Office365-Exclusion-Routes.ps1 -VPNprofilefile [FULLPATH AND NAME OF XML FILE]
+
+"@
+  
+# Check if filename has been provided #
+if ($VPNprofilefile -eq "")
+{
+   Write-Host "`nWARNING: You must specify either a PowerShell script or XML filename!" -ForegroundColor Red
+
+    $usage
+    exit
+}
+
+$FileExtension = [System.IO.Path]::GetExtension($VPNprofilefile)
+
+# Check if XML file exists and is a valid XML file #
+if ( $VPNprofilefile -ne "" -and $FileExtension -eq ".xml")
+{
+    if ( Test-Path $VPNprofilefile )
+    {
+        $xml = New-Object System.Xml.XmlDocument
+        try
+        {
+            $xml.Load((Get-ChildItem -Path $VPNprofilefile).FullName)
+
+        }
+        catch [System.Xml.XmlException]
+        {
+            Write-Verbose "$VPNprofilefile : $($_.toString())"
+            Write-Host "`nWARNING: The VPN profile XML file is not a valid xml file or incorrectly formatted!" -ForegroundColor Red
+            $usage
+            exit
+        }
+    }else
+    {
+        Write-Host "`nWARNING: VPN profile XML file does not exist or cannot be found!" -ForegroundColor Red
+        $usage
+        exit
+    }
+}
+
+# Check if VPN profile PowerShell script file exists and contains a VPNPROFILE XML section #
+if ( $VPNprofilefile -ne "" -and $FileExtension -eq ".ps1")
+{
+    if ( (Test-Path $VPNprofilefile) )
+    {
+        if (-Not $(Select-String -Path $VPNprofilefile -Pattern "<VPNPROFILE>") )
+        {
+            Write-Host "`nWARNING: PowerShell script file does not contain a valid VPN profile XML section or is incorrectly formatted!" -ForegroundColor Red
+            $usage
+            exit
+        }
+    }else
+    {
+        Write-Host "`nWARNING: PowerShell script file does not exist or cannot be found!"-ForegroundColor Red
+        $usage
+        exit
+    }
+}
+
+# Define Office 365 endpoints and service URLs #
+$ws = "https://endpoints.office.com"
+$baseServiceUrl = "https://endpoints.office.com"
+
+# Path where client ID and latest version number will be stored #
+$datapath = $Env:TEMP + "\endpoints_clientid_latestversion.txt"
+
+# Fetch client ID and version if data file exists; otherwise create new file #
+if (Test-Path $datapath)
+{
+    $content = Get-Content $datapath
+    $clientRequestId = $content[0]
+    $lastVersion = $content[1]
+
+}else
+{
+    $clientRequestId = [GUID]::NewGuid().Guid
+    $lastVersion = "0000000000"
+    @($clientRequestId, $lastVersion) | Out-File $datapath
+}
+
+# Call version method to check the latest version, and pull new data if version number is different #
+$version = Invoke-RestMethod -Uri ($ws + "/version?clientRequestId=" + $clientRequestId)
+
+if ($version[0].latest -gt $lastVersion)
+{
+
+    Write-Host
+    Write-Host "A new version of Office 365 worldwide commercial service instance endpoints has been detected!" -ForegroundColor Cyan
+
+    # Write the new version number to the data file #
+    @($clientRequestId, $version[0].latest) | Out-File $datapath
+}
+
+# Invoke endpoints method to get the new data #
+$uri = "$baseServiceUrl" + "/endpoints/worldwide?clientRequestId=$clientRequestId"
+
+# Invoke endpoints method to get the data for the VPN profile comparison #
+$endpointSets = Invoke-RestMethod -Uri ($uri)
+$Optimize = $endpointSets | Where-Object { $_.category -eq "Optimize" }
+$optimizeIpsv4 = $Optimize.ips | Where-Object { ($_).contains(".") } | Sort-Object -Unique
+
+# Temporarily include additional IP address until Teams client update is released
+$optimizeIpsv4 += "13.107.60.1/32"
+
+# Process PowerShell script file start #
+if ($VPNprofilefile -ne "" -and $FileExtension -eq ".ps1")
+{
+    Write-host "`nStarting PowerShell script exclusion route check...`n" -ForegroundColor Cyan
+
+    # Clear Variables to allow re-run testing #
+
+    $ARRVPN=$null              # Array to hold VPN addresses from VPN profile PowerShell file #
+    $In_Opt_Only=$null         # Variable to hold IP addresses that only appear in the optimize list #
+    $In_VPN_Only=$null         # Variable to hold IP addresses that only appear in the VPN profile PowerShell file #
+
+    # Extract the Profile XML from the ps1 file #
+
+    $regex = '(?sm).*^*.<VPNPROFILE>\r?\n(.*?)\r?\n</VPNProfile>.*'
+
+    # Create xml format variable to compare with the optimize list #
+
+    $xmlbody=(Get-Content -Raw $VPNprofilefile) -replace $regex, '$1'
+    [xml]$VPNprofilexml="<VPNPROFILE>"+$xmlbody+"</VPNPROFILE>"
+
+        # Loop through each address found in VPNPROFILE XML section #
+        foreach ($Route in $VPNprofilexml.VPNProfile.Route)
+        {
+        $VPNIP=$Route.Address+"/"+$Route.PrefixSize
+        [array]$ARRVPN=$ARRVPN+$VPNIP
+        }
+
+    # In optimize address list only #
+    $In_Opt_Only= $optimizeIpsv4 | Where {$ARRVPN -NotContains $_}
+
+    # In VPN list only #
+    $In_VPN_only =$ARRVPN | Where {$optimizeIpsv4 -NotContains $_}
+    [array]$Inpfile = get-content $VPNprofilefile
+
+    if ($In_Opt_Only.Count -gt 0 )
+    {
+        Write-Host "Exclusion route IP addresses are unknown, missing, or need to be updated in the VPN profile`n" -ForegroundColor Red
+
+         [int32]$insline=0
+
+            for ($i=0; $i -lt $Inpfile.count; $i++)
+            {
+                if ($Inpfile[$i] -match "</NativeProfile>")
+                {
+                $insline += $i # Record the position of the line after the NativeProfile section ends #
+                }
+            }
+            $OFS = "`r`n"
+                foreach ($NewIP in $In_Opt_Only)
+                {
+                    # Add the missing IP address(es) #
+                    $IPInfo=$NewIP.Split("/")
+                    $InpFile[$insline] += $OFS+"    <Route>"
+                    $InpFile[$insline] += $OFS+"      <Address>"+$IPInfo[0].Trim()+"</Address>"
+                    $InpFile[$insline] += $OFS+"      <PrefixSize>"+$IPInfo[1].Trim()+"</PrefixSize>"
+                    $InpFile[$insline] += $OFS+"      <ExclusionRoute>true</ExclusionRoute>"
+                    $InpFile[$insline] += $OFS+"    </Route>"
+                }
+             # Update fileName and write new PowerShell file #
+             $NewFileName=(Get-Item $VPNprofilefile).Basename + "-NEW.ps1"
+             $OutFile=$(Split-Path $VPNprofilefile -Parent)+"\"+$NewFileName
+             $InpFile | Set-Content $OutFile
+             Write-Host "Exclusion routes have been added to VPN profile and output to a separate PowerShell script file; the original file has not been modified`n" -ForegroundColor Green
+    }else
+    {
+        Write-Host "Exclusion route IP addresses are correct and up to date in the VPN profile`n" -ForegroundColor Green
+        $OutFile=$VPNprofilefile
+    }
+
+if ( $In_VPN_Only.Count -gt 0 )
+{
+    Write-Host "Unknown exclusion route IP addresses have been found in the VPN profile`n" -ForegroundColor Yellow
+
+        foreach ($OldIP in $In_VPN_Only)
+        {
+            [array]$Inpfile = get-content $Outfile
+            $IPInfo=$OldIP.Split("/")
+            Write-Host "Unknown exclusion route IP address"$IPInfo[0]"has been found in the VPN profile - Do you wish to remove it? (Y/N)`n" -ForegroundColor Yellow
+            $matchstr="<Address>"+$IPInfo[0].Trim()+"</Address>"
+            $DelAns=Read-host
+                if ($DelAns.ToUpper() -eq "Y")
+                {
+                    [int32]$insline=0
+                        for ($i=0; $i -lt $Inpfile.count; $i++)
+                        {
+                            if ($Inpfile[$i] -match $matchstr)
+                            {
+                                $insline += $i # Record the position of the line for the string match #
+                            }
+                        }
+                        # Remove entries from XML #
+                        $InpFile[$insline-1]="REMOVETHISLINE"
+                        $InpFile[$insline]="REMOVETHISLINE"
+                        $InpFile[$insline+1]="REMOVETHISLINE"
+                        $InpFile[$insline+2]="REMOVETHISLINE"
+                        $InpFile[$insline+3]="REMOVETHISLINE"
+                        $InpFile=$InpFile | Where-Object {$_ -ne "REMOVETHISLINE"}
+
+                        # Update filename and write new PowerShell file #
+                        $NewFileName=(Get-Item $VPNprofilefile).Basename + "-NEW.xml"
+                        $OutFile=$(Split-Path $VPNprofilefile -Parent)+"\"+$NewFileName
+                        $Inpfile | Set-content $OutFile
+                        Write-Host "`nAddress"$IPInfo[0]"exclusion route has been removed from the VPN profile and output to a separate PowerShell script file; the original file has not been modified`n" -ForegroundColor Green
+
+                }else
+                {
+                    Write-Host "`nExclusion route IP address has *NOT* been removed from the VPN profile`n" -ForegroundColor Green
+                }
+        }
+ }
+}
+
+# Process XML file start #
+if ($VPNprofilefile -ne "" -and $FileExtension -eq ".xml")
+{
+    Write-host "`nStarting XML file exclusion route check...`n" -ForegroundColor Cyan
+
+    # Clear variables to allow re-run testing #
+    $ARRVPN=$null              # Array to hold VPN addresses from the XML file #
+    $In_Opt_Only=$null         # Variable to hold IP Addresses that only appear in optimize list #
+    $In_VPN_Only=$null         # Variable to hold IP Addresses that only appear in the VPN profile XML file #  
+
+    # Extract the Profile XML from the XML file #
+    $regex = '(?sm).*^*.<VPNPROFILE>\r?\n(.*?)\r?\n</VPNProfile>.*'
+
+    # Create xml format variable to compare with optimize list #
+    $xmlbody=(Get-Content -Raw $VPNprofilefile) -replace $regex, '$1'
+    [xml]$VPNRulesxml="$xmlbody"
+
+        # Loop through each address found in VPNPROFILE file #
+        foreach ($Route in $VPNRulesxml.VPNProfile.Route)
+        {
+            $VPNIP=$Route.Address+"/"+$Route.PrefixSize
+            [array]$ARRVPN=$ARRVPN+$VPNIP
+        }
+
+    # In optimize address list only #
+    $In_Opt_Only= $optimizeIpsv4 | Where {$ARRVPN -NotContains $_}
+
+    # In VPN list only #
+    $In_VPN_only =$ARRVPN | Where {$optimizeIpsv4 -NotContains $_}
+    [array]$Inpfile = get-content $VPNprofilefile
+
+        if ($In_Opt_Only.Count -gt 0 )
+        {
+            Write-Host "Exclusion route IP addresses are unknown, missing, or need to be updated in the VPN profile`n" -ForegroundColor Red
+
+                foreach ($NewIP in $In_Opt_Only)
+                {
+                    # Add the missing IP address(es) #
+                    $IPInfo=$NewIP.Split("/")
+                    $inspoint = $Inpfile[0].IndexOf("</VPNProfile")
+                    $routes += "<Route>"+"<Address>"+$IPInfo[0].Trim()+"</Address>"+"<PrefixSize>"+$IPInfo[1].Trim()+"</PrefixSize>"+"<ExclusionRoute>true</ExclusionRoute>"+"</Route>"
+                }
+            $Inpfile = $Inpfile[0].Insert($inspoint,$routes)
+
+            # Update filename and write new XML file #
+            $NewFileName=(Get-Item $VPNprofilefile).Basename + "-NEW.xml"
+            $OutFile=$(Split-Path $VPNprofilefile -Parent)+"\"+$NewFileName
+            $InpFile | Set-Content $OutFile
+            Write-Host "Exclusion routes have been added to VPN profile and output to a separate XML file; the original file has not been modified`n`n" -ForegroundColor Green
+
+        }else
+        {
+            Write-Host "Exclusion route IP addresses are correct and up to date in the VPN profile`n" -ForegroundColor Green
+            $OutFile=$VPNprofilefile
+        }
+
+        if ( $In_VPN_Only.Count -gt 0 )
+        {
+            Write-Host "Unknown exclusion route IP addresses found in the VPN profile`n" -ForegroundColor Yellow
+
+            foreach ($OldIP in $In_VPN_Only)
+            {
+                [array]$Inpfile = get-content $OutFile
+                $IPInfo=$OldIP.Split("/")
+                Write-Host "Unknown exclusion route IP address"$IPInfo[0]"has been found in the VPN profile - Do you wish to remove it? (Y/N)`n" -ForegroundColor Yellow
+                $matchstr="<Route>"+"<Address>"+$IPInfo[0].Trim()+"</Address>"+"<PrefixSize>"+$IPInfo[1].Trim()+"</PrefixSize>"+"<ExclusionRoute>true</ExclusionRoute>"+"</Route>"
+                $DelAns=Read-host
+                    if ($DelAns.ToUpper() -eq "Y")
+                    {
+                        # Remove unknown IP address(es) #
+                        $inspoint = $Inpfile[0].IndexOf($matchstr)
+                        $Inpfile[0] = $Inpfile[0].Replace($matchstr,"")
+
+                        # Update filename and write new XML file #
+                        $NewFileName=(Get-Item $VPNprofilefile).Basename + "-NEW.xml"
+                        $OutFile=$(Split-Path $VPNprofilefile -Parent)+"\"+$NewFileName
+                        $Inpfile | Set-content $OutFile
+                        Write-Host "`nAddress"$IPInfo[0]"exclusion route has been removed from the VPN profile and output to a separate XML file; the original file has not been modified`n" -ForegroundColor Green
+
+                    }else
+                    {
+                        Write-Host "`nExclusion route IP address has *NOT* been removed from the VPN profile`n" -ForegroundColor Green
+                    }
+            }
+        }
+}
+```
+
+## Version Support
+
+This solution is supported with the following versions of Windows:
+
+- Windows 10 1903/1909 and newer: Included, no action needed
+- Windows 10 1809: At least [KB4490481](https://support.microsoft.com/help/4490481/windows-10-update-kb4490481)
+- Windows 10 1803: At least [KB4493437](https://support.microsoft.com/help/4493437/windows-10-update-kb4493437)
+- Windows 10 1709 and lower: Exclusion routes are not supported
+
+- Windows 10 Enterprise 2019 LTSC: At least [KB4490481](https://support.microsoft.com/help/4490481/windows-10-update-kb4490481)
+- Windows 10 Enterprise 2016 LTSC: Exclusion routes are not supported
+- Windows 10 Enterprise 2015 LTSC: Exclusion routes are not supported
+
+Microsoft strongly recommends that the latest available Windows 10 cumulative update always be applied.
+
+## Other Considerations
+
+You should also be able to adapt this approach to include necessary exclusions for other cloud-services that can be defined by known/static IP addresses; exclusions required for [Cisco WebEx](https://help.webex.com/WBX000028782/Network-Requirements-for-Webex-Teams-Services) or [Zoom](https://support.zoom.us/hc/en-us/articles/201362683) are good examples.
+
+## Examples
+
+An example of a PowerShell script that can be used to create a force tunnel VPN connection with Office 365 exclusions is provided below, or refer to the guidance in [Create the ProfileXML configuration files](https://docs.microsoft.com/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/vpn-deploy-client-vpn-connections#create-the-profilexml-configuration-files) to create the initial PowerShell script:
+
+```powershell
+# Copyright (c) Microsoft Corporation.  All rights reserved.
+#
+# THIS SAMPLE CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND,
+# WHETHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE.
+# IF THIS CODE AND INFORMATION IS MODIFIED, THE ENTIRE RISK OF USE OR RESULTS IN
+# CONNECTION WITH THE USE OF THIS CODE AND INFORMATION REMAINS WITH THE USER.
+
+<#
+.SYNOPSIS
+    Configures an AlwaysOn IKEv2 VPN Connection using a basic script
+.DESCRIPTION
+    Configures an AlwaysOn IKEv2 VPN Connection with proxy PAC information and force tunneling
+.PARAMETERS
+    Parameters are defined in a ProfileXML object within the script itself
+.NOTES
+    Requires at least Windows 10 Version 1803 with KB4493437, 1809 with KB4490481, or later
+.VERSION
+    1.0
+#>
+
+<#-- Define Key VPN Profile Parameters --#>
+$ProfileName = 'Contoso VPN with Office 365 Exclusions'
+$ProfileNameEscaped = $ProfileName -replace ' ', '%20'
+
+<#-- Define VPN ProfileXML --#>
+$ProfileXML = '<VPNProfile>
+      <RememberCredentials>true</RememberCredentials>
+    <DnsSuffix>corp.contoso.com</DnsSuffix>
+    <AlwaysOn>true</AlwaysOn>
+    <TrustedNetworkDetection>corp.contoso.com</TrustedNetworkDetection>
+<NativeProfile>
+        <Servers>edge1.contoso.com</Servers>
+        <RoutingPolicyType>ForceTunnel</RoutingPolicyType>
+        <NativeProtocolType>IKEv2</NativeProtocolType>
+        <Authentication>
+            <MachineMethod>Certificate</MachineMethod>
+        </Authentication>
+    </NativeProfile>
+    <Route>
+      <Address>13.107.6.152</Address>
+      <PrefixSize>31</PrefixSize>
+      <ExclusionRoute>true</ExclusionRoute>
+    </Route>
+    <Route>
+      <Address>13.107.18.10</Address>
+      <PrefixSize>31</PrefixSize>
+      <ExclusionRoute>true</ExclusionRoute>
+    </Route>
+    <Route>
+      <Address>13.107.128.0</Address>
+      <PrefixSize>22</PrefixSize>
+      <ExclusionRoute>true</ExclusionRoute>
+    </Route>
+    <Route>
+      <Address>23.103.160.0</Address>
+      <PrefixSize>20</PrefixSize>
+      <ExclusionRoute>true</ExclusionRoute>
+    </Route>
+    <Route>
+      <Address>40.96.0.0</Address>
+      <PrefixSize>13</PrefixSize>
+      <ExclusionRoute>true</ExclusionRoute>
+    </Route>
+    <Route>
+      <Address>40.104.0.0</Address>
+      <PrefixSize>15</PrefixSize>
+      <ExclusionRoute>true</ExclusionRoute>
+    </Route>
+    <Route>
+      <Address>52.96.0.0</Address>
+      <PrefixSize>14</PrefixSize>
+      <ExclusionRoute>true</ExclusionRoute>
+    </Route>
+    <Route>
+      <Address>131.253.33.215</Address>
+      <PrefixSize>32</PrefixSize>
+      <ExclusionRoute>true</ExclusionRoute>
+    </Route>
+    <Route>
+      <Address>132.245.0.0</Address>
+      <PrefixSize>16</PrefixSize>
+      <ExclusionRoute>true</ExclusionRoute>
+    </Route>
+    <Route>
+      <Address>150.171.32.0</Address>
+      <PrefixSize>22</PrefixSize>
+      <ExclusionRoute>true</ExclusionRoute>
+    </Route>
+    <Route>
+      <Address>191.234.140.0</Address>
+      <PrefixSize>22</PrefixSize>
+      <ExclusionRoute>true</ExclusionRoute>
+    </Route>
+    <Route>
+      <Address>204.79.197.215</Address>
+      <PrefixSize>32</PrefixSize>
+    <ExclusionRoute>true</ExclusionRoute>
+    </Route>
+    <Route>
+      <Address>13.107.136.0</Address>
+      <PrefixSize>22</PrefixSize>
+      <ExclusionRoute>true</ExclusionRoute>
+    </Route>
+    <Route>
+      <Address>40.108.128.0</Address>
+      <PrefixSize>17</PrefixSize>
+      <ExclusionRoute>true</ExclusionRoute>
+    </Route>
+    <Route>
+      <Address>52.104.0.0</Address>
+      <PrefixSize>14</PrefixSize>
+      <ExclusionRoute>true</ExclusionRoute>
+    </Route>
+    <Route>
+      <Address>104.146.128.0</Address>
+      <PrefixSize>17</PrefixSize>
+      <ExclusionRoute>true</ExclusionRoute>
+    </Route>  
+    <Route>
+      <Address>150.171.40.0</Address>
+      <PrefixSize>22</PrefixSize>
+      <ExclusionRoute>true</ExclusionRoute>
+    </Route>  
+    <Route>
+      <Address>13.107.60.1</Address>
+      <PrefixSize>32</PrefixSize>
+      <ExclusionRoute>true</ExclusionRoute>
+    </Route>
+    <Route>
+      <Address>13.107.64.0</Address>
+     <PrefixSize>18</PrefixSize>
+    <ExclusionRoute>true</ExclusionRoute>
+    </Route>
+    <Route>
+      <Address>52.112.0.0</Address>
+      <PrefixSize>14</PrefixSize>
+      <ExclusionRoute>true</ExclusionRoute>
+    </Route>
+    <Route>
+      <Address>52.120.0.0</Address>
+      <PrefixSize>14</PrefixSize>
+    <ExclusionRoute>true</ExclusionRoute>
+    </Route>
+    <Proxy>  
+            <AutoConfigUrl>http://webproxy.corp.contsoso.com/proxy.pac</AutoConfigUrl>  
+      </Proxy>  
+</VPNProfile>'
+
+<#-- Convert ProfileXML to Escaped Format --#>
+$ProfileXML = $ProfileXML -replace '<', '&lt;'
+$ProfileXML = $ProfileXML -replace '>', '&gt;'
+$ProfileXML = $ProfileXML -replace '"', '&quot;'
+
+<#-- Define WMI-to-CSP Bridge Properties --#>
+$nodeCSPURI = './Vendor/MSFT/VPNv2'
+$namespaceName = "root\cimv2\mdm\dmmap"
+$className = "MDM_VPNv2_01"
+
+<#-- Define WMI Session --#>
+$session = New-CimSession
+
+<#-- Detect and Delete Previous VPN Profile --#>
+try
+{
+    $deleteInstances = $session.EnumerateInstances($namespaceName, $className, $options)
+    foreach ($deleteInstance in $deleteInstances)
+    {
+        $InstanceId = $deleteInstance.InstanceID
+        if ("$InstanceId" -eq "$ProfileNameEscaped")
+        {
+            $session.DeleteInstance($namespaceName, $deleteInstance, $options)
+            $Message = "Removed $ProfileName profile $InstanceId"
+            Write-Host "$Message"
+        } else {
+            $Message = "Ignoring existing VPN profile $InstanceId"
+            Write-Host "$Message"
+        }
+    }
+}
+catch [Exception]
+{
+    $Message = "Unable to remove existing outdated instance(s) of $ProfileName profile: $_"
+    Write-Host "$Message"
+    exit
+}
+
+<#-- Create VPN Profile --#>
+try
+{
+    $newInstance = New-Object Microsoft.Management.Infrastructure.CimInstance $className, $namespaceName
+    $property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ParentID", "$nodeCSPURI", 'String', 'Key')
+    $newInstance.CimInstanceProperties.Add($property)
+    $property = [Microsoft.Management.Infrastructure.CimProperty]::Create("InstanceID", "$ProfileNameEscaped", 'String', 'Key')
+    $newInstance.CimInstanceProperties.Add($property)
+    $property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ProfileXML", "$ProfileXML", 'String', 'Property')
+    $newInstance.CimInstanceProperties.Add($property)
+
+    $session.CreateInstance($namespaceName, $newInstance, $options)
+    $Message = "Created $ProfileName profile."
+    Write-Host "$Message"
+    Write-Host "$ProfileName profile summary:"  
+    $session.EnumerateInstances($namespaceName, $className, $options)
+}
+catch [Exception]
+{
+    $Message = "Unable to create $ProfileName profile: $_"
+    Write-Host "$Message"
+    exit
+}
+
+$Message = "Script Complete"
+Write-Host "$Message"
+
+```
+
+An example of an [Intune-ready XML file](https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-profile-options#apply-profilexml-using-intune) that can be used to create a force tunnel VPN connection with Office 365 exclusions is provided below, or refer to the guidance in [Create the ProfileXML configuration files](https://docs.microsoft.com/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/vpn-deploy-client-vpn-connections#create-the-profilexml-configuration-files) to create the initial XML file.
+
+>[!NOTE]
+>This XML is formatted for use with Intune and cannot contain any carriage returns or whitespace.
+
+```xml
+<VPNProfile><RememberCredentials>true</RememberCredentials><DnsSuffix>corp.contoso.com</DnsSuffix><AlwaysOn>true</AlwaysOn><TrustedNetworkDetection>corp.contoso.com</TrustedNetworkDetection><NativeProfile><Servers>edge1.contoso.com</Servers><RoutingPolicyType>ForceTunnel</RoutingPolicyType><NativeProtocolType>IKEv2</NativeProtocolType><Authentication><MachineMethod>Certificate</MachineMethod></Authentication></NativeProfile><Route><Address>13.107.6.152</Address><PrefixSize>31</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>13.107.18.10</Address><PrefixSize>31</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>13.107.128.0</Address><PrefixSize>22</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>23.103.160.0</Address><PrefixSize>20</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>40.96.0.0</Address><PrefixSize>13</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>40.104.0.0</Address><PrefixSize>15</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>52.96.0.0</Address><PrefixSize>14</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>131.253.33.215</Address><PrefixSize>32</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>132.245.0.0</Address><PrefixSize>16</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>150.171.32.0</Address><PrefixSize>22</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>191.234.140.0</Address><PrefixSize>22</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>204.79.197.215</Address><PrefixSize>32</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>13.107.136.0</Address><PrefixSize>22</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>40.108.128.0</Address><PrefixSize>17</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>52.104.0.0</Address><PrefixSize>14</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>104.146.128.0</Address><PrefixSize>17</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>150.171.40.0</Address><PrefixSize>22</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>13.107.60.1</Address><PrefixSize>32</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>13.107.64.0</Address><PrefixSize>18</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>52.112.0.0</Address><PrefixSize>14</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>52.120.0.0</Address><PrefixSize>14</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Proxy><AutoConfigUrl>http://webproxy.corp.contsoso.com/proxy.pac</AutoConfigUrl></Proxy></VPNProfile>
+```

windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md

@@ -80,7 +80,9 @@ The server side configuration to enable Network Unlock also requires provisionin
 
 1.  The Windows boot manager detects that a Network Unlock protector exists in the BitLocker configuration.
 2.  The client computer uses its DHCP driver in the UEFI to obtain a valid IPv4 IP address.
-3.  The client computer broadcasts a vendor-specific DHCP request that contains the Network Key (a 256-bit intermediate key) and an AES-256 session key for the reply. Both of these keys are encrypted using the 2048-bit RSA Public Key of the Network Unlock certificate from the WDS server.
+3.  The client computer broadcasts a vendor-specific DHCP request that contains: 
+    1.  A Network Key (a 256-bit intermediate key) encrypted using the 2048-bit RSA Public Key of the Network Unlock certificate from the WDS server.
+    2.  An AES-256 session key for the reply.
 4.  The Network Unlock provider on the WDS server recognizes the vendor-specific request.
 5.  The provider decrypts it with the WDS server’s BitLocker Network Unlock certificate RSA private key.
 6.  The WDS provider then returns the network key encrypted with the session key using its own vendor-specific DHCP reply to the client computer. This forms an intermediate key.

windows/security/threat-protection/TOC.md

@@ -583,7 +583,7 @@
 ##### [Learn about different ways to pull detections](microsoft-defender-atp/configure-siem.md)
 ##### [Enable SIEM integration](microsoft-defender-atp/enable-siem-integration.md)
 ##### [Configure Splunk to pull detections](microsoft-defender-atp/configure-splunk.md)
-##### [Configure HP ArcSight to pull detections](microsoft-defender-atp/configure-arcsight.md)
+##### [Configure Micro Focus ArcSight to pull detections](microsoft-defender-atp/configure-arcsight.md)
 ##### [Microsoft Defender ATP detection fields](microsoft-defender-atp/api-portal-mapping.md)
 ##### [Pull detections using SIEM REST API](microsoft-defender-atp/pull-alerts-using-rest-api.md)
 ##### [Troubleshoot SIEM tool integration issues](microsoft-defender-atp/troubleshoot-siem.md)

windows/security/threat-protection/microsoft-defender-atp/configure-arcsight.md

@@ -1,7 +1,7 @@
 ---
-title: Configure HP ArcSight to pull Microsoft Defender ATP detections
+title: Configure Micro Focus ArcSight to pull Microsoft Defender ATP detections
-description: Configure HP ArcSight to receive and pull detections from Microsoft Defender Security Center
+description: Configure Micro Focus ArcSight to receive and pull detections from Microsoft Defender Security Center
-keywords: configure hp arcsight, security information and events management tools, arcsight
+keywords: configure Micro Focus ArcSight, security information and events management tools, arcsight
 search.product: eADQiWindows 10XVcnh
 search.appverid: met150
 ms.prod: w10
@@ -17,7 +17,7 @@ ms.collection: M365-security-compliance
 ms.topic: article
 ---
 
-# Configure HP ArcSight to pull Microsoft Defender ATP detections
+# Configure Micro Focus ArcSight to pull Microsoft Defender ATP detections
 
 **Applies to:**
 
@@ -28,14 +28,15 @@ ms.topic: article
 
 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configurearcsight-abovefoldlink) 
 
-You'll need to install and configure some files and tools to use HP ArcSight so that it can pull Microsoft Defender ATP detections.
+You'll need to install and configure some files and tools to use Micro Focus ArcSight so that it can pull Microsoft Defender ATP detections.
 
 >[!Note]
 >- [Microsoft Defender ATP Alert](alerts.md) is composed from one or more detections
 >- [Microsoft Defender ATP Detection](api-portal-mapping.md) is composed from the suspicious event occurred on the Machine and its related Alert details.
 
 ## Before you begin
-Configuring the HP ArcSight Connector tool requires several configuration files for it to pull and parse detections from your Azure Active Directory (AAD) application.
+
+Configuring the Micro Focus ArcSight Connector tool requires several configuration files for it to pull and parse detections from your Azure Active Directory (AAD) application.
 
 This section guides you in getting the necessary information to set and use the required configuration files correctly.
 
@@ -50,7 +51,7 @@ This section guides you in getting the necessary information to set and use the
   - WDATP-connector.properties
   - WDATP-connector.jsonparser.properties
 
-    You would have saved a .zip file which contains these two files when you chose HP ArcSight as the SIEM type you use in your organization.
+    You would have saved a .zip file which contains these two files when you chose Micro Focus ArcSight as the SIEM type you use in your organization.
 
 - Make sure you generate the following tokens and have them ready:
   - Access token
@@ -58,7 +59,8 @@ This section guides you in getting the necessary information to set and use the
 
   You can generate these tokens from the **SIEM integration** setup section of the portal.
 
-## Install and configure HP ArcSight FlexConnector
+## Install and configure Micro Focus ArcSight FlexConnector
+
 The following steps assume that you have completed all the required steps in [Before you begin](#before-you-begin).
 
 1. Install the latest 32-bit Windows FlexConnector installer. You can find this in the HPE Software center. The tool is typically installed in the following default location: `C:\Program Files\ArcSightFlexConnectors\current\bin`.</br></br>You can choose where to save the tool, for example C:\\*folder_location*\current\bin where *folder_location* represents the installation location.
@@ -79,8 +81,9 @@ The following steps assume that you have completed all the required steps in [Be
 
    - WDATP-connector.properties: C:\\*folder_location*\current\user\agent\flexagent\
 
-   NOTE:
+   > [!NOTE]
-   You must put the configuration files in this location, where *folder_location* represents the location where you installed the tool.
+   > 
+   > You must put the configuration files in this location, where *folder_location* represents the location where you installed the tool.
 
 4. After the installation of the core connector completes, the Connector Setup window opens. In the Connector Setup window, select **Add a Connector**.
 
@@ -114,30 +117,36 @@ The following steps assume that you have completed all the required steps in [Be
     </td>
     </tr>
     </tr>
-    </table><br/>7. A browser window is opened by the connector. Login with your application credentials. After you log in, you&#39;ll be asked to give permission to your OAuth2 Client. You must give permission to your OAuth 2 Client so that the connector configuration can authenticate. </br></br>
+    </table><br/>
-   If the <code>redirect_uri</code> is a https URL, you&#39;ll be redirected to a URL on the local host. You&#39;ll see a page that requests for you to trust the certificate supplied by the connector running on the local host. You&#39;ll need to trust this certificate if the redirect_uri is a https. </br></br> If however you specify a http URL for the redirect_uri, you do not need to provide consent in trusting the certificate.
+    
+7. A browser window is opened by the connector. Login with your application credentials. After you log in, you'll be asked to give permission to your OAuth2 Client. You must give permission to your OAuth 2 Client so that the connector configuration can authenticate.
 
-7. Continue with the connector setup by returning to the HP ArcSight Connector Setup window.
+   If the <code>redirect_uri</code> is a https URL, you'll be redirected to a URL on the local host. You'll see a page that requests for you to trust the certificate supplied by the connector running on the local host. You'll need to trust this certificate if the redirect_uri is a https.
+   
+   If however you specify a http URL for the redirect_uri, you do not need to provide consent in trusting the certificate.
 
-8. Select the **ArcSight Manager (encrypted)** as the destination and click **Next**.
+8. Continue with the connector setup by returning to the Micro Focus ArcSight Connector Setup window.
 
-9. Type in the destination IP/hostname in **Manager Hostname** and your credentials in the parameters form. All other values in the form should be retained with the default values. Click **Next**.
+9. Select the **ArcSight Manager (encrypted)** as the destination and click **Next**.
 
-10. Type in a name for the connector in the connector details form. All other values in the form are optional and can be left blank. Click **Next**.
+10. Type in the destination IP/hostname in **Manager Hostname** and your credentials in the parameters form. All other values in the form should be retained with the default values. Click **Next**.
 
-11. The ESM Manager import certificate window is shown. Select **Import the certificate to connector from destination** and click **Next**. The **Add connector Summary** window is displayed and the certificate is imported.
+11. Type in a name for the connector in the connector details form. All other values in the form are optional and can be left blank. Click **Next**.
 
-12. Verify that the details in the **Add connector Summary** window is correct, then click **Next**.
+12. The ESM Manager import certificate window is shown. Select **Import the certificate to connector from destination** and click **Next**. The **Add connector Summary** window is displayed and the certificate is imported.
 
-13. Select **Install as a service** and click **Next**.
+13. Verify that the details in the **Add connector Summary** window is correct, then click **Next**.
 
-14. Type a name in the **Service Internal Name** field. All other values in the form can be retained with the default values or left blank . Click **Next**.
+14. Select **Install as a service** and click **Next**.
 
-15. Type in the service parameters and click **Next**. A window with the **Install Service Summary** is shown. Click **Next**.
+15. Type a name in the **Service Internal Name** field. All other values in the form can be retained with the default values or left blank . Click **Next**.
 
-16. Finish the installation by selecting **Exit** and **Next**.
+16. Type in the service parameters and click **Next**. A window with the **Install Service Summary** is shown. Click **Next**.
+
+17. Finish the installation by selecting **Exit** and **Next**.
+
+## Install and configure the Micro Focus ArcSight console
 
-## Install and configure the HP ArcSight console
 1. Follow the installation wizard through the following tasks:
    - Introduction
    - License Agreement
@@ -158,18 +167,19 @@ The following steps assume that you have completed all the required steps in [Be
 
 7. Click **Done** to quit the installer.
 
-8. Login to the HP ArcSight console.
+8. Login to the Micro Focus ArcSight console.
 
 9. Navigate to **Active channel set** > **New Condition** > **Device** > **Device Product**.
 
 10. Set **Device Product = Microsoft Defender ATP**. When you've verified that events are flowing to the tool, stop the process again and go to Windows Services and start the ArcSight FlexConnector REST.
 
-You can now run queries in the HP ArcSight console.
+You can now run queries in the Micro Focus ArcSight console.
 
 Microsoft Defender ATP detections will appear as discrete events, with "Microsoft” as the vendor and “Windows Defender ATP” as the device name.
 
 
-## Troubleshooting HP ArcSight connection
+## Troubleshooting Micro Focus ArcSight connection
+
 **Problem:** Failed to refresh the token. You can find the log located in C:\\*folder_location*\current\logs where *folder_location* represents the location where you installed the tool. Open _agent.log_ and look for `ERROR/FATAL/WARN`.
 
 **Symptom:** You get the following error message:
@@ -177,7 +187,9 @@ Microsoft Defender ATP detections will appear as discrete events, with "Microsof
 `Failed to refresh the token. Set reauthenticate to true: com.arcsight.common.al.e: Failed to refresh access token: status=HTTP/1.1 400 Bad Request FATAL EXCEPTION: Could not refresh the access token`
 
 **Solution:**
+
 1. Stop the process by clicking Ctrl + C on the Connector window. Click **Y** when asked "Terminate batch job Y/N?".
+
 2. Navigate to the folder where you stored the WDATP-connector.properties file and edit it to add the following value:
    `reauthenticate=true`.
 

windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md

@@ -43,6 +43,9 @@ The choice of the channel determines the type and frequency of updates that are
 
 In order to preview new features and provide early feedback, it is recommended that you configure some devices in your enterprise to use either *insiders-fast* or *insiders-slow*.
 
+> [!WARNING]
+> Switching the channel after the initial installation requires the product to be reinstalled. To switch the product channel: uninstall the existing package, re-configure your device to use the new channel, and follow the steps in this document to install the package from the new location.
+
 ### RHEL and variants (CentOS and Oracle Linux)
 
 - Note your distribution and version, and identify the closest entry for it under `https://packages.microsoft.com/config/`.
@@ -201,15 +204,19 @@ Download the onboarding package from Microsoft Defender Security Center:
 4. From a command prompt, verify that you have the file.
     Extract the contents of the archive:
 
-    ```bash
+```bash
-    ls -l
+ls -l
-    total 8
+```
-    -rw-r--r-- 1 test  staff  5752 Feb 18 11:22 WindowsDefenderATPOnboardingPackage.zip
 
-    unzip WindowsDefenderATPOnboardingPackage.zip
+`total 8`
-    Archive:  WindowsDefenderATPOnboardingPackage.zip
+`-rw-r--r-- 1 test  staff  5752 Feb 18 11:22 WindowsDefenderATPOnboardingPackage.zip`
-    inflating: WindowsDefenderATPOnboarding.py
+
-    ```
+```bash
+unzip WindowsDefenderATPOnboardingPackage.zip
+```
+
+`Archive:  WindowsDefenderATPOnboardingPackage.zip`
+`inflating: WindowsDefenderATPOnboarding.py`
 
 ## Client configuration
 
@@ -231,14 +238,12 @@ Download the onboarding package from Microsoft Defender Security Center:
 
     ```bash
     mdatp --health orgId
-    [your organization identifier]
     ```
 
 4. A few minutes after you complete the installation, you can see the status by running the following command. A return value of `1` denotes that the product is functioning as expected:
 
     ```bash
     mdatp --health healthy
-    1
     ```
 
     > [!IMPORTANT]
@@ -248,22 +253,21 @@ Download the onboarding package from Microsoft Defender Security Center:
 
     - Ensure that real-time protection is enabled (denoted by a result of `1` from running the following command):
 
-        ```bash
+    ```bash
-        mdatp --health realTimeProtectionEnabled
+    mdatp --health realTimeProtectionEnabled
-        1
+    ```
-        ```
 
     - Open a Terminal window. Copy and execute the following command:
 
-        ``` bash
+    ``` bash
-        curl -o ~/Downloads/eicar.com.txt https://www.eicar.org/download/eicar.com.txt
+    curl -o ~/Downloads/eicar.com.txt https://www.eicar.org/download/eicar.com.txt
-        ```
+    ```
 
     - The file should have been quarantined by Microsoft Defender ATP for Linux. Use the following command to list all the detected threats:
 
-        ```bash
+    ```bash
-        mdatp --threat --list --pretty
+    mdatp --threat --list --pretty
-        ```
+    ```
 
 ## Log installation issues
 

windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md

@@ -139,6 +139,9 @@ Create subtask or role files that contribute to an actual task. First create the
 
     In order to preview new features and provide early feedback, it is recommended that you configure some devices in your enterprise to use either *insiders-fast* or *insiders-slow*.
 
+    > [!WARNING]
+    > Switching the channel after the initial installation requires the product to be reinstalled. To switch the product channel: uninstall the existing package, re-configure your device to use the new channel, and follow the steps in this document to install the package from the new location.
+
     Note your distribution and version and identify the closest entry for it under `https://packages.microsoft.com/config/`.
 
     In the following commands, replace *[distro]* and *[version]* with the information you've identified.

windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md

@@ -1,6 +1,6 @@
 ---
 title: Deploy Microsoft Defender ATP for Linux with Puppet
-ms.reviewer: 
+ms.reviewer:
 description: Describes how to deploy Microsoft Defender ATP for Linux using Puppet.
 keywords: microsoft, defender, atp, linux, installation, deploy, uninstallation, puppet, ansible, linux, redhat, ubuntu, debian, sles, suse, centos
 search.product: eADQiWindows 10XVcnh
@@ -14,7 +14,7 @@ author: dansimp
 ms.localizationpriority: medium
 manager: dansimp
 audience: ITPro
-ms.collection: M365-security-compliance 
+ms.collection: M365-security-compliance
 ms.topic: conceptual
 ---
 
@@ -48,7 +48,7 @@ Download the onboarding package from Microsoft Defender Security Center:
     ![Microsoft Defender Security Center screenshot](images/atp-portal-onboarding-linux-2.png)
 
 4. From a command prompt, verify that you have the file. Extract the contents of the archive:
-  
+
     ```bash
     $ ls -l
     total 8
@@ -60,7 +60,7 @@ Download the onboarding package from Microsoft Defender Security Center:
 
 ## Create a Puppet manifest
 
-You need to create a Puppet manifest for deploying Microsoft Defender ATP for Linux to devices managed by a Puppet server. This example makes use of the *apt* module available from puppetlabs, and assumes that the apt module has been installed on your Puppet server.
+You need to create a Puppet manifest for deploying Microsoft Defender ATP for Linux to devices managed by a Puppet server. This example makes use of the *apt* and *yumrepo* modules available from puppetlabs, and assumes that the modules have been installed on your Puppet server.
 
 Create the folders *install_mdatp/files* and *install_mdatp/manifests* under the modules folder of your Puppet installation. This is typically located in */etc/puppetlabs/code/environments/production/modules* on your Puppet server. Copy the mdatp_onboard.json file created above to the *install_mdatp/files* folder. Create an *init.pp* file that contains the deployment instructions:
 
@@ -84,46 +84,74 @@ The choice of the channel determines the type and frequency of updates that are
 
 In order to preview new features and provide early feedback, it is recommended that you configure some devices in your enterprise to use either *insiders-fast* or *insiders-slow*.
 
+> [!WARNING]
+> Switching the channel after the initial installation requires the product to be reinstalled. To switch the product channel: uninstall the existing package, re-configure your device to use the new channel, and follow the steps in this document to install the package from the new location.
+
 Note your distribution and version and identify the closest entry for it under `https://packages.microsoft.com/config/`.
 
 In the below commands, replace *[distro]* and *[version]* with the information you've identified:
 
 > [!NOTE]
-> In case of Oracle Linux, replace *[distro]* with “rhel”.
+> In case of RedHat, Oracle EL, and CentOS 8, replace *[distro]* with 'rhel'.
 
 ```puppet
-class install_mdatp {
+# Puppet manifest to install Microsoft Defender ATP.
+# @param channel The release channel based on your environment, insider-fast or prod.
+# @param distro The Linux distribution in lowercase. In case of RedHat, Oracle EL, and CentOS 8, the distro variable should be 'rhel'.
+# @param version The Linux distribution release number, e.g. 7.4.
 
-    if ($osfamily == 'Debian') {
+class install_mdatp (
-        apt::source { 'microsoftpackages' :
+$channel = 'insiders-fast',
-            location => 'https://packages.microsoft.com/[distro]/[version]/prod', # change the version and distro based on your OS 
+$distro = undef,
-            release  => '[channel]',
+$version = undef
-            repos    => 'main',
+){
-            key      => {
+    case $::osfamily {
-                'id'     => 'BC528686B50D79E339D3721CEB3E94ADBE1229CF',
+        'Debian' : {
-                'server' => 'https://packages.microsoft.com/keys/microsoft.asc',
+            apt::source { 'microsoftpackages' :
-            },
+                location => "https://packages.microsoft.com/${distro}/${version}/prod",
+                release  => $channel,
+                repos    => 'main',
+                key      => {
+                    'id'     => 'BC528686B50D79E339D3721CEB3E94ADBE1229CF',
+                    'server' => 'keyserver.ubuntu.com',
+                },
+            }
         }
-    }
+        'RedHat' : {
-    else {
+            yumrepo { 'microsoftpackages' :
-        yumrepo { 'microsoftpackages' :
+                baseurl  => "https://packages.microsoft.com/${distro}/${version}/${channel}",
-            baseurl  => 'https://packages.microsoft.com/[distro]/[version]/[channel]', # change the version and distro based on your OS 
+                descr    => "packages-microsoft-com-prod-${channel}",
-            enabled  => 1,
+                enabled  => 1,
-            gpgcheck => 1,
+                gpgcheck => 1,
-            gpgkey   => 'https://packages.microsoft.com/keys/microsoft.asc'
+                gpgkey   => 'https://packages.microsoft.com/keys/microsoft.asc'
+            }
         }
+        default : { fail("${::osfamily} is currently not supported.") }
     }
 
-    package { 'mdatp':
+    case $::osfamily {
-        ensure => 'installed',
+        /(Debian|RedHat)/: {
-    }
+            file { ['/etc/opt', '/etc/opt/microsoft', '/etc/opt/microsoft/mdatp']:
+                ensure => directory,
+                owner  => root,
+                group  => root,
+                mode   => '0755'
+            }
 
-    file { ['/etc', '/etc/opt', '/etc/opt/microsoft', '/etc/opt/microsoft/mdatp']:
+            file { '/etc/opt/microsoft/mdatp/mdatp_onboard.json':
-        ensure => directory,
+                source  => 'puppet:///modules/mdatp/mdatp_onboard.json',
-    }
+                owner   => root,
-    file { '/etc/opt/microsoft/mdatp/mdatp_onboard.json':
+                group   => root,
-        mode => "0644",
+                mode    => '0600',
-        source => 'puppet:///modules/install_mdatp/mdatp_onboard.json',
+                require => File['/etc/opt/microsoft/mdatp']
+            }
+
+            package { 'mdatp':
+                ensure  => 'installed',
+                require => File['/etc/opt/microsoft/mdatp/mdatp_onboard.json']
+            }
+        }
+        default : { fail("${::osfamily} is currently not supported.") }
     }
 }
 ```
@@ -162,7 +190,7 @@ orgId                                   : "[your organization identifier]"
 You can check that devices have been correctly onboarded by creating a script. For example, the following script checks enrolled devices for onboarding status:
 
 ```bash
-$ mdatp --health healthy
+mdatp --health healthy
 ```
 
 The above command prints `1` if the product is onboarded and functioning as expected.

windows/security/threat-protection/microsoft-defender-atp/mac-preferences.md

@@ -310,17 +310,6 @@ Manage the preferences of the endpoint detection and response (EDR) component of
 | **Data type** | Dictionary (nested preference) |
 | **Comments** | See the following sections for a description of the dictionary contents. |
 
-#### Enable / disable early preview
-
-Specify whether to enable EDR early preview features.
-
-|||
-|:---|:---|
-| **Domain** | `com.microsoft.wdav` |
-| **Key** | earlyPreview |
-| **Data type** | Boolean |
-| **Possible values** | true (default) <br/> false |
-
 #### Device tags
 
 Specify a tag name and its value. 

windows/security/threat-protection/windows-defender-application-guard/install-wd-app-guard.md

@@ -28,7 +28,7 @@ See [System requirements for Windows Defender Application Guard](https://docs.mi
 ## Prepare for Windows Defender Application Guard 
 Before you can install and use Windows Defender Application Guard, you must determine which way you intend to use it in your enterprise. You can use Application Guard in either **Standalone** or **Enterprise-managed** mode.
 
-**Standalone mode**
+### Standalone mode
 
 Applies to:
 - Windows 10 Enterprise edition, version 1709 or higher
@@ -36,7 +36,7 @@ Applies to:
 
 Employees can use hardware-isolated browsing sessions without any administrator or management policy configuration. In this mode,   you must install Application Guard and then the employee must manually start Microsoft Edge in Application Guard while browsing untrusted sites. For an example of how this works, see the [Application Guard in standalone mode](test-scenarios-wd-app-guard.md) testing scenario.
 
-**Enterprise-managed mode** 
+## Enterprise-managed mode
 
 Applies to:
 - Windows 10 Enterprise edition, version 1709 or higher
@@ -47,9 +47,11 @@ The following diagram shows the flow between the host PC and the isolated contai
 ![Flowchart for movement between Microsoft Edge and Application Guard](images/application-guard-container-v-host.png)
 
 ## Install Application Guard
-Application Guard functionality is turned off by default. However, you can quickly install it on your employee’s devices through the Control Panel, PowerShell, or your mobile device management (MDM) solution.
 
-**To install by using the Control Panel**
+Application Guard functionality is turned off by default. However, you can quickly install it on your employee's devices through the Control Panel, PowerShell, or your mobile device management (MDM) solution.
+
+### To install by using the Control Panel
+
 1. Open the **Control Panel**, click **Programs,** and then click **Turn Windows features on or off**.
 
     ![Windows Features, turning on Windows Defender Application Guard](images/turn-windows-features-on.png)
@@ -58,12 +60,11 @@ Application Guard functionality is turned off by default. However, you can quick
 
    Application Guard and its underlying dependencies are all installed.
 
-**To install by using PowerShell**
+### To install by using PowerShell
 
 >[!NOTE]
 >Ensure your devices have met all system requirements prior to this step. PowerShell will install the feature without checking system requirements. If your devices don't meet the system requirements, Application Guard may not work. This step is recommended for enterprise managed scenarios only.
 
-
 1. Click the **Search** or **Cortana** icon in the Windows 10 taskbar and type **PowerShell**.
    
 2. Right-click **Windows PowerShell**, and then click **Run as administrator**.
@@ -79,3 +80,46 @@ Application Guard functionality is turned off by default. However, you can quick
 
    Application Guard and its underlying dependencies are all installed.
 
+### To install by using Intune
+
+> [!IMPORTANT]
+> Make sure your organization's devices meet [requirements](reqs-wd-app-guard.md) and are [enrolled in Intune](https://docs.microsoft.com/mem/intune/enrollment/device-enrollment).
+
+:::image type="complex" source="images/MDAG-EndpointMgr-newprofile.jpg" alt-text="Endpoint protection profile":::
+
+:::image-end:::
+
+1. Go to [https://endpoint.microsoft.com](https://endpoint.microsoft.com) and sign in.
+
+2. Choose **Devices** > **Configuration profiles** > **+ Create profile**, and do the following: <br/>
+
+   a. In the **Platform** list, select **Windows 10 and later**. 
+   
+   b. In the **Profile** list, select **Endpoint protection**. 
+   
+   c. Choose **Create**.
+
+4. Specify the following settings for the profile:
+
+   - **Name** and **Description**
+
+   - In the **Select a category to configure settings** section, choose **Microsoft Defender Application Guard**.
+
+   - In the **Application Guard** list, choose **Enabled for Edge**.
+
+   - Choose your preferences for **Clipboard behavior**, **External content**, and the remaining settings.
+
+5. Choose **OK**, and then choose **OK** again.
+
+6. Review your settings, and then choose **Create**.
+
+7. Choose **Assignments**, and then do the following:
+
+   a. On the **Include** tab, in the **Assign to** list, choose an option.
+
+   b. If you have any devices or users you want to exclude from this endpoint protection profile, specify those on the **Exclude** tab.
+
+   c. Click **Save**.
+
+After the profile is created, any devices to which the policy should apply will have Windows Defender Application Guard enabled. Users might have to restart their devices in order for protection to be in place.
+

windows/security/threat-protection/windows-defender-application-guard/test-scenarios-wd-app-guard.md

@@ -8,7 +8,6 @@ ms.pagetype: security
 ms.localizationpriority: medium
 author: denisebmsft
 ms.author: deniseb
-ms.date: 03/15/2019
 ms.reviewer: 
 manager: dansimp
 ms.custom: asr
@@ -28,9 +27,9 @@ We've come up with a list of scenarios that you can use to test hardware-based i
 
 You can see how an employee would use standalone mode with Application Guard.
 
-**To test Application Guard in Standalone mode**
+### To test Application Guard in Standalone mode
 
-1.	[Install Application Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/install-wd-app-guard).
+1.    [Install Application Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/install-wd-app-guard).
 
 2. Restart the device, start Microsoft Edge, and then click **New Application Guard window** from the menu.
 
@@ -84,11 +83,11 @@ Before you can use Application Guard in enterprise mode, you must install Window
 
 6. Start Microsoft Edge and type <em>www.microsoft.com</em>.
     
-    After you submit the URL, Application Guard determines the URL is trusted because it uses the domain you’ve marked as trusted and shows the site directly on the host PC instead of in Application Guard.
+    After you submit the URL, Application Guard determines the URL is trusted because it uses the domain you've marked as trusted and shows the site directly on the host PC instead of in Application Guard.
 
     ![Trusted website running on Microsoft Edge](images/appguard-turned-on-with-trusted-site.png)
 
-7. In the same Microsoft Edge browser, type any URL that isn’t part of your trusted or neutral site lists.
+7. In the same Microsoft Edge browser, type any URL that isn't part of your trusted or neutral site lists.
  
    After you submit the URL, Application Guard determines the URL is untrusted and redirects the request to the hardware-isolated environment.
 
@@ -109,7 +108,7 @@ Application Guard provides the following default behavior for your employees:
 You have the option to change each of these settings to work with your enterprise from within Group Policy.
 
 **Applies to:**
-- Windows 10 Enterpise edition, version 1709 or higher
+- Windows 10 Enterprise edition, version 1709 or higher
 - Windows 10 Professional edition, version 1803
 
 #### Copy and paste options
@@ -169,10 +168,10 @@ You have the option to change each of these settings to work with your enterpris
     The previously added site should still appear in your **Favorites** list.
 
     >[!NOTE]
-    >If you don't allow or turn off data persistence, restarting a device or logging in and out of the isolated container triggers a recycle event that discards all generated data, including session cookies, Favorites, and so on, removing the data from Application Guard. If you turn on data persistence, all employee-generated artifacts are preserved across container recycle events. However, these artifacts only exist in the isolated container and aren’t shared with the host PC. This data persists after restarts and even through build-to-build upgrades of Windows 10.<br><br>If you turn on data persistence, but later decide to stop supporting it for your employees, you can use our Windows-provided utility to reset the container and to discard any personal data.<br><br>**To reset the container, follow these steps:**<br/>1. Open a command-line program and navigate to Windows/System32.<br/>2. Type `wdagtool.exe cleanup`. The container environment is reset, retaining only the employee-generated data.<br/>3. Type `wdagtool.exe cleanup RESET_PERSISTENCE_LAYER`. The container environment is reset, including discarding all employee-generated data.
+    >If you don't allow or turn off data persistence, restarting a device or logging in and out of the isolated container triggers a recycle event that discards all generated data, including session cookies, Favorites, and so on, removing the data from Application Guard. If you turn on data persistence, all employee-generated artifacts are preserved across container recycle events. However, these artifacts only exist in the isolated container and aren't shared with the host PC. This data persists after restarts and even through build-to-build upgrades of Windows 10.<br><br>If you turn on data persistence, but later decide to stop supporting it for your employees, you can use our Windows-provided utility to reset the container and to discard any personal data.<br><br>**To reset the container, follow these steps:**<br/>1. Open a command-line program and navigate to Windows/System32.<br/>2. Type `wdagtool.exe cleanup`. The container environment is reset, retaining only the employee-generated data.<br/>3. Type `wdagtool.exe cleanup RESET_PERSISTENCE_LAYER`. The container environment is reset, including discarding all employee-generated data.
     
 **Applies to:**
-- Windows 10 Enterpise edition, version 1803
+- Windows 10 Enterprise edition, version 1803
 - Windows 10 Professional edition, version 1803
 
 #### Download options
@@ -202,7 +201,7 @@ You have the option to change each of these settings to work with your enterpris
 4. Assess the visual experience and battery performance. 
 
 **Applies to:**
-- Windows 10 Enterpise edition, version 1809
+- Windows 10 Enterprise edition, version 1809
 - Windows 10 Professional edition, version 1809
 
 #### File trust options

windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md

@@ -40,7 +40,7 @@ SmartScreen uses registry-based Administrative Template policy settings. For mor
 <tr>
 <td>Administrative Templates\Windows Components\Windows Defender SmartScreen\Explorer\Configure App Install Control</td>
 <td>Windows 10, version 1703</td>
-<td>This policy setting is intended to prevent malicious content from affecting your user's devices when downloading executable content from the internet.<p>This setting does not protect against malicious content from USB devices, network shares or other non-internet sources.<p><strong>Important:</strong> Using a trustworthy browser helps ensure that these protections work as expected.</td>
+<td>This policy setting is intended to prevent malicious content from affecting your user's devices when downloading executable content from the internet.</br></br>This setting does not protect against malicious content from USB devices, network shares or other non-internet sources.</p><p><strong>Important:</strong> Using a trustworthy browser helps ensure that these protections work as expected.</p></td>
 </tr>
 <tr>
 <td><strong>Windows 10, version 1703:</strong><br>Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Configure Windows Defender SmartScreen<p><strong>Windows 10, Version 1607 and earlier:</strong><br>Administrative Templates\Windows Components\Microsoft Edge\Configure Windows SmartScreen</td>

windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md

@@ -21,12 +21,13 @@ manager: dansimp
 
 - Windows 10
 - Windows 10 Mobile
+- Microsoft Edge
 
-Windows Defender SmartScreen protects against phishing or malware websites, and the downloading of potentially malicious files.
+Windows Defender SmartScreen protects against phishing or malware websites and applications, and the downloading of potentially malicious files.
 
 **Windows Defender SmartScreen determines whether a site is potentially malicious by:**
 
-- Analyzing visited webpages looking for indications of suspicious behavior. If Windows Defender Smartscreen determines that a page is suspicious, it will show a warning page to advise caution.
+- Analyzing visited webpages looking for indications of suspicious behavior. If Windows Defender SmartScreen determines that a page is suspicious, it will show a warning page to advise caution.
 
 - Checking the visited sites against a dynamic list of reported phishing sites and malicious software sites. If it finds a match, Windows Defender SmartScreen shows a warning to let the user know that the site might be malicious.
 
@@ -36,16 +37,13 @@ Windows Defender SmartScreen protects against phishing or malware websites, and
 
 - Checking downloaded files against a list of files that are well known and downloaded by many Windows users. If the file isn't on that list, Windows Defender SmartScreen shows a warning, advising caution.
 
-    >[!NOTE]
-    >Before Windows 10, version 1703, this feature was called _the SmartScreen filter_ when used within the browser and _Windows SmartScreen_ when used outside of the browser.
-
 ## Benefits of Windows Defender SmartScreen
 
 Windows Defender SmartScreen provide an early warning system against websites that might engage in phishing attacks or attempt to distribute malware through a socially-engineered attack. The primary benefits are:
 
-- **Anti-phishing and anti-malware support.** Windows Defender SmartScreen helps to protect your employees from sites that are reported to host phishing attacks or attempt to distribute malicious software. It can also help protect against deceptive advertisements, scam sites, and drive-by attacks. Drive-by attacks are web-based attacks that tend to start on a trusted site, targeting security vulnerabilities in commonly-used software. Because drive-by attacks can happen even if the user does not click or download anything on the page, the danger often goes unnoticed. For more info about drive-by attacks, see [Evolving Windows Defender SmartScreen to protect you from drive-by attacks](https://blogs.windows.com/msedgedev/2015/12/16/SmartScreen-drive-by-improvements/#3B7Bb8bzeAPq8hXE.97)
+- **Anti-phishing and anti-malware support.** Windows Defender SmartScreen helps to protect users from sites that are reported to host phishing attacks or attempt to distribute malicious software. It can also help protect against deceptive advertisements, scam sites, and drive-by attacks. Drive-by attacks are web-based attacks that tend to start on a trusted site, targeting security vulnerabilities in commonly used software. Because drive-by attacks can happen even if the user does not click or download anything on the page, the danger often goes unnoticed. For more info about drive-by attacks, see [Evolving Windows Defender SmartScreen to protect you from drive-by attacks](https://blogs.windows.com/msedgedev/2015/12/16/SmartScreen-drive-by-improvements/#3B7Bb8bzeAPq8hXE.97)
 
-- **Reputation-based URL and app protection.** Windows Defender SmartScreen evaluates a website's URLs to determine if they're known to distribute or host unsafe content. It also provides reputation checks for apps, checking downloaded programs and the digital signature used to sign a file. If a URL, a file, an app, or a certificate has an established reputation, your employees won't see any warnings. If however there's no reputation, the item is marked as a higher risk and presents a warning to the employee.
+- **Reputation-based URL and app protection.** Windows Defender SmartScreen evaluates a website's URLs to determine if they're known to distribute or host unsafe content. It also provides reputation checks for apps, checking downloaded programs and the digital signature used to sign a file. If a URL, a file, an app, or a certificate has an established reputation, users won't see any warnings. If, however, there's no reputation, the item is marked as a higher risk and presents a warning to the user.
 
 - **Operating system integration.** Windows Defender SmartScreen is integrated into the Windows 10 operating system, meaning that it checks any files an app (including 3rd-party browsers and email clients) attempts to download and run.
 
@@ -53,14 +51,14 @@ Windows Defender SmartScreen provide an early warning system against websites th
 
 - **Management through Group Policy and Microsoft Intune.** Windows Defender SmartScreen supports using both Group Policy and Microsoft Intune settings. For more info about all available settings, see [Available Windows Defender SmartScreen Group Policy and mobile device management (MDM) settings](windows-defender-smartscreen-available-settings.md).
 
-- **Blocking URLs associated with potentially unwanted applications.** In the next major version of Microsoft Edge (based on Chromium), SmartScreen will blocks URLs associated with potentially unwanted applications, or PUAs. For more information on blocking URLs associated with PUAs, see [Detect and block potentially unwanted applications](../windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md).
+- **Blocking URLs associated with potentially unwanted applications.** In Microsoft Edge (based on Chromium), SmartScreen blocks URLs associated with potentially unwanted applications, or PUAs. For more information on blocking URLs associated with PUAs, see [Detect and block potentially unwanted applications](../windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md).
 
 > [!IMPORTANT]
 > SmartScreen protects against malicious files from the internet. It does not protect against malicious files on internal locations or network shares, such as shared folders with UNC paths or SMB/CIFS shares.
 
 ## Viewing Windows Defender SmartScreen anti-phishing events
 
-When Windows Defender SmartScreen warns or blocks an employee from a website, it's logged as [Event 1035 - Anti-Phishing](https://technet.microsoft.com/scriptcenter/dd565657(v=msdn.10).aspx).
+When Windows Defender SmartScreen warns or blocks a user from a website, it's logged as [Event 1035 - Anti-Phishing](https://technet.microsoft.com/scriptcenter/dd565657(v=msdn.10).aspx).
 
 ## Viewing Windows event logs for Windows Defender SmartScreen
 Windows Defender SmartScreen events appear in the Microsoft-Windows-SmartScreen/Debug log in Event Viewer.
@@ -82,8 +80,5 @@ EventID | Description
 1002 | User Decision Windows Defender SmartScreen Event
 
 ## Related topics
-- [Windows Defender SmartScreen Frequently Asked Questions (FAQ)](https://feedback.smartscreen.microsoft.com/smartscreenfaq.aspx)
-
-- [SmartScreen Frequently Asked Questions (FAQ)](https://feedback.smartscreen.microsoft.com/smartscreenfaq.aspx)
 - [Threat protection](../index.md)
 - [Available Windows Defender SmartScreen Group Policy and mobile device management (MDM) settings](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings)

windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md

@@ -19,60 +19,65 @@ ms.author: macapara
 **Applies to:**
 - Windows 10, version 1703
 - Windows 10 Mobile
+- Microsoft Edge
 
-Windows Defender SmartScreen helps to protect your employees if they try to visit sites previously reported as phishing or malware websites, or if an employee tries to download potentially malicious files.
+Windows Defender SmartScreen helps to protect users if they try to visit sites previously reported as phishing or malware websites, or if a user tries to download potentially malicious files.
 
-## How employees can use Windows Security to set up Windows Defender SmartScreen
+## How users can use Windows Security to set up Windows Defender SmartScreen
-Starting with Windows 10, version 1703 your employees can use Windows Security to set up Windows Defender SmartScreen for an individual device; unless you've used Group Policy or Microsoft Intune to prevent it.
+Starting with Windows 10, version 1703, users can use Windows Security to set up Windows Defender SmartScreen for an individual device; unless and administrator has used Group Policy or Microsoft Intune to prevent it.
 
 >[!NOTE]
 >If any of the following settings are managed through Group Policy or mobile device management (MDM) settings, it appears as unavailable to the employee.
 
 **To use Windows Security to set up Windows Defender SmartScreen on a device**
-1. Open the Windows Security app, and then click **App & browser control**.
+1. Open the Windows Security app, and then select **App & browser control** > **Reputation-based protection settings**.
 
-2. In the **App & browser control** screen, choose from the following options:
+2. In the **Reputation-based protection** screen, choose from the following options:
 
    - In the **Check apps and files** area:
-    
-       - **Block.** Stops employees from downloading and running unrecognized apps and files from the web.
 
-       - **Warn.** Warns employees that the apps and files being downloaded from the web are potentially dangerous, but allows the action to continue.
+       - **On.** Warns users that the apps and files being downloaded from the web are potentially dangerous but allows the action to continue.
 
-       - **Off.** Turns off Windows Defender SmartScreen, so an employee isn't alerted or stopped from downloading potentially malicious apps and files.
+       - **Off.** Turns off Windows Defender SmartScreen, so a user isn't alerted or stopped from downloading potentially malicious apps and files.
 
    - In the **Windows Defender SmartScreen for Microsoft Edge** area:
-    
-       - **Block.** Stops employees from downloading and running unrecognized apps and files from the web, while using Microsoft Edge.
         
-       - **Warn.** Warns employees that sites and downloads are potentially dangerous, but allows the action to continue while running in Microsoft Edge.
+       - **On.** Warns users that sites and downloads are potentially dangerous but allows the action to continue while running in Microsoft Edge.
         
-       - **Off.** Turns off Windows Defender SmartScreen, so an employee isn't alerted or stopped from downloading potentially malicious apps and files.    
+       - **Off.** Turns off Windows Defender SmartScreen, so a user isn't alerted or stopped from downloading potentially malicious apps and files.
+   - In the **Potentially unwanted app blocking** area:
+
+      - **On.** Turns on both the 'Block apps' and 'Block downloads settings. To learn more, see [How Microsoft identifies malware and potentially unwanted applications](https://docs.microsoft.com/windows/security/threat-protection/intelligence/criteria#potentially-unwanted-application-pua).
+          - **Block apps.** This setting will prevent new apps from installing on the device and warn users of apps that are existing on the device.
+
+          - **Block downloads.** This setting will alert users and stop the downloads of apps in the Microsoft Edge browser (based on Chromium).
+
+      - **Off.** Turns off Potentially unwanted app blocking, so a user isn't alerted or stopped from downloading or installing potentially unwanted apps.
 
    - In the **Windows Defender SmartScreen from Microsoft Store apps** area:
         
-     - **Warn.** Warns employees that the sites and downloads used by Microsoft Store apps are potentially dangerous, but allows the action to continue.
+     - **On.** Warns users that the sites and downloads used by Microsoft Store apps are potentially dangerous but allows the action to continue.
         
-     - **Off.** Turns off Windows Defender SmartScreen, so an employee isn't alerted or stopped from visiting sites or from downloading potentially malicious apps and files.
+     - **Off.** Turns off Windows Defender SmartScreen, so a user isn't alerted or stopped from visiting sites or from downloading potentially malicious apps and files.
 
-       ![Windows Security, Windows Defender SmartScreen controls](images/windows-defender-smartscreen-control.png)
+       ![Windows Security, Windows Defender SmartScreen controls](images/windows-defender-smartscreen-control-2020.png)
 
-## How Windows Defender SmartScreen works when an employee tries to run an app
+## How Windows Defender SmartScreen works when a user tries to run an app
-Windows Defender SmartScreen checks the reputation of any web-based app the first time it's run from the Internet, checking digital signatures and other factors against a Microsoft-maintained service. If an app has no reputation or is known to be malicious, Windows Defender SmartScreen can warn the employee or block the app from running entirely, depending on how you've configured the feature to run in your organization.
+Windows Defender SmartScreen checks the reputation of any web-based app the first time it's run from the Internet, checking digital signatures and other factors against a Microsoft-maintained service. If an app has no reputation or is known to be malicious, Windows Defender SmartScreen can warn the user or block the app from running entirely, depending on how you've configured the feature to run in your organization.
 
-By default, your employees can bypass Windows Defender SmartScreen protection, letting them run legitimate apps after accepting a warning message prompt. You can also use Group Policy or Microsoft Intune to block employees from using unrecognized apps, or to entirely turn off Windows Defender SmartScreen (not recommended).
+By default, users can bypass Windows Defender SmartScreen protection, letting them run legitimate apps after accepting a warning message prompt. You can also use Group Policy or Microsoft Intune to block your employees from using unrecognized apps, or to entirely turn off Windows Defender SmartScreen (not recommended).
 
-## How employees can report websites as safe or unsafe
+## How users can report websites as safe or unsafe
-You can configure Windows Defender SmartScreen to warn employees from going to a potentially dangerous site. Employees can then choose to report a website as safe from the warning message or as unsafe from within Microsoft Edge and Internet Explorer 11.
+Windows Defender SmartScreen can be configured to warn users from going to a potentially dangerous site. Users can then choose to report a website as safe from the warning message or as unsafe from within Microsoft Edge and Internet Explorer 11.
 
 **To report a website as safe from the warning message**
 - On the warning screen for the site, click **More Information**, and then click **Report that this site does not contain threats**. The site info is sent to the Microsoft feedback site, which provides further instructions.
 
 **To report a website as unsafe from Microsoft Edge**
-- If a site seems potentially dangerous, employees can report it to Microsoft by clicking **More (...)**, clicking **Send feedback**, and then clicking **Report unsafe site**.
+- If a site seems potentially dangerous, users can report it to Microsoft by clicking **More (...)**, clicking **Send feedback**, and then clicking **Report unsafe site**.
 
 **To report a website as unsafe from Internet Explorer 11**
-- If a site seems potentially dangerous, employees can report it to Microsoft by clicking on the **Tools** menu, clicking **Windows Defender SmartScreen**, and then clicking **Report unsafe website**.
+- If a site seems potentially dangerous, users can report it to Microsoft by clicking on the **Tools** menu, clicking **Windows Defender SmartScreen**, and then clicking **Report unsafe website**.
 
 ## Related topics
 - [Threat protection](../index.md)