diff --git a/memdocs/configmgr/apps/deploy-use/manage-apps-from-the-windows-store-for-business.md b/memdocs/configmgr/apps/deploy-use/manage-apps-from-the-windows-store-for-business.md index 898039c0d9d..fe05e7e7a5a 100644 --- a/memdocs/configmgr/apps/deploy-use/manage-apps-from-the-windows-store-for-business.md +++ b/memdocs/configmgr/apps/deploy-use/manage-apps-from-the-windows-store-for-business.md @@ -29,7 +29,7 @@ The Microsoft Store for Business and Education supports two types of app: - **Offline**: This type lets you cache apps and licenses to deploy directly within your on-premises network. Devices don't need to connect to the store or have a connection to the internet. -For more information, see the [Microsoft Store for Business and Education overview](/microsoft-store/microsoft-store-for-business-overview). +For more information, see the [Microsoft Store for Business and Education overview](/mem/configmgr/apps/deploy-use/manage-apps-from-the-windows-store-for-business). ### Summary of capabilities @@ -64,7 +64,7 @@ Before deploying Microsoft Store for Business and Education apps to devices that - When the local Administrator account signs in on the device, it can't access Microsoft Store for Business and Education apps. -- Devices need a live internet connection to the Microsoft Store for Business and Education. For more information including proxy configuration, see [Prerequisites](/microsoft-store/prerequisites-microsoft-store-for-business). +- Devices need a live internet connection to the Microsoft Store for Business and Education. For more information including proxy configuration, see [Prerequisites](/mem/intune/apps/store-apps-microsoft). ## Set up synchronization @@ -72,13 +72,13 @@ When you synchronize the list of Microsoft Store for Business and Education apps Connect your Configuration Manager site to Microsoft Entra ID and the Microsoft Store for Business and Education. For more information and details of this process, see [Configure Azure services](../../core/servers/deploy/configure/azure-services-wizard.md). Create a connection to the **Microsoft Store for Business** service. -Make sure the service connection point and targeted devices can access the cloud service. For more information, see [Prerequisites for Microsoft Store for Business and Education - Proxy configuration](/microsoft-store/prerequisites-microsoft-store-for-business#proxy-configuration). +Make sure the service connection point and targeted devices can access the cloud service. For more information, see [Prerequisites for Microsoft Store for Business and Education - Proxy configuration](/mem/intune/apps/store-apps-microsoft). ### Supplemental information and configuration On the **App** page of the Azure Services Wizard, first configure the **Azure environment** and **Web app**. Then read the **More Information** section at the bottom of the page. This information includes the following other actions in the Microsoft Store for Business and Education portal: -- Configure Configuration Manager as the store management tool. For more information, see [Configure management provider](/microsoft-store/configure-mdm-provider-microsoft-store-for-business). +- Configure Configuration Manager as the store management tool. For more information, see [Configure management provider](/windows/client-management/azure-active-directory-integration-with-mdm). - Enable support for offline licensed apps. For more information, see [Distribute offline apps](/microsoft-store/distribute-offline-apps). diff --git a/memdocs/configmgr/comanage/autopilot-enrollment.md b/memdocs/configmgr/comanage/autopilot-enrollment.md index c66b33772e5..f8b1cd070a8 100644 --- a/memdocs/configmgr/comanage/autopilot-enrollment.md +++ b/memdocs/configmgr/comanage/autopilot-enrollment.md @@ -131,6 +131,8 @@ Use these recommendations for a more successful deployment: ## Limitations +- [Windows Autopilot device preparation](/autopilot/device-preparation/overview) policy doesn't support Autopilot into co-management. As a result, attempting to install co-management during the device preparation flow might result in failed deployments. + - For Windows 11 devices in Microsoft Entra hybrid joined scenario, the management authority will be set to Microsoft Intune during the Windows Autopilot process. Installing Configuration Manager client as Win32 app does not change management authority to Configuration Manager and Microsoft Intune will continue to manage all the co-management workloads. To change the management authority to Configuration Manager, set the following registry key value:
diff --git a/memdocs/configmgr/comanage/company-portal.md b/memdocs/configmgr/comanage/company-portal.md index 1009028794b..ee7cd4cfd49 100644 --- a/memdocs/configmgr/comanage/company-portal.md +++ b/memdocs/configmgr/comanage/company-portal.md @@ -83,7 +83,7 @@ For more information on client settings, see the following articles: - To require the app on co-managed devices, the deployment process depends upon the state of the [Client apps](workloads.md#client-apps) co-management workload: - - If the client apps workload is with Configuration Manager, [create and deploy an application with Configuration Manager](../apps/get-started/create-and-deploy-an-application.md). Download the offline Company Portal app from the [Microsoft Store for Business](https://www.microsoft.com/business-store). + - If the client apps workload is with Configuration Manager, [create and deploy an application with Configuration Manager](../apps/get-started/create-and-deploy-an-application.md). - If the client apps workload is with Intune, you can deploy it via Configuration Manager or [add the Company Portal app by using Microsoft Intune](../../intune/apps/store-apps-company-portal-app.md). diff --git a/memdocs/configmgr/core/get-started/2020/includes/2001/3721603.md b/memdocs/configmgr/core/get-started/2020/includes/2001/3721603.md index f32a6bb64c2..6214a4a8f95 100644 --- a/memdocs/configmgr/core/get-started/2020/includes/2001/3721603.md +++ b/memdocs/configmgr/core/get-started/2020/includes/2001/3721603.md @@ -19,7 +19,7 @@ Save Power BI Desktop report files (.PBIX) and deploy them to the Power BI Repor - Power BI Report Server license. For more information, see [Licensing Power BI Report Server](/power-bi/report-server/get-started#licensing-power-bi-report-server). -- Download [Microsoft Power BI Report Server-September 2019](https://www.microsoft.com/download/details.aspx?id=57270). +- Download [Microsoft Power BI Report Server-September 2024](https://www.microsoft.com/download/details.aspx?id=105945). - Download [Microsoft Power BI Desktop (Optimized for Power BI Report Server - September 2019)](https://www.microsoft.com/download/details.aspx?id=58494). diff --git a/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1604.md b/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1604.md index 85dfae9bfc4..eb0ad42ba58 100644 --- a/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1604.md +++ b/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1604.md @@ -23,7 +23,7 @@ This article introduces the features that are available in the Technical Preview The following are new features you can try out with this version. ## Manage volume-purchased apps from the Windows Store for Business - The [Windows Store for Business](https://www.microsoft.com/business-store) is where you can find and purchase apps for your organization, individually or in volume. By connecting the store to Configuration Manager, you can manage volume-purchased apps from the Configuration Manager console, for example: + The Windows Store for Business is where you can find and purchase apps for your organization, individually or in volume. By connecting the store to Configuration Manager, you can manage volume-purchased apps from the Configuration Manager console, for example: - You can synchronize the list of purchased apps with Configuration Manager @@ -35,7 +35,7 @@ This article introduces the features that are available in the Technical Preview ##### Scenario 1: Set up Windows Store for Business synchronization -1. In Microsoft Entra ID, register Configuration Manager as a "Web Application and/or Web API" management tool. This will give you a client ID that you will need later. +1. In Microsoft Entra ID, register Configuration Manager as a "Web Application and/or Web API" management tool. This will give you a client ID that you'll need later. 1. In the **Active Directory** node of [https://portal.azure.com](https://portal.azure.com), select your Microsoft Entra ID, then click **Applications** > **Add**. @@ -43,7 +43,7 @@ This article introduces the features that are available in the Technical Preview 3. Enter a name for the application, select **Web application** and/or **Web API**, then click the Next arrow. - 4. Enter the same URL for both the **Sign-on URL** and **App ID URI**. The URL can be anything and does not need to resolve to a real address. For example, you can enter **https://<yourdomain\>/sccm**. + 4. Enter the same URL for both the **Sign-on URL** and **App ID URI**. The URL can be anything and doesn't need to resolve to a real address. For example, you can enter **https://<yourdomain\>/sccm**. 5. Complete the wizard. @@ -51,11 +51,11 @@ This article introduces the features that are available in the Technical Preview 1. Highlight the application you just created and click **Configure**. - 2. Under **Keys**, select a duration from the list, and click **Save**. This will create a new client key. Do not navigate away from this page until you have successfully onboarded Windows Store for Business to Configuration Manager. + 2. Under **Keys**, select a duration from the list, and click **Save**. This will create a new client key. Don't navigate away from this page until you have successfully onboarded Windows Store for Business to Configuration Manager. 3. In the Windows Store for Business, configure Configuration Manager as the store management tool. - 1. Open [https://businessstore.microsoft.com/en-us/managementtools](https://businessstore.microsoft.com/en-us/managementtools) and sign-in if prompted. + 1. Open Windows Store for Business and sign-in if prompted. 2. Accept the terms of use if required. @@ -73,9 +73,9 @@ This article introduces the features that are available in the Technical Preview 6. On the **Home** tab, in the **Create** group, click **Add Windows Store for Business Account**. -7. Add your tenant ID, client id, and client key from Microsoft Entra ID, then complete the wizard. +7. Add your tenant ID, client ID, and client key from Microsoft Entra ID, then complete the wizard. -8. Once you are done, you will see the account you configured in the **Windows Store for Business Accounts** list in the Configuration Manager console. +8. Once you're done, you'll see the account you configured in the **Windows Store for Business Accounts** list in the Configuration Manager console. ##### Scenario 2: Create and deploy a Configuration Manager application from a Windows Store for Business offline licensed app @@ -103,7 +103,7 @@ This article introduces the features that are available in the Technical Preview ## Client settings to manage Client Cache Settings and client Peer Cache Technical preview version 1604 introduces two new device client settings that affect the use of a client's cache. Both can be used individually but are configured on the same property sheet for client settings and combine to help you manage deployment of content to your clients in remote locations. -- First is **client Peer Cache**, a built-in Configuration Manager solution for clients to share content with other clients directly from their local cache. For Peer Cache clients to share content, they must be members of the same boundary group. Peer Cache does not replace the use of other solutions like BracnchCache but instead works side-by-side to give you more options to extend traditional content deployment solutions like distribution points. +- First is **client Peer Cache**, a built-in Configuration Manager solution for clients to share content with other clients directly from their local cache. For Peer Cache clients to share content, they must be members of the same boundary group. Peer Cache doesn't replace the use of other solutions like BracnchCache but instead works side-by-side to give you more options to extend traditional content deployment solutions like distribution points. After you deploy client settings that enable Peer Cache to a collection, members of that collection can act as a peer content source for other clients in its boundary group. The client that operates as a peer content source will submit a list of available content it has cached to its management point. Then, when the next client in that boundary group requests that content, the peer cache source is offered as a potential content source along with all distribution points that are configured to be fast. The client selects a random content source from this combined pool of content sources. Clients will only seek content from a distribution point that is configured to be slow when no fast distribution points or peer cache sources are present in the boundary group. @@ -116,7 +116,7 @@ To help you understand the use of client Peer Cache, you can view the **Client D - You must configure your site with a **Network Access Account** that has **Full Control** to the cache folder on each client. By default, this is **%windir%\ccmcache** -- Clients can only transfer content using Peer Cache when they are members of the same boundary group. +- Clients can only transfer content using Peer Cache when they're members of the same boundary group. #### To configure Client Peer Cache client settings @@ -142,9 +142,9 @@ To help you understand the use of client Peer Cache, you can view the **Client D ## Support for Passport for Work as a KSP Configuration Manager lets you integrate with Microsoft Passport for Work which is an alternative sign-in method that uses Active Directory, or a Microsoft Entra account to replace a password, smart card, or virtual smart card. -Passport lets you use a user gesture to login, instead of a password. A user gesture might be a simple PIN, biometric authentication such as Windows Hello, or an external device such as a fingerprint reader. +Passport lets you use a user gesture to log in, instead of a password. A user gesture might be a simple PIN, biometric authentication such as Windows Hello, or an external device such as a fingerprint reader. -- You can use Configuration Manager to control which gestures users can and cannot use to login, and to configure PIN complexity requirements. +- You can use Configuration Manager to control which gestures users can and can't use to log in, and to configure PIN complexity requirements. - You can store authentication certificates in the Passport for Work key storage provider (KSP). @@ -162,4 +162,4 @@ When a user creates a Passport PIN, Windows sends a notification which Configura To try it out, configure on-premises Health Attestation Service using client agent settings. ## SmartLock setting for Android devices - A new setting, **Allow SmartLock and other trust agents** has been added to the **Android and Samsung KNOX** configuration item that lets you control the SmartLock feature on compatible Android devices. This phone capability, sometimes known as trust agents lets you disable or bypass the device lock screen password if the device is in a trusted location such as when it is connected to a specific Bluetooth device, or when it is near to an NFC tag. You can use this setting to prevent end users from configuring SmartLock. + A new setting, **Allow SmartLock and other trust agents** has been added to the **Android and Samsung KNOX** configuration item that lets you control the SmartLock feature on compatible Android devices. This phone capability, sometimes known as trust agents lets you disable or bypass the device lock screen password if the device is in a trusted location such as when it's connected to a specific Bluetooth device, or when it's near to an NFC tag. You can use this setting to prevent end users from configuring SmartLock. diff --git a/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1605.md b/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1605.md index ae2b899814a..5288d9918e5 100644 --- a/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1605.md +++ b/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1605.md @@ -48,7 +48,7 @@ This article introduces the features that are available in the Technical Preview The Prepare ConfigMgr Client step will now completely remove the Configuration Manager client, instead of only removing key information. When the task sequence deploys the captured operating system image it will install a new Configuration Manager client each time. ## Grace period for required application deployments - In some cases, you might want give users more time to install required application deployments beyond any deadlines you configured. For example, if an end user has just returned from vacation, they might have to wait for a long while as overdue application deployments are installed. However, they can still immediately install the application at any time they want. + In some cases, you might want to give users more time to install required application deployments beyond any deadlines you configured. For example, if an end user has just returned from vacation, they might have to wait for a long while as overdue application deployments are installed. However, they can still immediately install the application at any time they want. To help solve this problem, you can now define a **grace period** by deploying Configuration Manager client settings to a collection. @@ -79,7 +79,7 @@ Common actions such as **Retire/Wipe**, **Reset Passcode**, **Remote Lock**, and - On the main page of the **Devices** node (not all columns might be visible by default). ## Windows Store for Business apps - The [Windows Store for Business](https://www.microsoft.com/business-store) is where you can find and purchase apps for your organization, individually or in volume. By connecting the store to Configuration Manager, you can manage volume-purchased apps from the Configuration Manager console, for example: + The Windows Store for Business is where you can find and purchase apps for your organization, individually or in volume. By connecting the store to Configuration Manager, you can manage volume-purchased apps from the Configuration Manager console, for example: - You can synchronize the list of purchased apps with Configuration Manager @@ -111,7 +111,7 @@ Common actions such as **Retire/Wipe**, **Reset Passcode**, **Remote Lock**, and 3. In the Windows Store for Business, configure Configuration Manager as the store management tool. - 1. Open [https://businessstore.microsoft.com](https://businessstore.microsoft.com/) and sign-in if prompted. + 1. Open Windows Store for Business and sign-in if prompted. 2. Accept the terms of use if necessary. diff --git a/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1606.md b/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1606.md index ee3fcbdb05c..95b83dddb66 100644 --- a/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1606.md +++ b/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1606.md @@ -57,7 +57,7 @@ When you associate a collection with a device category, all devices in the categ ## Enforcement grace period for required application and software update deployments -In some cases, you might want give users more time to install required application deployments or software updates beyond any deadlines you configured. This might typically be required when a computer has been turned off for an extended period of time and needs to install a large number of application or update deployments. +In some cases, you might want to give users more time to install required application deployments or software updates beyond any deadlines you configured. This might typically be required when a computer has been turned off for an extended period of time and needs to install a large number of application or update deployments. For example, if an end user has just returned from vacation, they might have to wait for a long while as overdue application deployments are installed. To help solve this problem, you can now define an enforcement grace period by deploying Configuration Manager client settings to a collection. @@ -76,7 +76,7 @@ Similar options have been added to the software updates deployment wizard, autom Device Guard is a Windows 10 feature that uses hardware and software features to strictly control what is allowed to run on the device. -For more information, see [Introduction to Device Guard](/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control). +For more information, see [Introduction to Device Guard](/windows-server/security/security-and-assurance). In this release, Configuration Manager can interoperate with Device Guard and [Windows AppLocker](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd723678(v=ws.10)) so that executable and DLL files that are deployed with Configuration Manager are automatically trusted as they come from a Managed Installer, meaning that they will be allowed to run on the target device and other software will not be allowed to run unless explicitly allowed to run by other AppLocker rules. @@ -91,12 +91,12 @@ Like all AppLocker policies, policies with Managed Installer rules can run in tw For more information, see the following articles: -- [Device Guard introduction](/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control) +- [Device Guard introduction](/windows-server/security/security-and-assurance) - [Planning and getting started on the Windows Defender Application Control deployment process](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide) ## Multiple device management points for On-premises Mobile Device Management - With Technical Preview 1606, On\-premises Mobile Device Management (MDM) supports a new capability in Windows 10 Anniversary Update that automatically configures an enrolled device to have more than one device management point available for use. This capability allows the device to fallback to another device management point when the one it normal uses is not available. This capability only works for PCs with Windows 10 Anniversary Update installed. + With Technical Preview 1606, On\-premises Mobile Device Management (MDM) supports a new capability in Windows 10 Anniversary Update that automatically configures an enrolled device to have more than one device management point available for use. This capability allows the device to fall back to another device management point when the one it normal uses is not available. This capability only works for PCs with Windows 10 Anniversary Update installed. ### Try it out! @@ -150,7 +150,7 @@ You can create a custom SSL certificate for Cloud Proxy Service in the same way #### Export the client certificate's root -The easiest way to get export the root of the client certificates used on the network, is to open a client certificate on one of the domain-joined machines that has one and copy it. +The easiest way to get export the root of the client certificates used on the network is to open a client certificate on one of the domain-joined machines that has one and copy it. >[!NOTE] >Client certificates are required on any computer you want to manage with Cloud Proxy Service and on the site system server hosting the cloud proxy connector point. If you need to add a client certificate to any of these machines, see [Deploying the Client Certificate for Windows Computers](../plan-design/network/example-deployment-of-pki-certificates.md#BKMK_clouddp2008_cm2012). @@ -257,4 +257,4 @@ With Technical Preview 1606 several changes have been introduced that apply to U - **Renamed option for pre-production:** - In the Updates and Servicing node, the button what was named **Client options** is now renamed to **Promote Pre-production Client**. \ No newline at end of file + In the Updates and Servicing node, the button what was named **Client options** is now renamed to **Promote Pre-production Client**. diff --git a/memdocs/configmgr/core/plan-design/changes/whats-new-in-version-1606.md b/memdocs/configmgr/core/plan-design/changes/whats-new-in-version-1606.md index e0252ae279b..c42b62a9600 100644 --- a/memdocs/configmgr/core/plan-design/changes/whats-new-in-version-1606.md +++ b/memdocs/configmgr/core/plan-design/changes/whats-new-in-version-1606.md @@ -47,7 +47,7 @@ The following are changes to the Updates and Servicing node in the Configuration - **Prerequisites Check** - **Installation** - Additionally, there is now more detailed information for each step, including which log file you can view for more information. + Additionally, there's now more detailed information for each step, including which log file you can view for more information. - **New option to retry prerequisite failures:** In both the **Administration** and **Monitoring** workspaces, the **Updates and Servicing** node includes a new button on the ribbon called **Ignore prerequisite warnings**. @@ -71,7 +71,7 @@ Beginning with 1606, you must give consent to use pre-release features in Config ### New distribution point update behavior Update 1606 introduces changes that improve the availability of distribution points when you install future updates. -After update 1606 is installed, when you next install an update at that site that requires the automatic reinstallation of standard and pull-distribution point site system roles, all distribution points no longer go offline to update at the same time. Instead, the site server uses the site's content distribution settings to distribute the update to a subset of distribution points at any given time. The result is that only some distribution points go offline to install the update. This allows distribution points that have not yet begun to update, or that have completed the update, to remain online and able to provide content to clients. +After update 1606 is installed, when you next install an update at that site that requires the automatic reinstallation of standard and pull-distribution point site system roles, all distribution points no longer go offline to update at the same time. Instead, the site server uses the site's content distribution settings to distribute the update to a subset of distribution points at any given time. The result is that only some distribution points go offline to install the update. This allows distribution points that haven't yet begun to update, or that have completed the update, to remain online and able to provide content to clients. @@ -94,14 +94,14 @@ You can now configure the size of the cache folder on client computers with **Cl ### Support for multiple device management points -On-premises mobile device management (MDM) now supports a new capability in Windows 10 Anniversary Update that automatically configures an enrolled device to have more than one device management point available for use. This capability allows the device to fall back to another device management point, when the one it normally uses is not available. This capability only works for PCs and devices with the Windows 10 Anniversary Update installed. +On-premises mobile device management (MDM) now supports a new capability in Windows 10 Anniversary Update that automatically configures an enrolled device to have more than one device management point available for use. This capability allows the device to fall back to another device management point, when the one it normally uses isn't available. This capability only works for PCs and devices with the Windows 10 Anniversary Update installed. ## Application management ### Manage apps from the Windows Store for Business -The [Windows Store for Business](https://businessstore.microsoft.com/store/private-store) is where you can find and purchase Windows apps for your organization, either individually or in volume. By connecting the store to Configuration Manager, you can synchronize the list of apps you've purchased with Configuration Manager, view these in the Configuration Manager console, and deploy them like you would any other app. +The Windows Store for Business is where you can find and purchase Windows apps for your organization, either individually or in volume. By connecting the store to Configuration Manager, you can synchronize the list of apps you've purchased with Configuration Manager, view these in the Configuration Manager console, and deploy them like you would any other app. For details, see [Manage apps from the Windows Store for Business with Configuration Manager](../../../apps/deploy-use/manage-apps-from-the-windows-store-for-business.md). @@ -118,7 +118,7 @@ The Software Center user interface has been streamlined for easier discovery. * Multiple updates can now be selected for installation at once, or all updates can be installed at once by clicking **Install All**. ### Content status links -On the properties of an application or package, there is now a link that takes you to the status for that object. +On the properties of an application or package, there's now a link that takes you to the status for that object. ## Software updates @@ -133,7 +133,7 @@ You can now enable an option that lets Configuration Manager clients switch to a For details, see [Plan for software updates in Configuration Manager](../../../sum/plan-design/plan-for-software-updates.md#BKMK_ManuallySwitchSUPs). ### Restart options for Windows 10 clients after software update installation -When a software update that requires a restart is deployed by using Configuration Manager and is installed on a computer, a pending restart is scheduled. A restart dialog box is also displayed. Beginning in Configuration Manager version 1606, the options **Update and Restart** and **Update and Shutdown** are available whenever there is a pending restart for a Configuration Manager software update. These are available in the Windows power options of Windows 10 computers. After using one of these options, the restart dialog box will not display after the computer restarts. +When a software update that requires a restart is deployed by using Configuration Manager and is installed on a computer, a pending restart is scheduled. A restart dialog box is also displayed. Beginning in Configuration Manager version 1606, the options **Update and Restart** and **Update and Shutdown** are available whenever there's a pending restart for a Configuration Manager software update. These are available in the Windows power options of Windows 10 computers. After using one of these options, the restart dialog box won't display after the computer restarts. For details, see [Plan for software updates](../../../sum/plan-design/plan-for-software-updates.md#BKMK_RestartOptions). @@ -153,7 +153,7 @@ The OSDPreserveDriveLetter task sequence variable has been deprecated. Starting For details, see [Task sequence built-in variables](../../../osd/understand/task-sequence-variables.md). ### Customize the RamDisk TFTP window size for PXE-enabled distribution points -You can now customize the RamDisk window size for PXE-enabled distribution points. If you have customized your network, it could cause the boot image download to fail with a time-out error, because the window size is too large. The RamDisk Trivial File Transfer Protocol (TFTP) window size customization lets you optimize TFTP traffic when you are using PXE to meet your specific network requirements. +You can now customize the RamDisk window size for PXE-enabled distribution points. If you have customized your network, it could cause the boot image download to fail with a time-out error, because the window size is too large. The RamDisk Trivial File Transfer Protocol (TFTP) window size customization lets you optimize TFTP traffic when you're using PXE to meet your specific network requirements. For details, see [Prepare site system roles for operating system deployments with Configuration Manager](../../../osd/get-started/prepare-site-system-roles-for-operating-system-deployments.md#customize-the-ramdisk-tftp-block-and-window-sizes-on-pxe-enabled-distribution-points). @@ -162,7 +162,7 @@ For details, see [Prepare site system roles for operating system deployments wit ### Smart Lock setting for Android devices A new setting, **Allow Smart Lock and other trust agents**, has been added to the Android and Samsung KNOX Standard configuration item. -This setting lets you control the Smart Lock feature on compatible Android devices. This phone capability, sometimes known as "trust agents," lets you disable or bypass the device lock screen password if the device is in a trusted location. For example, a trusted location could be when it is connected to a specific Bluetooth device, or when it is near to an NFC tag. You can use this setting to prevent users from configuring Smart Lock. +This setting lets you control the Smart Lock feature on compatible Android devices. This phone capability, sometimes known as "trust agents," lets you disable or bypass the device lock screen password if the device is in a trusted location. For example, a trusted location could be when it's connected to a specific Bluetooth device, or when it's near to an NFC tag. You can use this setting to prevent users from configuring Smart Lock. ## Device configuration and protection @@ -197,7 +197,7 @@ Endpoint Protection can help manage and monitor Microsoft Defender for Endpoint. For details, see [Microsoft Defender for Endpoint](../../../protect/deploy-use/defender-advanced-threat-protection.md). ### Device categories -You can create device categories, which can be used to place devices in device collections automatically when you are using Configuration Manager with Microsoft Intune. Users are then required to choose a device category when they enroll a device in Intune. Additionally, you can change the category of a device from the Configuration Manager console. +You can create device categories, which can be used to place devices in device collections automatically when you're using Configuration Manager with Microsoft Intune. Users are then required to choose a device category when they enroll a device in Intune. Additionally, you can change the category of a device from the Configuration Manager console. ### Predeclare devices with IMEI or iOS serial numbers @@ -210,4 +210,4 @@ You can now enable Health Attestation services monitoring for Windows 10 PCs by For details, see [Health attestation for Configuration Manager](../../../core/servers/manage/health-attestation.md#how-to-enable-health-attestation-service-communication-on-configuration-manager-client-computers). ## Remote control -Allow your users the opportunity to accept or deny file transfers before transferring content from the shared clipboard in a remote control session. Users only need to grant permission once per session, and the viewer does not have the ability to give themselves permission to proceed with the file transfer. You can find this new setting in the **Administration** workspace. Go to **Client Settings**, and then in **Default Settings**, open the **Remote Tools** panel. +Allow your users the opportunity to accept or deny file transfers before transferring content from the shared clipboard in a remote control session. Users only need to grant permission once per session, and the viewer doesn't have the ability to give themselves permission to proceed with the file transfer. You can find this new setting in the **Administration** workspace. Go to **Client Settings**, and then in **Default Settings**, open the **Remote Tools** panel. diff --git a/memdocs/configmgr/core/plan-design/network/internet-endpoints.md b/memdocs/configmgr/core/plan-design/network/internet-endpoints.md index 0b73c8853cc..18c020c93f2 100644 --- a/memdocs/configmgr/core/plan-design/network/internet-endpoints.md +++ b/memdocs/configmgr/core/plan-design/network/internet-endpoints.md @@ -106,7 +106,7 @@ If you enroll Windows devices to Microsoft Intune for co-management, make sure t ## Microsoft Store for Business -If you integrate Configuration Manager with the [Microsoft Store for Business](../../../apps/deploy-use/manage-apps-from-the-windows-store-for-business.md), make sure the service connection point and targeted devices can access the cloud service. For more information, see [Microsoft Store for Business proxy configuration](/microsoft-store/prerequisites-microsoft-store-for-business#proxy-configuration). +If you integrate Configuration Manager with the [Microsoft Store for Business](../../../apps/deploy-use/manage-apps-from-the-windows-store-for-business.md), make sure the service connection point and targeted devices can access the cloud service. For more information, see [Microsoft Store for Business proxy configuration](/mem/intune/fundamentals/intune-endpoints). ## Delivery optimization diff --git a/memdocs/configmgr/core/servers/manage/configuring-reporting.md b/memdocs/configmgr/core/servers/manage/configuring-reporting.md index abb8f3ce477..92fe0a54e8a 100644 --- a/memdocs/configmgr/core/servers/manage/configuring-reporting.md +++ b/memdocs/configmgr/core/servers/manage/configuring-reporting.md @@ -92,6 +92,8 @@ Before you can view or manage reports in the Configuration Manager console, you If you need to change the report server URL, first remove the existing reporting services point. Change the URL, and then reinstall the reporting services point. - When you install a reporting services point, specify a [Reporting services point account](../../plan-design/hierarchy/accounts.md#reporting-services-point-account). For users from a different domain to run a report, create a two-way trust between domains. Otherwise the report fails to run. + +- The account that runs Reporting Services service must belong to the domain local security group **Windows Authorization Access Group**. This grants the account **Allow Read** permissions on the **tokenGroupsGlobalAndUniversal** attribute for all user objects within the domain. Users in a different domain than the reporting services point account need a two-way trust between the domains to successfully run reports. ### Install the reporting services point on a site system @@ -125,11 +127,7 @@ For more information about configuring site systems, see [Install site system ro > [!IMPORTANT] > Configuration Manager makes a connection in the context of the current user to WMI on the selected site system. It uses this connection to retrieve the instance of SQL Server for Reporting Services. The current user must have **Read** access to WMI on the site system, or the wizard can't get the Reporting Services instances. - - **Reporting services point account**: Select **Set**, and then select an account to use. SQL Server Reporting Services on the reporting services point uses this account to connect to the Configuration Manager site database. This connection is to retrieve the data for a report. Select **Existing account** to specify a Windows user account that you previously configured as a Configuration Manager account. Select **New account** to specify a Windows user account that's not currently configured for use. Configuration Manager automatically grants the specified user access to the site database. - - The account that runs Reporting Services must belong to the domain local security group **Windows Authorization Access Group**. This grants the account **Allow Read** permissions on the **tokenGroupsGlobalAndUniversal** attribute for all user objects within the domain. Users in a different domain than the reporting services point account need a two-way trust between the domains to successfully run reports. - - The specified Windows user account and password are encrypted and stored in the Reporting Services database. Reporting Services retrieves the data for reports from the site database by using this account and password. + - **Reporting services point account**: Select **Set**, and then select an account to use. SQL Server Reporting Services on the reporting services point uses this account to connect to the Configuration Manager site database. This connection is to retrieve the data for a report. Select **Existing account** to specify a Windows user account that you previously configured as a Configuration Manager account. Select **New account** to specify a Windows user account that's not currently configured for use. Configuration Manager automatically grants the specified user access to the site database. The specified Windows user account and password are encrypted and stored in the Reporting Services database. Reporting Services retrieves the data for reports from the site database by using this account and password. > [!IMPORTANT] > The account that you specify must have the **Log on locally** permission on the server that hosts the Reporting Services database. diff --git a/memdocs/configmgr/core/servers/manage/powerbi-report-server.md b/memdocs/configmgr/core/servers/manage/powerbi-report-server.md index 4b562ad8ae9..fa82eadb48b 100644 --- a/memdocs/configmgr/core/servers/manage/powerbi-report-server.md +++ b/memdocs/configmgr/core/servers/manage/powerbi-report-server.md @@ -28,7 +28,7 @@ Save Power BI Desktop report files (.PBIX) and deploy them to the Power BI Repor - Power BI Report Server license. For more information, see [Licensing Power BI Report Server](/power-bi/report-server/get-started#licensing-power-bi-report-server). -- Download [Microsoft Power BI Report Server-September 2019](https://www.microsoft.com/download/details.aspx?id=57270), or later. +- Download [Microsoft Power BI Report Server-September 2024](https://www.microsoft.com/download/details.aspx?id=105945), or later. - Don't install Power BI Report Server right away. For the proper process based on your environment, see [Configure the reporting services point](#configure-the-reporting-services-point). - It's recommended that you use a [supported version of Power BI Report Server](/power-bi/report-server/support-timeline). For versioning information, see the [Change log for Power BI Report Server](/power-bi/report-server/changelog). diff --git a/memdocs/configmgr/mdm/index.yml b/memdocs/configmgr/mdm/index.yml index 936153795d7..7ab7e18e6c2 100644 --- a/memdocs/configmgr/mdm/index.yml +++ b/memdocs/configmgr/mdm/index.yml @@ -50,10 +50,10 @@ landingContent: - linkListType: overview links: - text: What is Intune? - url: /intune/fundamentals/what-is-intune + url: /mem/intune/fundamentals/what-is-intune - text: Device management overview - url: /intune/fundamentals/what-is-device-management + url: /mem/intune/fundamentals/what-is-device-management - linkListType: tutorial links: - text: Walkthrough the Microsoft Intune admin center - url: /intune/fundamentals/tutorial-walkthrough-endpoint-manager \ No newline at end of file + url: /mem/intune/fundamentals/tutorial-walkthrough-endpoint-manager \ No newline at end of file diff --git a/memdocs/configmgr/protect/plan-design/resource-access-deprecation-faq.yml b/memdocs/configmgr/protect/plan-design/resource-access-deprecation-faq.yml index 99530884ffc..a2d76c54a8e 100644 --- a/memdocs/configmgr/protect/plan-design/resource-access-deprecation-faq.yml +++ b/memdocs/configmgr/protect/plan-design/resource-access-deprecation-faq.yml @@ -26,6 +26,10 @@ summary: | - Email profiles - The co-management resource access workload + > [!IMPORTANT] + > If above mentioned resource access profiles are configured in Intune, but the applicability to co-managed devices are controlled through the co-management Resource Access workload setting in Configuration Manager, post 2403 upgrade, the Resource Access workload is moved to Intune and hence all resource access profiles + configured in Intune are now applicable and enforced to co-managed devices. + This article answers your frequently asked questions about these deprecated features. sections: @@ -81,8 +85,6 @@ sections: Starting in version 2211, the prerequisite checker will display a warning for co-managed clients if the resource access workload is on Configuration Manager. If the resource access slider is towards Configuration Manager, they aren't tested or supported in version 2203. Co-management behavior is the same as if you used Configuration Manager 2111 or earlier to switch the resource access workload to Intune. This Workload slider will be disabled, and you can only use Microsoft Intune to deploy resource access profiles in upcoming Configuration Manager versions. - - - question: | What alternative options are available? answer: | diff --git a/memdocs/intune/apps/android-deployment-scenarios-app-protection-work-profiles.md b/memdocs/intune/apps/android-deployment-scenarios-app-protection-work-profiles.md index 8ab6d41d3db..8e61348e8fe 100644 --- a/memdocs/intune/apps/android-deployment-scenarios-app-protection-work-profiles.md +++ b/memdocs/intune/apps/android-deployment-scenarios-app-protection-work-profiles.md @@ -61,7 +61,7 @@ Individual Android apps are enabled for APP in a few ways: For more information on this tool, see [prepare line-of-business apps for app protection policies](../developer/apps-prepare-mobile-application-management.md). -To see a list of apps enabled with APP, see [managed apps with a rich set of mobile application protection policies](https://www.microsoft.com/cloud-platform/microsoft-intune-apps). +To see a list of apps enabled with APP, see [managed apps with a rich set of mobile application protection policies](/mem/intune/apps/apps-supported-intune-apps). ## Deployment scenarios diff --git a/memdocs/intune/apps/apps-enterprise-app-management.md b/memdocs/intune/apps/apps-enterprise-app-management.md index 3ce76c60e5d..99b0c836698 100644 --- a/memdocs/intune/apps/apps-enterprise-app-management.md +++ b/memdocs/intune/apps/apps-enterprise-app-management.md @@ -96,7 +96,7 @@ Microsoft hosts the applications in Microsoft storage accessible through `*.mana ### Is Microsoft providing security around any of the content provided in the Enterprise App Catalog? -No. Microsoft makes no guarantee, express or implied, with respect to the security and compliance of the applications provided in the Enterprise App Catalog. +Microsoft does not assert compliance or authorizations for apps distributed via Intune. Customers are responsible for ensuring that apps meet their requirements. ### What app installer types are in the Enterprise App Catalog? @@ -110,6 +110,10 @@ At this time, Intune provides no running application detection. No SLA is currently available. +### How many applications are in the catalog? + +The catalog has over 400+ available applications in the Enterprise App Catalog. More apps are available on an ongoing basis. + ### How can working with the applications in Enterprise App Catalog be automated? Graph API is planned to be available soon. diff --git a/memdocs/intune/apps/apps-supported-intune-apps.md b/memdocs/intune/apps/apps-supported-intune-apps.md index 2329ae3d9b3..551001ff9a1 100644 --- a/memdocs/intune/apps/apps-supported-intune-apps.md +++ b/memdocs/intune/apps/apps-supported-intune-apps.md @@ -6,7 +6,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 10/08/2024 +ms.date: 10/31/2024 ms.topic: conceptual ms.service: microsoft-intune ms.subservice: apps @@ -249,7 +249,6 @@ The following apps support the core Intune App Protection Policy settings. Apps | :::no-loc text="Singletrack for Intune":::

Partner app - Singletrack for Intune icon | Singletrack for Intune lets users access their CRM data anywhere and at any time, while supporting the Mobile Application Management (MAM) policies offered by Microsoft Intune. Users can connect with contacts and send out research. They can also log new interactions, as well as view and update existing ones.

You can choose to receive local notifications of recently finished Interactions and log draft interactions to be completed on your desktop at a later date. You can also work offline to capture data when convenient. | [App Store link (iOS)](https://apps.apple.com/us/app/singletrack-for-intune/id6502955456) | | :::no-loc text="Slack for Intune":::

Partner app - Slack for Intune icon | Slack for Intune is for Slack customers that have enabled Microsoft Intune Mobile Application Management (MAM). | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.Slack.intune), [App Store link (iOS)](https://apps.apple.com/app/slack-for-intune/id1558736484) | | :::no-loc text="PK Protect for Intune":::

Partner app - PK Protect for Intune icon | PK Protect for Intune is specifically designed for existing PKWARE customers operating in an Intune environment. PK Protect lets you get your work done on the go. It's fast, secure and simple to use so you can be productive from anywhere. If you're unsure if you have PK Protect, contact your company's IT administrator. With PK Protect, you can: Encrypt and decrypt files using Smartkeys, Decrypt archives with X.509 Digital Certificates, Create and manage Smartkeys, Perform digital signing and authentication of data with X.509 Digital Certificates, Encrypt and decrypt files with Strong Passphrase encryption, including AE2, Log in with existing Active Directory credentials, Create and view unencrypted zip archives. PK Protect armors data at its core, eliminating vulnerabilities everywhere data is used, shared or stored. For nearly three decades, PKWARE has provided encryption and compression software to more than 30,000 enterprise customers and over 200 government agencies. Available for iOS/iPadOS and Android. | [App Store link (iOS)](https://apps.apple.com/app/smartcrypt-for-intune/id1489232256) | -| :::no-loc text="ServiceNow Agent - Intune":::

Partner app - ServiceNow Agent icon | ServiceNow Mobile Agent app delivers out-of-the-box, mobile-first experiences for the most common service desk agent workflows, making it easy for agents to triage, act on and resolve requests on the go. The app enables service desk agents to promptly manage and resolve end user issues from their mobile devices. Agents use the app’s intuitive interface to accept and update work even without Internet connectivity. The app greatly simplifies work by using native device capabilities for tasks like navigation, barcode scanning, or collecting a signature.

The app comes with out-of-the-box workflows for service desk agents in IT, Customer Service, HR, Field Services, Security Ops and IT Asset Management. Organizations can easily configure and extend the workflows to meet their own unique needs.

With Mobile Agent you can:

| [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.servicenow.fulfiller.mam.intune),
[App Store link (iOS)](https://apps.apple.com/app/servicenow-agent-intune/id1494183149) | | :::no-loc text="Slack for Intune":::

Partner app - Slack for Intune icon | Slack for Intune is for Slack customers that have enabled Microsoft Intune Mobile Application Management (MAM). | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.Slack.intune), [App Store link (iOS)](https://apps.apple.com/app/slack-for-intune/id1558736484) | | :::no-loc text="PK Protect for Intune":::

Partner app - PK Protect for Intune icon | PK Protect for Intune is designed for existing PKWARE customers operating in an Intune environment. PK Protect lets you get your work done on the go. It's fast, secure and simple to use so you can be productive from anywhere. If you are unsure if you have PK Protect, contact your company's IT administrator. With PK Protect, you can: Encrypt and decrypt files using Smartkeys, Decrypt archives with X.509 Digital Certificates, Create and manage Smartkeys, Perform digital signing and authentication of data with X.509 Digital Certificates, Encrypt and decrypt files with Strong Passphrase encryption, including AE2, Log in with existing Active Directory credentials, Create and view unencrypted zip archives. PK Protect armors data at its core, eliminating vulnerabilities everywhere data is used, shared or stored. For nearly three decades, PKWARE has provided encryption and compression software to more than 30,000 enterprise customers and over 200 government agencies. Available for iOS/iPadOS and Android. | [App Store link (iOS)](https://apps.apple.com/app/smartcrypt-for-intune/id1489232256) | | :::no-loc text="Speaking Email":::

Partner app - Speaking Email icon | Get more time in your day by having your email read to you on the move. Voice commands and simple gestures designed to be safe to use while driving give you the ability to archive, flag or even reply on the move.

Smart content detection skips over disclaimers, reply headers, and email signatures to speak only the content without the clutter.

Employees can sign in via Intune to access Microsoft 365 Exchange email. | [App Store link (iOS)](https://apps.apple.com/app/apple-store/id991406423?ct=intune) | diff --git a/memdocs/intune/apps/mam-faq.yml b/memdocs/intune/apps/mam-faq.yml index e382cc3c825..5b20f335105 100644 --- a/memdocs/intune/apps/mam-faq.yml +++ b/memdocs/intune/apps/mam-faq.yml @@ -59,7 +59,7 @@ sections: questions: - question: Which apps can be managed by app protection policies? answer: | - Any app that has been integrated with the [Intune App SDK](../developer/app-sdk.md) or wrapped by the [Intune App Wrapping Tool](../developer/apps-prepare-mobile-application-management.md) can be managed using Intune app protection policies. See the official list of [Intune-managed apps](https://www.microsoft.com/cloud-platform/microsoft-intune-apps) available for public use. + Any app that has been integrated with the [Intune App SDK](../developer/app-sdk.md) or wrapped by the [Intune App Wrapping Tool](../developer/apps-prepare-mobile-application-management.md) can be managed using Intune app protection policies. See the official list of [Intune-managed apps](/mem/intune/apps/apps-supported-intune-apps) available for public use. - question: What are the baseline requirements to use app protection policies on an Intune-managed app? answer: | diff --git a/memdocs/intune/apps/mamedge-1-mamca.md b/memdocs/intune/apps/mamedge-1-mamca.md index 622ace2452c..084bbfad370 100644 --- a/memdocs/intune/apps/mamedge-1-mamca.md +++ b/memdocs/intune/apps/mamedge-1-mamca.md @@ -102,7 +102,7 @@ In the previous steps, you implemented conditional access as a required app prot :::image type="content" alt-text="Device Platform - Conditional Access policy - Microsoft Intune admin center." source="./media/securing-data-edge-for-business/securing-data-edge-for-business59.png" lightbox="./media/securing-data-edge-for-business/securing-data-edge-for-business59.png"::: -7. Select **Grant** and select **Require device to be market as compliant.** This will provide access through desktop apps only for enrolled and compliant devices. +7. Select **Grant** and select **Require device to be marked as compliant.** This will provide access through desktop apps only for enrolled and compliant devices. :::image type="content" alt-text="Grant - Conditional Access policy - Microsoft Intune admin center." source="./media/securing-data-edge-for-business/securing-data-edge-for-business60.png" lightbox="./media/securing-data-edge-for-business/securing-data-edge-for-business60.png"::: diff --git a/memdocs/intune/apps/manage-microsoft-edge.md b/memdocs/intune/apps/manage-microsoft-edge.md index eff856589ac..e1477d4fce6 100644 --- a/memdocs/intune/apps/manage-microsoft-edge.md +++ b/memdocs/intune/apps/manage-microsoft-edge.md @@ -8,7 +8,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 02/27/2024 +ms.date: 10/24/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: apps @@ -282,7 +282,7 @@ Edge for iOS and Android allows organizations to disable certain features that a |Key |Value | |:-----------|:-------------| -|com.microsoft.intune.mam.managedbrowser.disabledFeatures|**password** disables prompts that offer to save passwords for the end user
**inprivate** disables InPrivate browsing
**autofill** disables "Save and Fill Addresses" and "Save and Fill Payment info". Autofill will be disabled even for previously saved information
**translator** disables translator
**readaloud** disables read aloud
**drop** disables drop
**coupons** disables coupons
**extensions** disables extensions (Edge for Android only)
**developertools** grays out the build version numbers to prevent users from accessing Developer options (Edge for Android only)
**UIRAlert** suppress re-verify account popups in new tab page screen

To disable multiple features, separate values with `|`. For example, `inprivate|password` disables both InPrivate and password storage. | +|com.microsoft.intune.mam.managedbrowser.disabledFeatures|**password** disables prompts that offer to save passwords for the end user
**inprivate** disables InPrivate browsing
**autofill** disables "Save and Fill Addresses" and "Save and Fill Payment info". Autofill will be disabled even for previously saved information
**translator** disables translator
**readaloud** disables read aloud
**drop** disables drop
**coupons** disables coupons
**extensions** disables extensions (Edge for Android only)
**developertools** grays out the build version numbers to prevent users from accessing Developer options (Edge for Android only)
**UIRAlert** suppress re-verify account popups in new tab page screen
**share** disables Share under menu
**sendtodevices** disables Send to devices under menu
**weather** disables weather in NTP (New Tab Page)

To disable multiple features, separate values with `|`. For example, `inprivate|password` disables both InPrivate and password storage. | #### Disable import passwords feature @@ -316,9 +316,12 @@ Edge for Android can be enabled as a kiosk app with the following settings: |com.microsoft.intune.mam.managedbrowser.showAddressBarInKioskMode |**true** shows the address bar in kiosk mode
**false** (default) hides the address bar when kiosk mode is enabled| |com.microsoft.intune.mam.managedbrowser.showBottomBarInKioskMode |**true** shows the bottom action bar in kiosk mode
**false** (default) hides the bottom bar when kiosk mode is enabled | +> [!NOTE] +> Kiosk mode is not supported on iOS devices. However, you may want to use Locked View Mode (MDM policy only) to achieve a similar user experience, where users are unable to navigate to other websites, as the URL address bar becomes read-only in Locked View Mode. + ### Locked view mode -Edge for iOS and Android can be enabled as locked view mode with MDM policy EdgeLockedViewModeEnabled. +Edge for iOS and Android can be enabled as locked view mode with MDM policy **[EdgeLockedViewModeEnabled](/deployedge/microsoft-edge-mobile-policies#edgelockedviewmodeenabled)**. |Key |Value | |:---------|:---------| @@ -485,16 +488,6 @@ Organizations can configure a search provider for users. To configure a search p |com.microsoft.intune.mam.managedbrowser.DefaultSearchProviderName | The corresponding value is a string
**Example** `My Intranet Search` | |com.microsoft.intune.mam.managedbrowser.DefaultSearchProviderSearchURL | The corresponding value is a string
**Example** `https://search.my.company/search?q={searchTerms}`| -### Open external apps -When a web page requests to open an external app, users will see a pop-up asking them to open the external app or not. Organizations can manage the behavior. - -|Key |Value | -|:-----------|:-------------| -|com.microsoft.intune.mam.managedbrowser.OpeningExternalApps |**0** (default) Show the pop-up for users to choose stay in Edge or open by external apps.
**1** Always open within Edge without showing the pop-up.
**2** Always open with external apps without showing the pop-up. If external apps aren't installed, the behavior will be the same as value 1| - -> [!NOTE] -> As of version 120.2210.99, the app jump blocker feature is removed. External apps will be opened from Edge by default. Therefore, this policy is no longer valid from version 120.2210.99. - ### Copilot > [!NOTE] @@ -549,6 +542,16 @@ Organizations can define which sites users can access within the work or school Organizations also define what happens when a user attempts to navigate to a restricted web site. By default, transitions are allowed. If the organization allows it, restricted web sites can be opened in the personal account context, the Microsoft Entra account’s InPrivate context, or whether the site is blocked entirely. For more information on the various scenarios that are supported, see [Restricted website transitions in Microsoft Edge mobile](https://techcommunity.microsoft.com/t5/intune-customer-success/restricted-website-transitions-in-microsoft-edge-mobile/ba-p/1381333). By allowing transitioning experiences, the organization's users stay protected, while keeping corporate resources safe. +To enhance the profile-switching experience by reducing the need for users to manually switch to personal profiles or InPrivate mode to open blocked URLs, we’ve introduced two new policies: +- `com.microsoft.intune.mam.managedbrowser.AutoTransitionModeOnBlock` +- `com.microsoft.intune.mam.managedbrowser.ProfileAutoSwitchToWork` + +Since these policies bring different results based on their configurations and combinations, we recommend trying our policy suggestions below for a quick evaluation to see if the profile-switching experience aligns well with your organization’s needs before exploring detailed documentation. Suggested profile-switching configuration settings include the following values: +- `com.microsoft.intune.mam.managedbrowser.AllowTransitionOnBlock=true` +- `com.microsoft.intune.mam.managedbrowser.openInPrivateIfBlocked=true` +- `com.microsoft.intune.mam.managedbrowser.AutoTransitionModeOnBlock=1` +- `com.microsoft.intune.mam.managedbrowser.ProfileAutoSwitchToWork=2` + > [!NOTE] > Edge for iOS and Android can block access to sites only when they're accessed directly. It doesn't block access when users use intermediate services (such as a translation service) to access the site. URLs that start with **Edge**, such as `Edge://*`, `Edge://flags`, and `Edge://net-export`, aren't supported in app configuration policy **AllowListURLs** or **BlockListURLs** for managed apps. You can disable these URLs with **com.microsoft.intune.mam.managedbrowser.InternalPagesBlockList**.

If your devices are managed, you can also use app configuration policy [URLAllowList](/deployedge/microsoft-edge-mobile-policies#urlallowlist) or [URLBlocklist](/deployedge/microsoft-edge-mobile-policies#urlblocklist) for managed devices. For related information, see [Microsoft Edge mobile policies](/deployedge/microsoft-edge-mobile-policies). @@ -556,8 +559,8 @@ Use the following key/value pairs to configure either an allowed or blocked site |Key |Value | |:--|:----| -|com.microsoft.intune.mam.managedbrowser.AllowListURLs |The corresponding value for the key is a list of URLs. You enter all the URLs you want to allow as a single value, separated by a pipe `|` character.

**Examples:**
`URL1|URL2|URL3`
`http://www.contoso.com/|https://www.bing.com/|https://expenses.contoso.com` | -|com.microsoft.intune.mam.managedbrowser.BlockListURLs |The corresponding value for the key is a list of URLs. You enter all the URLs you want to block as a single value, separated by a pipe `|` character.

**Examples:**
`URL1|URL2|URL3`
`http://www.contoso.com/|https://www.bing.com/|https://expenses.contoso.com` | +|com.microsoft.intune.mam.managedbrowser.AllowListURLs

This policy name has been replaced by the UI of **Allowed URLs** under Edge Configuration settings|The corresponding value for the key is a list of URLs. You enter all the URLs you want to allow as a single value, separated by a pipe `|` character.

**Examples:**
`URL1|URL2|URL3`
`http://www.contoso.com/|https://www.bing.com/|https://expenses.contoso.com` | +|com.microsoft.intune.mam.managedbrowser.BlockListURLs

This policy name has been replaced by the UI of **Blocked URLs** under Edge Configuration settings|The corresponding value for the key is a list of URLs. You enter all the URLs you want to block as a single value, separated by a pipe `|` character.

**Examples:**
`URL1|URL2|URL3`
`http://www.contoso.com/|https://www.bing.com/|https://expenses.contoso.com` | |com.microsoft.intune.mam.managedbrowser.AllowTransitionOnBlock |**true** (default) allows Edge for iOS and Android to transition restricted sites. When personal accounts aren't disabled, users are prompted to either switch to the personal context to open the restricted site, or to add a personal account. If com.microsoft.intune.mam.managedbrowser.openInPrivateIfBlocked is set to true, users have the capability of opening the restricted site in the InPrivate context.
**false** prevents Edge for iOS and Android from transitioning users. Users are simply shown a message stating that the site they are trying to access is blocked. | |com.microsoft.intune.mam.managedbrowser.openInPrivateIfBlocked

This policy name has been replaced by the UI of **Redirect restricted sites to personal context** under Edge Configuration settings |**true** allows restricted sites to be opened in the Microsoft Entra account's InPrivate context. If the Microsoft Entra account is the only account configured in Edge for iOS and Android, the restricted site is opened automatically in the InPrivate context. If the user has a personal account configured, the user is prompted to choose between opening InPrivate or switch to the personal account.
**false** (default) requires the restricted site to be opened in the user's personal account. If personal accounts are disabled, then the site is blocked.
In order for this setting to take effect, com.microsoft.intune.mam.managedbrowser.AllowTransitionOnBlock must be set to true. | |com.microsoft.intune.mam.managedbrowser.durationOfOpenInPrivateSnackBar | Enter the number of seconds that users will see the snack bar notification "Access to this site is blocked by your organization. We’ve opened it in InPrivate mode for you to access the site." By default, the snack bar notification is shown for 7 seconds.| @@ -571,6 +574,22 @@ The following sites except copilot.microsoft.com are always allowed regardless o - `https://*.microsoftonline.com/*` - `https://*.microsoftonline-p.com/*` +### Control the behavior of the Site Blocked popup +When attempting to access blocked websites, users will be prompted to use either switch to InPrivate or personal account to open the blocked websites. You can choose preferences between InPrivate and personal account. + +|Key |Value | +|:--|:----| +|com.microsoft.intune.mam.managedbrowser.AutoTransitionModeOnBlock |**0**: (Default) Always show the popup window for user to choose.
**1**: Automatically switch to personal account when personal account is signed in.If personal account is not signed in, the behavior will be changed to value 2.
**2**:Automatically switch to InPrivate if InPrivate switch is allowed by com.microsoft.intune.mam.managedbrowser.openInPrivateIfBlocked=true. | + +### Control the behavior of switching personal profile to work profile +When Edge is under the personal profile and users are attempting to open a link from Outlook or Microsoft Teams which are under the work profile, by default, Intune will use the Edge work profile to open the link because both Edge, Outlook, and Microsoft Teams are managed by Intune. However, when the link is blocked, the user will be switched to the the personal profile. This causes a friction experience for users + +You can configure a policy to enhance users' experience. This policy is recommended to be used together with AutoTransitionModeOnBlock as it may switch users to the personal profile according to the policy value you configured. + +|Key |Value | +|:--|:----| +|com.microsoft.intune.mam.managedbrowser.ProfileAutoSwitchToWork |**1**: (Default) Switch to work profile even if the URL is blocked by Edge policy.
**2**: The blocked URLs will open under personal profile if personal profile is signed in. If personal profile is not signed in, the blocked URL will opened in InPrivate mode. | + #### URL formats for allowed and blocked site list You can use various URL formats to build your allowed/blocked sites lists. These permitted patterns are detailed in the following table. @@ -607,25 +626,6 @@ You can use various URL formats to build your allowed/blocked sites lists. These - `http://www.contoso.com:*` - `http://www.contoso.com: /*` -### Control the behavior of the Site Blocked popup -When attempting to access blocked websites, users will be prompted to use either switch to InPrivate or personal account to open the blocked websites. You can choose preferences between InPrivate and personal account. - -|Key |Value | -|:--|:----| -|com.microsoft.intune.mam.managedbrowser.AutoTransitionModeOnBlock |**0**: (Default) Always show the popup window for user to choose.
**1**: Automatically switch to personal account when personal account is signed in.If personal account is not signed in, the behavior will be changed to value 2.
**2**:Automatically switch to InPrivate if InPrivate switch is allowed by com.microsoft.intune.mam.managedbrowser.openInPrivateIfBlocked=true. | - -### Control the behavior of switching personal profile to work profile -When Edge is under the personal profile and users are attempting to open a link from Outlook or Microsoft Teams which are under the work profile, by default, Intune will use the Edge work profile to open the link because both Edge, Outlook, and Microsoft Teams are managed by Intune. However, when the link is blocked, the user will be switched to the the personal profile. This causes a friction experience for users - -You can configure a policy to enhance users' experience. This policy is recommended to be used together with AutoTransitionModeOnBlock as it may switch users to the personal profile according to the policy value you configured. - -|Key |Value | -|:--|:----| -|com.microsoft.intune.mam.managedbrowser.ProfileAutoSwitchToWork |**1**: (Default) Switch to work profile even if the URL is blocked by Edge policy.
**2**: URLs that are blocked by Edge policy will not be switched to work profile. | - -> [!NOTE] -> This policy takes effect when Edge is in personal profile and is receiving URL from a managed apps such as Outlook and Microsoft Teams by Intune. Edge also needs to have both personal profile and work profile signed in. - ### Disable Edge internal pages You can disable Edge internal pages such as `Edge://flags` and `Edge://net-export`. More pages can be found from `Edge://about` diff --git a/memdocs/intune/configuration/kiosk-settings-windows.md b/memdocs/intune/configuration/kiosk-settings-windows.md index ab12dbee5b8..5324b12ffb8 100644 --- a/memdocs/intune/configuration/kiosk-settings-windows.md +++ b/memdocs/intune/configuration/kiosk-settings-windows.md @@ -100,7 +100,7 @@ Runs only one app on the device, such as a web browser or Store app. For more information on these options, see [Deploy Microsoft Edge kiosk mode](/microsoft-edge/deploy/microsoft-edge-kiosk-mode-deploy#supported-configuration-types). - - **Add Kiosk browser**: Select **Kiosk browser settings**. These settings control a web browser app on the kiosk. Be sure you get the [Kiosk browser app](https://businessstore.microsoft.com/store/details/kiosk-browser/9NGB5S5XG2KP) from the Store, add it to Intune as a [Client App](../apps/apps-add.md). Then, assign the app to the kiosk devices. + - **Add Kiosk browser**: Select **Kiosk browser settings**. These settings control a web browser app on the kiosk. Be sure you get the [Kiosk browser app](https://apps.microsoft.com/detail/9ngb5s5xg2kp?) from the Store, add it to Intune as a [Client App](../apps/apps-add.md). Then, assign the app to the kiosk devices. Enter the following settings: diff --git a/memdocs/intune/developer/app-sdk-android-phase1.md b/memdocs/intune/developer/app-sdk-android-phase1.md index 0204f285ba7..34b1b8afb35 100644 --- a/memdocs/intune/developer/app-sdk-android-phase1.md +++ b/memdocs/intune/developer/app-sdk-android-phase1.md @@ -7,7 +7,7 @@ keywords: SDK author: Erikre ms.author: erikre manager: dougeby -ms.date: 12/04/2023 +ms.date: 10/31/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: developer diff --git a/memdocs/intune/developer/app-sdk-android-phase2.md b/memdocs/intune/developer/app-sdk-android-phase2.md index 1e2db119a18..bc9f9a82ba2 100644 --- a/memdocs/intune/developer/app-sdk-android-phase2.md +++ b/memdocs/intune/developer/app-sdk-android-phase2.md @@ -7,7 +7,7 @@ keywords: SDK author: Erikre ms.author: erikre manager: dougeby -ms.date: 12/04/2023 +ms.date: 10/31/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: developer diff --git a/memdocs/intune/developer/app-sdk-android-phase5.md b/memdocs/intune/developer/app-sdk-android-phase5.md index e2ab3520f59..c396bf1daf7 100644 --- a/memdocs/intune/developer/app-sdk-android-phase5.md +++ b/memdocs/intune/developer/app-sdk-android-phase5.md @@ -7,7 +7,7 @@ keywords: SDK author: Erikre ms.author: erikre manager: dougeby -ms.date: 12/04/2023 +ms.date: 10/31/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: developer @@ -509,6 +509,11 @@ Calling `protectForOID` with empty string for the identity parameter will tag th This operation will remove encryption from the file/directory if it was previously encrypted. When a selective wipe command is issued, the file/directory won't be deleted. +> [!WARNING] +> It is important to ensure that only files belonging to a particular identity become protected +> with that identity. Otherwise, other identities may experience data loss when the owning identity +> signs out, as files will be wiped and encryption key access will be lost. + #### Displaying Protected File Content It is equally critical to have the correct identity set when file content is being *displayed* to prevent unauthorized users from viewing managed data. @@ -597,6 +602,17 @@ An app can prevent these buffers becoming unreadable by calling `MAMDataProtecti It is also safe to call `protectForOID` during this notification, if you wish to preserve identity information. Encryption is guaranteed to be disabled during the notification and calling `protectForOID` in the handler won't encrypt data buffers. +> [!WARNING] +> Encryption operations should be avoided early in the app process. The SDK will perform encryption +> initialization asynchronously as early as possible after app startup. However, if an app makes +> an encryption request in app startup, it may be blocked until encryption initialization is +> complete. + +> [!NOTE] +> The Intune App SDK encryption API should be used only to encrypt data as required by Intune +> policy. No protection will be applied to accounts that are not targeted with encryption policy +> enabled, so it cannot be used as general-purpose encryption library. + ### Content Providers A multi-identity app must also protect data shared through `ContentProvider`s to prevent inappropriately sharing managed content. diff --git a/memdocs/intune/developer/app-sdk-android-phase7.md b/memdocs/intune/developer/app-sdk-android-phase7.md index 3618077dda8..6a74718ff22 100644 --- a/memdocs/intune/developer/app-sdk-android-phase7.md +++ b/memdocs/intune/developer/app-sdk-android-phase7.md @@ -7,7 +7,7 @@ keywords: SDK author: Erikre ms.author: erikre manager: dougeby -ms.date: 12/04/2023 +ms.date: 10/31/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: developer diff --git a/memdocs/intune/developer/app-sdk-ios-phase5.md b/memdocs/intune/developer/app-sdk-ios-phase5.md index 252dde06b86..255ec1e0e3c 100644 --- a/memdocs/intune/developer/app-sdk-ios-phase5.md +++ b/memdocs/intune/developer/app-sdk-ios-phase5.md @@ -7,7 +7,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 12/09/2023 +ms.date: 10/31/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: developer diff --git a/memdocs/intune/developer/app-sdk-ios-phase7.md b/memdocs/intune/developer/app-sdk-ios-phase7.md index 342c6225034..1b66db3ba1c 100644 --- a/memdocs/intune/developer/app-sdk-ios-phase7.md +++ b/memdocs/intune/developer/app-sdk-ios-phase7.md @@ -8,7 +8,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 12/09/2023 +ms.date: 10/31/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: developer diff --git a/memdocs/intune/developer/app-sdk.md b/memdocs/intune/developer/app-sdk.md index fc7f2a69c4b..551be1445a5 100644 --- a/memdocs/intune/developer/app-sdk.md +++ b/memdocs/intune/developer/app-sdk.md @@ -6,7 +6,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 12/04/2023 +ms.date: 10/31/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: developer diff --git a/memdocs/intune/developer/reports-api-url.md b/memdocs/intune/developer/reports-api-url.md index fb4e9b1ee1f..6677f4f4d7f 100644 --- a/memdocs/intune/developer/reports-api-url.md +++ b/memdocs/intune/developer/reports-api-url.md @@ -7,7 +7,7 @@ keywords: Intune Data Warehouse author: Erikre ms.author: erikre manager: dougeby -ms.date: 12/04/2023 +ms.date: 10/30/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: developer diff --git a/memdocs/intune/developer/reports-nav-create-intune-reports.md b/memdocs/intune/developer/reports-nav-create-intune-reports.md index 8a57446e962..2ac865af0e6 100644 --- a/memdocs/intune/developer/reports-nav-create-intune-reports.md +++ b/memdocs/intune/developer/reports-nav-create-intune-reports.md @@ -7,7 +7,7 @@ keywords: Intune Data Warehouse author: Erikre ms.author: erikre manager: dougeby -ms.date: 12/04/2023 +ms.date: 10/30/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: developer diff --git a/memdocs/intune/developer/reports-nav-intune-data-warehouse.md b/memdocs/intune/developer/reports-nav-intune-data-warehouse.md index 2fe0637168a..5656f76d0c2 100644 --- a/memdocs/intune/developer/reports-nav-intune-data-warehouse.md +++ b/memdocs/intune/developer/reports-nav-intune-data-warehouse.md @@ -7,7 +7,7 @@ keywords: Intune Data Warehouse author: Erikre ms.author: erikre manager: dougeby -ms.date: 12/04/2023 +ms.date: 10/30/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: developer diff --git a/memdocs/intune/developer/reports-proc-create-with-odata.md b/memdocs/intune/developer/reports-proc-create-with-odata.md index 9054b36ce5b..e4eac8782bd 100644 --- a/memdocs/intune/developer/reports-proc-create-with-odata.md +++ b/memdocs/intune/developer/reports-proc-create-with-odata.md @@ -7,7 +7,7 @@ keywords: Intune Data Warehouse author: Erikre ms.author: erikre manager: dougeby -ms.date: 12/04/2023 +ms.date: 10/30/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: developer diff --git a/memdocs/intune/developer/reports-proc-get-a-link-powerbi.md b/memdocs/intune/developer/reports-proc-get-a-link-powerbi.md index e9ffe091f65..1f3ed1f056a 100644 --- a/memdocs/intune/developer/reports-proc-get-a-link-powerbi.md +++ b/memdocs/intune/developer/reports-proc-get-a-link-powerbi.md @@ -7,7 +7,7 @@ keywords: Intune Data Warehouse author: Erikre ms.author: erikre manager: dougeby -ms.date: 12/04/2023 +ms.date: 10/30/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: developer diff --git a/memdocs/intune/developer/reports-ref-application.md b/memdocs/intune/developer/reports-ref-application.md index 367c037cdd4..1067a49df4d 100644 --- a/memdocs/intune/developer/reports-ref-application.md +++ b/memdocs/intune/developer/reports-ref-application.md @@ -7,7 +7,7 @@ keywords: Intune Data Warehouse author: Erikre ms.author: erikre manager: dougeby -ms.date: 12/04/2023 +ms.date: 10/30/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: developer diff --git a/memdocs/intune/developer/reports-ref-data-model.md b/memdocs/intune/developer/reports-ref-data-model.md index 53876b5c4e1..688507216a0 100644 --- a/memdocs/intune/developer/reports-ref-data-model.md +++ b/memdocs/intune/developer/reports-ref-data-model.md @@ -7,7 +7,7 @@ keywords: Intune Data Warehouse author: Erikre ms.author: erikre manager: dougeby -ms.date: 12/04/2023 +ms.date: 10/30/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: developer diff --git a/memdocs/intune/developer/reports-ref-date.md b/memdocs/intune/developer/reports-ref-date.md index f4bab925ab8..da548477cd9 100644 --- a/memdocs/intune/developer/reports-ref-date.md +++ b/memdocs/intune/developer/reports-ref-date.md @@ -7,7 +7,7 @@ keywords: Intune Data Warehouse author: Erikre ms.author: erikre manager: dougeby -ms.date: 12/04/2023 +ms.date: 10/30/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: developer diff --git a/memdocs/intune/developer/reports-ref-devices.md b/memdocs/intune/developer/reports-ref-devices.md index 5237e1544c3..392a27a9b9f 100644 --- a/memdocs/intune/developer/reports-ref-devices.md +++ b/memdocs/intune/developer/reports-ref-devices.md @@ -7,7 +7,7 @@ keywords: Intune Data Warehouse author: Erikre ms.author: erikre manager: dougeby -ms.date: 12/04/2023 +ms.date: 10/30/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: developer diff --git a/memdocs/intune/developer/reports-ref-intunemanagementextension.md b/memdocs/intune/developer/reports-ref-intunemanagementextension.md index ee8d7b4640e..aefaf67746f 100644 --- a/memdocs/intune/developer/reports-ref-intunemanagementextension.md +++ b/memdocs/intune/developer/reports-ref-intunemanagementextension.md @@ -7,7 +7,7 @@ keywords: Intune Data Warehouse author: Erikre ms.author: erikre manager: dougeby -ms.date: 12/04/2023 +ms.date: 10/30/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: developer diff --git a/memdocs/intune/developer/reports-ref-mobile-app-management.md b/memdocs/intune/developer/reports-ref-mobile-app-management.md index ff38b2631ba..29c6fae53f1 100644 --- a/memdocs/intune/developer/reports-ref-mobile-app-management.md +++ b/memdocs/intune/developer/reports-ref-mobile-app-management.md @@ -7,7 +7,7 @@ keywords: Intune Data Warehouse author: Erikre ms.author: erikre manager: dougeby -ms.date: 12/04/2023 +ms.date: 10/30/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: developer diff --git a/memdocs/intune/developer/reports-ref-policy.md b/memdocs/intune/developer/reports-ref-policy.md index 40b942f1fe8..ef57e85b2d0 100644 --- a/memdocs/intune/developer/reports-ref-policy.md +++ b/memdocs/intune/developer/reports-ref-policy.md @@ -7,7 +7,7 @@ keywords: Intune Data Warehouse author: Erikre ms.author: erikre manager: dougeby -ms.date: 12/04/2023 +ms.date: 10/30/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: developer diff --git a/memdocs/intune/developer/reports-ref-user-device.md b/memdocs/intune/developer/reports-ref-user-device.md index b2818133d17..e5f54eb0f81 100644 --- a/memdocs/intune/developer/reports-ref-user-device.md +++ b/memdocs/intune/developer/reports-ref-user-device.md @@ -7,7 +7,7 @@ keywords: Intune Data Warehouse author: Erikre ms.author: erikre manager: dougeby -ms.date: 12/04/2023 +ms.date: 10/30/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: developer diff --git a/memdocs/intune/developer/reports-ref-user-timeline.md b/memdocs/intune/developer/reports-ref-user-timeline.md index f13f251519b..1f6c6f6ff13 100644 --- a/memdocs/intune/developer/reports-ref-user-timeline.md +++ b/memdocs/intune/developer/reports-ref-user-timeline.md @@ -7,7 +7,7 @@ keywords: Intune Data Warehouse author: Erikre ms.author: erikre manager: dougeby -ms.date: 12/04/2023 +ms.date: 10/30/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: developer diff --git a/memdocs/intune/developer/reports-ref-user.md b/memdocs/intune/developer/reports-ref-user.md index 3da3153785d..df8cefff46d 100644 --- a/memdocs/intune/developer/reports-ref-user.md +++ b/memdocs/intune/developer/reports-ref-user.md @@ -7,7 +7,7 @@ keywords: Intune Data Warehouse author: Erikre ms.author: erikre manager: dougeby -ms.date: 12/04/2023 +ms.date: 10/30/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: developer diff --git a/memdocs/intune/enrollment/android-corporate-owned-work-profile-enroll.md b/memdocs/intune/enrollment/android-corporate-owned-work-profile-enroll.md index a0578dc8780..d6a511ea3a4 100644 --- a/memdocs/intune/enrollment/android-corporate-owned-work-profile-enroll.md +++ b/memdocs/intune/enrollment/android-corporate-owned-work-profile-enroll.md @@ -8,7 +8,7 @@ keywords: author: Lenewsad ms.author: lanewsad manager: dougeby -ms.date: 05/17/2024 +ms.date: 10/28/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: enrollment @@ -34,7 +34,7 @@ ms.collection: Android Enterprise corporate-owned devices with a work profile are single user devices intended for corporate and personal use. -End users can keep their work and personal data separate and are guaranteed that personal data and applications will remain private. Admins can control some settings and features for the entire device, including: +End users can keep their work and personal data separate and are guaranteed that personal data and applications remain private. Admins can control some settings and features for the entire device, including: - Setting requirements for the device password - Controlling Bluetooth and data roaming @@ -47,7 +47,8 @@ Intune helps you deploy apps and settings to Android Enterprise corporate-owned Devices must meet these requirements to be managed as Android Enterprise corporate-owned work profile devices: - Android OS version 8.0 and above. -- Devices must run a distribution of Android that has Google Mobile Services (GMS) connectivity. Devices must have GMS available and must be able to connect to GMS. +- Devices must run a distribution of Android that has Google Mobile Services (GMS) connectivity. Devices must have GMS available and must be able to connect to GMS. + ## Set up Android Enterprise corporate-owned work profile device management @@ -92,14 +93,14 @@ You must create an enrollment profile so that users can enroll corporate-owned w 8. Select **Next** to continue to **Scope tags**. -9. Optionally, apply one or more scope tags to limit restriction visibility and management to certain admin users in Intune. For more information about how to use scope tags, see [Use role-based access control (RBAC) and scope tags for distributed IT](../fundamentals/scope-tags.md). +9. Optionally, apply one or more scope tags to limit restriction visibility and management to certain admin users in Intune. For more information about how to use scope tags, see [Use role-based access control and scope tags for distributed IT](../fundamentals/scope-tags.md). 10. Choose **Next** to continue to **Create + review**. 11. Review your choices, and then select **Create** to finish creating the profile. ### Access enrollment token -After you create a profile, Intune generates a token that's needed for enrollment. +After you create a profile, Intune generates the token you need for enrollment. 1. Return to **Devices** > **Enrollment**, and select the Android tab. @@ -167,7 +168,7 @@ When you create the enrollment profile in the admin center, you have to select a The default token, *corporate-owned work profile*, enrolls devices into Microsoft Intune as standard Android Enterprise corporate-owned devices with work profiles. This token requires you to complete pre-provisioning steps before you distribute the devices. End users complete the remaining steps on the device when they sign in with their work or school account. -The device staging token, *Corporate-owned work profile, via staging*, enrolls devices into Microsoft Intune in a staging mode so that you or a third party vendor can complete all pre-provisioning steps. End users complete the last step of provisioning by signing into the Microsoft Intune app with their work or school account. Devices are ready to use upon sign-in. Intune supports device staging for Android Enterprise devices running Android 8 or later. +The device staging token, *Corporate-owned work profile, via staging*, enrolls devices into Microsoft Intune in a staging mode so that you or a partner vendor can complete all pre-provisioning steps. End users complete the last step of provisioning by signing into the Microsoft Intune app with their work or school account. Devices are ready to use upon sign-in. Intune supports device staging for Android Enterprise devices running Android 8 or later. For more information, see [Device staging overview](device-staging-overview.md). @@ -181,6 +182,12 @@ To remove an app from Android Enterprise corporate-owned work profile devices, y - Delete the Required app deployment. - Create an uninstall deployment for the app. +## Limitations + +The limitations in this section apply to corporate-owned devices with a work profile. + +Private space is a feature introduced with Android 15 that lets people create a space on their device for sensitive apps and data they want to keep hidden. The private space is considered a personal profile. Microsoft Intune doesn't support mobile device management within the private space or provide technical support for devices that attempt to enroll the private space. + ## Next steps - [Deploy Android apps](../apps/apps-deploy.md) - [Add Android configuration policies](../configuration/device-profiles.md) diff --git a/memdocs/intune/enrollment/android-enroll-device-administrator.md b/memdocs/intune/enrollment/android-enroll-device-administrator.md index 6415449397b..c13c4eac4ec 100644 --- a/memdocs/intune/enrollment/android-enroll-device-administrator.md +++ b/memdocs/intune/enrollment/android-enroll-device-administrator.md @@ -8,7 +8,7 @@ keywords: author: Lenewsad ms.author: lanewsad manager: dougeby -ms.date: 04/05/2024 +ms.date: 10/28/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: enrollment @@ -34,7 +34,7 @@ ms.collection: [!INCLUDE [android_device_administrator_support](../includes/android-device-administrator-support.md)] -Android device administrator (sometimes referred to *legacy* Android management and released with Android 2.2) is a way to manage Android devices. However, improved management functionality is available with [Android Enterprise](https://www.android.com/enterprise/management/) in [countries where Android Enterprise is available](https://support.google.com/work/android/answer/6270910). In an effort to move to modern, richer, and more secure device management, Google deprecated Android device administrator management in 2020 and Intune will be ending support for device administrator devices with access to Google Mobile Services at the end of 2024. +Android device administrator (sometimes referred to *legacy* Android management and released with Android 2.2) is a way to manage Android devices. However, improved management functionality is available with [Android Enterprise](https://www.android.com/enterprise/management/) in [countries/regions where Android Enterprise is available](https://support.google.com/work/android/answer/6270910). Google deprecated Android device administrator management in 2020. Intune is ending support for device administrator devices with access to Google Mobile Services at the end of 2024. Therefore, we advise against enrolling new devices using the device administrator process described here and we also recommend that you migrate devices off of device administrator management. @@ -44,7 +44,7 @@ If you still decide to have users enroll their Android devices with device admin ## Set up device administrator enrollment -1. To prepare to manage mobile devices, you must set the mobile device management (MDM) authority to **Microsoft Intune**. See [Set the MDM authority](../fundamentals/mdm-authority-set.md) for instructions. You set this item only once, when you are first setting up Intune for mobile device management. +1. To prepare to manage mobile devices, you must set the mobile device management (MDM) authority to **Microsoft Intune**. See [Set the MDM authority](../fundamentals/mdm-authority-set.md) for instructions. You only need to configure this setting in your tenant once. 2. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). 3. Go to **Devices** > **Enrollment. 4. Select the **Android** tab. @@ -52,11 +52,13 @@ If you still decide to have users enroll their Android devices with device admin 6. Select the checkmark next to **Use device administrator to manage devices**. 7. [Tell your users how to enroll their devices](../user-help/enroll-device-android-company-portal.md). -After a user has enrolled, you can begin managing their devices in Intune, including [assigning compliance policies](../protect/compliance-policy-create-android.md), [managing apps](../apps/app-management.md), and more. +After a user enrolls, you can begin managing their devices in Intune, including [assigning compliance policies](../protect/compliance-policy-create-android.md), [managing apps](../apps/app-management.md), and more. -For information about other user tasks, see these articles: -- [Resources about the end-user experience with Microsoft Intune](../fundamentals/intune-planning-guide.md) -- [Using your Android device with Intune](../user-help/why-enroll-android-device.md) +For information about other user tasks, see these articles: + +- [Microsoft Intune planning guide](../fundamentals/intune-planning-guide.md) + +- [Android device enrollment overview ](../user-help/why-enroll-android-device.md) ## Block device administrator enrollment To block Android device administrator devices, or to block only personally owned Android device administrator devices from enrollment, see [Set device type restrictions](enrollment-restrictions-set.md). @@ -65,7 +67,24 @@ To block Android device administrator devices, or to block only personally owned [Microsoft Teams certified Android devices](/microsoftteams/devices/teams-ip-phones) should continue being managed with device administrator management until [AOSP user-associated](android-aosp-corporate-owned-user-associated-enroll.md) management becomes available for these devices. -To unenroll a Microsoft Teams certified Android device that's enrolled in Android device administrator, sign in to the [Microsoft 365 admin center](https://admin.microsoft.com/) and deselect the Intune license from the Teams account for the Android device. After you remove an Intune license, there is a 30 day grace period in which the device still functions. The device will have to sign in again after this step to avoid enrolling in Intune under device administrator management again. +To unenroll a Microsoft Teams-certified Android device you manage with Android device administrator, you must: + +1. Sign in to the [Microsoft 365 admin center](https://admin.microsoft.com/). +1. Deselect the Intune license from the Teams account for the Android device. + +After you remove an Intune license, there's a 30 day grace period, during which the device still functions. The device must sign in again after this step to avoid enrolling in Intune under device administrator management again. + +## Limitations + +The limitations in this section apply to devices managed with device administrator. + +Private space is a feature introduced with Android 15 that lets people create a space on their device for sensitive apps and data they want to keep hidden. + + * The private space is considered a personal profile. Microsoft Intune doesn't support mobile device management within the private space or provide technical support for devices that attempt to enroll the private space. + + * Users might try to create a work profile-like experience on their devices by enrolling only the private space, leading to partial device management. Microsoft Intune doesn't provide support for this scenario. To avoid this issue, we recommend using [personal work profile management](android-work-profile-enroll.md) or [corporate-owned work profile management](android-corporate-owned-work-profile-enroll.md) instead of device administrator management. + + * After a user enrolls their personal device, if they attempt to enroll the private space, Intune will initiate the personal work profile enrollment flow. However, in this scenario the enrollment process will fail without any notification. ## Next steps - [Assign compliance policies](../protect/compliance-policy-create-android.md) diff --git a/memdocs/intune/enrollment/android-work-profile-enroll.md b/memdocs/intune/enrollment/android-work-profile-enroll.md index a0bcad7f741..a76861d2d56 100644 --- a/memdocs/intune/enrollment/android-work-profile-enroll.md +++ b/memdocs/intune/enrollment/android-work-profile-enroll.md @@ -8,7 +8,7 @@ keywords: author: Lenewsad ms.author: lanewsad manager: dougeby -ms.date: 6/28/2024 +ms.date: 10/28/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: enrollment @@ -33,7 +33,7 @@ ms.collection: # Set up enrollment of Android Enterprise personally owned work profile devices -Set up enrollment for bring-your-own-device (BYOD) and personal device scenarios using the *Android Enterprise personally owned work profile* management solution. During enrollment, a work profile is created on the device to house work apps and work data. The work profile can be managed by Microsoft Intune policies. Personal apps and data stay separate in another part of the device and remain unaffected by Intune. +Set up enrollment for bring-your-own-device (BYOD) and personal device scenarios using the *Android Enterprise personally owned work profile* management solution. During enrollment, a work profile is created on the device to house work apps and work data. You can use Microsoft Intune policies to manage the work profile and its contents. Personal apps and data stay separate in another part of the device and remain unaffected by Intune. For more information about Android Enterprise work profile features, see [Work profiles](https://support.google.com/work/android/answer/9563584) (opens Android Enterprise Help). @@ -68,7 +68,7 @@ Complete these steps to set up enrollment for Android Enterprise devices in BYOD [!INCLUDE [android_device_administrator_support](../includes/android-device-administrator-support.md)] 10. Select **Next** to continue to **Scope tags**. -11. Optionally, apply one or more scope tags to limit visibility and management of restrictions to certain admin users in Intune. For more information about how to use scope tags, see [Use role-based access control (RBAC) and scope tags for distributed IT](../fundamentals/scope-tags.md). +11. Optionally, apply one or more scope tags to limit visibility and management of restrictions to certain admin users in Intune. For more information about how to use scope tags, see [Use role-based access control and scope tags for distributed IT](../fundamentals/scope-tags.md). 12. Select **Next** to continue to **Assignments**. 13. Assign the restriction to all users, or select specific groups. 14. Select **Next** to continue to **Review + create**. @@ -86,7 +86,17 @@ For more information and screenshots of the end user experience, see [Enroll dev ## Data shared with Google -Microsoft Intune shares certain user and device information with Google when Android Enterprise device management is enabled. For more information, see [Data Intune sends to Google](../protect/data-intune-sends-to-google.md). +Microsoft Intune shares certain user and device information with Google when Android Enterprise device management is enabled. For more information, see [Data Intune sends to Google](../protect/data-intune-sends-to-google.md). + +## Limitations + +The limitations in this section apply to personal devices with a work profile. + +Private space is a feature introduced with Android 15 that lets people create a space on their device for sensitive apps and data they want to keep hidden. + + * The private space is considered a personal profile. Microsoft Intune doesn't support mobile device management within the private space or provide technical support for devices that attempt to enroll the private space. + + * If users attempt to enroll the private space after they enroll the device, Intune will initiate the device administrator enrollment process. The second enrollment causes two enrollment records to appear in the Microsoft Intune admin center: one under work profile management and one under device administrator management. Microsoft Intune doesn't provide support for this scenario. ## Next steps - [Deploy Android Enterprise apps](../apps/apps-add-android-for-work.md) diff --git a/memdocs/intune/fundamentals/cloud-configuration-setup-guide.md b/memdocs/intune/fundamentals/cloud-configuration-setup-guide.md index f1c0a8d5e7c..9796042f2b2 100644 --- a/memdocs/intune/fundamentals/cloud-configuration-setup-guide.md +++ b/memdocs/intune/fundamentals/cloud-configuration-setup-guide.md @@ -287,18 +287,9 @@ The script is deployed to devices using in Intune. To add and deploy the script, #### Microsoft Store app -If you previously removed the Microsoft Store app, you can redeploy it using Microsoft Intune. To re-add the Microsoft Store app (or any other apps you want to re-add), add the Microsoft Store app to your private organization app repository. Then, deploy the app to devices using Intune. The Microsoft Store app helps keep apps updated. +If you previously removed the Microsoft Store app, you can redeploy it using Microsoft Intune. To re-add the Microsoft Store app (or any other apps you want to re-add), add the Microsoft Store app to your private organization app repository. Then, deploy the app to devices using Intune. The Microsoft Store app helps keep apps updated. For information about how to configure access to the Microsoft Store app, see [Manage access to private store](/microsoft-store/manage-access-to-private-store). -Your private organization app repository can be: - -- The Intune Company Portal app or website (preferred) - -- Microsoft Store for Business or Microsoft Store for Education - - Previously, the Microsoft Store app had a Microsoft Store for Business tab. This tab is removed. If you use Microsoft Store for Business, then to access your private app repository, go to the [Microsoft Store for Business website](https://businessstore.microsoft.com/). For more information, go to [Manage access to private store](/microsoft-store/manage-access-to-private-store). - - > [!NOTE] - > The Microsoft Store for Business and Microsoft Store for Education will be retired. For more information, go to [Microsoft Store for Business and Microsoft Store for Education](/microsoft-store/microsoft-store-for-business-overview). +Your private organization app repository can be the Intune Company Portal app or website. Using Intune, on Windows 10/11 Enterprise and Education devices, you can block end users from installing Microsoft Store apps outside of your organization's private app repository. diff --git a/memdocs/intune/fundamentals/in-development.md b/memdocs/intune/fundamentals/in-development.md index 6a3920b61a8..4e975e33bbc 100644 --- a/memdocs/intune/fundamentals/in-development.md +++ b/memdocs/intune/fundamentals/in-development.md @@ -7,7 +7,7 @@ keywords: author: dougeby ms.author: dougeby manager: dougeby -ms.date: 10/17/2024 +ms.date: 10/29/2024 ms.topic: conceptual ms.service: microsoft-intune ms.subservice: fundamentals @@ -77,6 +77,14 @@ EPM is available as an [Intune Suite add-on-capability](../fundamentals/intune-a ## App management +### Additional reporting details for LOB apps on AOSP devices + +Additional details will be provided for app installation reporting of Line of Business (LOB) apps on Android Open Source Project (AOSP) devices. You will be able to see error codes and detailed error messages for LOB apps. For information about app status details, see [Monitor app information and assignments with Microsoft Intune](../apps/apps-monitor.md). + +Applies to: + +- Android Open Source Project (AOSP) devices + ### Added protection for iOS/iPadOS app widgets To protect organizational data for MAM managed accounts and apps, Intune app protection policies now provide the capability to block data sync from policy managed app data to app widgets. App widgets can be added to end-user's iOS/iPadOS device lock screen, which can expose data contained by these widgets, such as meeting titles, top sites, and recent notes. In Intune, you'll be able to set the app protection policy setting **Sync policy managed app data with app widgets** to **Block** for iOS/iPadOS apps. This setting will be available as part of the **Data Protection** settings in app protection policies. This new setting will be an app protection feature similar to the **Sync policy managed app data with native app or add-ins** setting. @@ -87,7 +95,67 @@ Applies to: - +## Device configuration + +### Device Firmware Configuration Interface (DFCI) support for Samsung devices + +We're adding support to use DFCI profiles to manage UEFI (BIOS) settings for Samsung devices that run Windows 10 or Windows 11. Not all Samsung devices running Windows are enabled for DFCI. Contact your device vendor or device manufacturer for eligible devices. + +You can manage DFCI profiles from within the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) by going to **Devices** > **Manage devices** > **Configuration** > **Create** > **New policy** > **Windows 10 and later** for platform > **Templates** > **Device Firmware Configuration Interface** for profile type. For more information about DFCI profiles, see: + +- [Configure Device Firmware Configuration Interface (DFCI) profiles on Windows devices in Microsoft Intune](../configuration/device-firmware-configuration-interface-windows.md) +- [Device Firmware Configuration Interface (DFCI) management with Windows Autopilot](../../autopilot/dfci-management.md) + +Applies to: + +- Windows + +### New settings for Windows 24H2 in the Windows settings catalog + +The Settings Catalog lists all the settings you can configure in a device policy, and all in one place. You can view these Windows settings in the Microsoft Intune admin center by going to **Devices** > **Manage devices** > **Configuration** > **Create** > **New policy** > **Windows 10 and later for platform** > **Settings catalog** for profile type. + +We're working on the addition of new settings for Window 24H2. + +Applies to: + +- Windows + +### New settings available in the Apple settings catalog + +The [Settings Catalog](../configuration/settings-catalog.md) lists all the settings you can configure in a device policy, and all in one place. For more information about configuring Settings Catalog profiles in Intune, see [Create a policy using settings catalog](../configuration/settings-catalog.md). + +We're adding new settings to the Settings Catalog. To view available settings, in the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Devices** > **Manage devices** > **Configuration** > **Create** > **New policy** > **iOS/iPadOS** or **macOS** for platform > **Settings catalog** for profile type. + +#### iOS/iPadOS + +**Restrictions**: + +- Allow Apps To Be Hidden +- Allow Apps To Be Locked +- Allow Call Recording +- Allow Mail Summary +- Allow RCS Messaging + +##### macOS + +**Declarative Device Management (DDM) > Math Settings**: + +- Calculator + - Input Mode - RPN + +**Restrictions**: + +- Allow Mail Summary +- Allow Media Sharing Modification + +The following settings have been deprecated by Apple and will be marked as deprecated in the Settings Catalog: + +#### macOS + +**Security > Firewall**: + +- Enable Logging +- Logging Option @@ -97,6 +165,14 @@ Applies to: ## Device management +### Store macOS certificates in user keychain + +Soon you'll have the option to store macOS certificates in the user keychain. Currently, Microsoft Intune automatically stores user and device certificates in the *device* keychain. The enhancement will strengthen system security, and will improve the user experience by reducing certificate prompts. + +Applies to: + +- macOS + ### Device Inventory for Windows Device inventory lets you collect and view additional hardware properties from your managed devices to help you better understand the state of your devices and make business decisions. @@ -111,6 +187,23 @@ Applies to: ## Device security +### Linux support for Endpoint detection and response exclusion settings + +We are adding a new Endpoint Security template under Endpoint detection and response (EDR) for the Linux platform, that will be supported through the [Microsoft Defender for Endpoint security settings management](../protect/mde-security-integration.md) scenario. + +The template will support settings related to global exclusion settings. Applicable to antivirus and EDR engines on the client, the settings can configure exclusions to stop associated real time protection EDR alerts for the excluded items. Exclusions can be defined by the file path, folder, or process explicitly defined by the admin in the policy. + +Applies to: + +- Linux + +### New Microsoft Tunnel readiness check for auditd package + +We're updating the [Microsoft Tunnel readiness tool](../protect/microsoft-tunnel-prerequisites.md#run-the-readiness-tool) to detect if the **auditd** package for Linux System Auditing (LSA) is installed on your Linux Server. When this check is in place, the mst-readiness tool will raise a warning if the audit package isn't installed. Auditing isn't a required prerequisite for the Linux Server, but recommended. + +For more information on *auditd* and how to install it on your Microsoft Tunnel server, see [Linux system auditing](../protect/microsoft-tunnel-prerequisites.md#linux-system-auditing). + + ### Support for Intune Device control policy for devices managed by Microsoft Defender for Endpoint You'll be able to use the endpoint security policy for *Device control* (Attack surface reduction policy) from the Microsoft Intune with the devices you manage through the [Microsoft Defender for Endpoint security settings management](../protect/mde-security-integration.md) capability. @@ -134,7 +227,40 @@ When this change takes effect, devices that are assigned this policy while manag - +## Monitor and troubleshoot + +### New device actions for single device query + +We're adding the Intune remote device actions to Single device query to help you manage your devices remotely. From the device query interface, you'll be able to run device actions based on query results for faster and more efficient troubleshooting. + +Applies to: + +- Windows + +For more information, see: + +- [Device query in Microsoft Intune](../../analytics/device-query.md) +- [Run remote actions on devices with Microsoft Intune](../remote-actions/device-management.md) + +### Device Query for Multiple Devices + +We're adding Device query for multiple devices. This feature allows you to gain comprehensive insights about your entire fleet of devices using Kusto Query Language (KQL) to query across collected inventory data for your devices. + +Device query for multiple devices will be supported for devices running Windows 10 or later. This feature will be included as part of Advanced Analytics. + +Applies to: + +- Windows + +### ICCID will be inventoried for Android Enterprise Dedicated and Fully Managed + +We're adding the ability to view a device's ICCID number for devices enrolled as Android Enterprise Dedicated or Android Fully Managed. Admins can view ICCID numbers in their device inventory. + +When available, you can find the ICCID number for Android devices by navigating to **Devices** > **Android**. Select a device of interest. In the side panel, under **Monitor** select **Hardware**. The ICCID number will be in the **Network details** group. The ICCID number isn't supported for Android Corporate-Owned Work Profile devices. + +Applies to: + +- Android diff --git a/memdocs/intune/fundamentals/intune-govt-service-description.md b/memdocs/intune/fundamentals/intune-govt-service-description.md index 1db705490c7..1f49422a6ff 100644 --- a/memdocs/intune/fundamentals/intune-govt-service-description.md +++ b/memdocs/intune/fundamentals/intune-govt-service-description.md @@ -7,7 +7,7 @@ keywords: author: MandiOhlinger ms.author: mandia manager: dougeby -ms.date: 09/19/2024 +ms.date: 10/30/2024 ms.topic: article ms.service: microsoft-intune ms.suite: ems @@ -73,7 +73,7 @@ The following features are available and supported in Microsoft GCC High and/or | --- | --- | | Standard MDM features | ✅

You can use app policies, device configuration profiles, compliance policies, and more. | | Mobile Threat Defense (MTD) | ✅

Mobile Threat Defense (MTD) connectors for Android and iOS/iPadOS devices with MTD vendors that **also support** the GCC High environment can be used. When you sign in to a GCC High tenant, you see the connectors that are available in these environments. | -| Microsoft Defender for Endpoint security settings management (public preview)| ✅

On devices onboarded to Defender but not enrolled in Intune, you can use Intune endpoint security policies to manage Defender security settings. For more information on this feature, go to [Defender for Endpoint security settings management](../protect/mde-security-integration.md). | +| Microsoft Defender for Endpoint security settings management | ✅

On devices onboarded to Defender but not enrolled in Intune, you can use Intune endpoint security policies to manage Defender security settings.

This support extends to the US Government Community Cloud (GCC), US Government Community High (GCC High), and Department of Defense (DoD) environments.

For more information on this feature, go to [Defender for Endpoint security settings management](../protect/mde-security-integration.md). | | Platform support | ✅

You can use the same operating systems - Android, AOSP, iOS/iPadOS, Linux, macOS, and Windows.

- **Android (AOSP)**: There are some device restrictions. For more information, go to [Supported operating systems and browsers in Intune - AOSP](supported-devices-browsers.md#android).
- **Linux**: Generally available (GA) in February 2024.| | Remote Help | ✅

Remote Help is supported in GCC on Android, macOS, and Windows devices. It's not supported in GCC High or DoD.

For more information on this feature, go to [Remote Help in Microsoft Intune](../fundamentals/remote-help.md). | | Windows Autopilot device preparation | ✅

Some features are available now, such as user-driven deployments, and some are still [in the planning phase](#in-the-planning-phase). For more information on the recent changes to Windows Autopilot device preparation, go to [Blog: Windows deployment with the next generation of Windows Autopilot](https://techcommunity.microsoft.com/t5/microsoft-intune-blog/windows-deployment-with-the-next-generation-of-windows-autopilot/ba-p/4148169).

To get started with Windows Autopilot device preparation, go to [Windows Autopilot Device Preparation overview](/autopilot/device-preparation/overview). | diff --git a/memdocs/intune/fundamentals/intune-planning-guide.md b/memdocs/intune/fundamentals/intune-planning-guide.md index 82caaf3feb0..2d39a8ba885 100644 --- a/memdocs/intune/fundamentals/intune-planning-guide.md +++ b/memdocs/intune/fundamentals/intune-planning-guide.md @@ -623,7 +623,7 @@ Validate the end-user experience with success metrics in your deployment plan. S - Tools and resources - Q & A -The community-based [Intune forum](https://social.technet.microsoft.com/Forums/home) and [end-user documentation](/intune-user-help/use-managed-devices-to-get-work-done) are also great resources. +The community-based [Intune forum](https://social.technet.microsoft.com/Forums/home) and [end-user documentation](/mem/intune/user-help/use-managed-devices-to-get-work-done) are also great resources. ## Related articles diff --git a/memdocs/intune/fundamentals/manage-apps.md b/memdocs/intune/fundamentals/manage-apps.md index f5bcbfb2ed9..beb5c63fd50 100644 --- a/memdocs/intune/fundamentals/manage-apps.md +++ b/memdocs/intune/fundamentals/manage-apps.md @@ -125,7 +125,7 @@ The app features in the Intune admin center make it easier to deploy these diffe - [Win32 app management](../apps/apps-win32-app-management.md) > [!NOTE] - > [Microsoft Store for Business](/microsoft-store/microsoft-store-for-business-overview) is being retired. Starting with Windows 11, you have a new option for your private volume-licensed apps. For more information, go to [Private app repository in Windows 11](/windows/application-management/private-app-repository-mdm-company-portal-windows-11) and [Update to Microsoft Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077). + > Microsoft Store for Business is being retired. Starting with Windows 11, you have a new option for your private volume-licensed apps. For more information, go to [Private app repository in Windows 11](/windows/application-management/private-app-repository-mdm-company-portal-windows-11) and [Update to Microsoft Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077). ## Configure apps before they're installed diff --git a/memdocs/intune/fundamentals/reports-export-graph-available-reports.md b/memdocs/intune/fundamentals/reports-export-graph-available-reports.md index 36153a1962c..a5331e077d2 100644 --- a/memdocs/intune/fundamentals/reports-export-graph-available-reports.md +++ b/memdocs/intune/fundamentals/reports-export-graph-available-reports.md @@ -860,6 +860,7 @@ The following table contains the possible output when calling the `AppInvAggrega | ApplicationShortVersion | | ApplicationVersion | | DeviceCount | +| Platform | There are no filters for this report. @@ -884,7 +885,19 @@ The following table contains the possible output when calling the `AppInvRawData | EmailAddress | | UserName | -There are no filters for this report. +You can filter the `AppInvRawData` report using the `eq` comparison operator on the following properties: +- ApplicationName +- ApplicationPublisher +- ApplicationShortVersion +- ApplicationVersion +- DeviceId +- DeviceName +- OSDescription +- OSVersion +- Platform +- UserId +- EmailAddress +- UserName ## ChromeOSDevices report @@ -941,7 +954,7 @@ You can check whether the ChromeOSDevices report has completed by using the Micr Use the output from the above call to determine the status of the ChromeOSDevices report. An example call will look similar to the following: `https://graph.microsoft.com/beta/deviceManagement/reports/exportJobs('ChromeOSDevices_1223a321-4bcd-5432-efg1-0hi9876h1234') ` -You can continue to run your call to check the status of the report. When the report shows a status of `complete`, you're report is ready to be downloaded. +You can continue to run your call to check the status of the report. When the report shows a status of `complete`, your report is ready to be downloaded. ### Download the completed ChromeOSDevices report diff --git a/memdocs/intune/fundamentals/whats-new.md b/memdocs/intune/fundamentals/whats-new.md index 3791d16f6de..8e8e34fe44f 100644 --- a/memdocs/intune/fundamentals/whats-new.md +++ b/memdocs/intune/fundamentals/whats-new.md @@ -7,7 +7,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 10/19/2024 +ms.date: 10/31/2024 ms.topic: conceptual ms.service: microsoft-intune ms.subservice: fundamentals @@ -75,6 +75,15 @@ You can use RSS to be notified when this page is updated. For more information, ### Tenant administration --> +## Week of October 28, 2024 + +### Device security + +#### Defender for Endpoint security settings support in government cloud environments (generally available) + +Now generally available, customer tenants in the Government Community Cloud (GCC), US Government Community High (GCC High), and Department of Defense (DoD) environments can use Intune to manage the Defender security settings on the devices you’ve onboarded to Defender without enrolling those devices with Intune. Previously, support for Defender security settings was in public preview. + +This capability is known as [Defender for Endpoint security settings management](../protect/mde-security-integration.md). ## Week of October 14, 2024 (Service release 2410) diff --git a/memdocs/intune/includes/intune-notices.md b/memdocs/intune/includes/intune-notices.md index ef1daca0e81..615a5ca2d36 100644 --- a/memdocs/intune/includes/intune-notices.md +++ b/memdocs/intune/includes/intune-notices.md @@ -4,7 +4,7 @@ description: include file author: dougeby ms.service: microsoft-intune ms.topic: include -ms.date: 03/13/2024 +ms.date: 10/30/2024 ms.author: dougeby manager: dougeby ms.custom: include file @@ -12,6 +12,26 @@ ms.custom: include file These notices provide important information that can help you prepare for future Intune changes and features. +### Update to the latest Intune App SDK and Intune App Wrapper for Android 15 support +We've recently released new versions of the Intune App SDK and Intune App Wrapping Tool for Android to support Android 15. We recommend upgrading your app to the latest SDK or wrapper versions to ensure applications stay secure and run smoothly. + +#### How does this affect you or your users? + +If you have applications using the Intune App SDK or Intune App Wrapping Tool for Android, it's recommended that you update your app to the latest version to support Android 15. + +#### How can you prepare? + +If you choose to build apps targeting Android API 35, you'll need to adopt the new version of the Intune App SDK for Android (v11.0.0). If you’ve wrapped your app and are targeting API 35 you'll need to use the new version of the App wrapper (v1.0.4549.6). + +> [!NOTE] +> As a reminder, while apps must update to the latest SDK if targeting Android 15, apps do not need to update the SDK to simply run on Android 15. + +You should also plan to update your documentation or developer guidance if applicable to include this change in support for the SDK. + +Here are the public repositories: +- [Intune App SDK for Android](https://github.com/microsoftconnect/ms-intune-app-sdk-android) +- [Intune App Wrapping Tool for Android](https://github.com/microsoftconnect/intune-app-wrapping-tool-android) + ### Take Action: Update to the latest Intune App SDK for iOS and Intune App Wrapping Tool for iOS To support the upcoming release of iOS/iPadOS 18.1, update to the latest versions of the Intune App SDK and the Intune App Wrapping Tool to ensure applications stay secure and run smoothly. **Important:** If you don't update to the latest versions, some app protection policies may not apply to your app in certain scenarios. Review the following GitHub announcements for more details on the specific impact: diff --git a/memdocs/intune/industry/education/tutorial-school-deployment/common-config-ipads-ai.md b/memdocs/intune/industry/education/tutorial-school-deployment/common-config-ipads-ai.md new file mode 100644 index 00000000000..471b12382f2 --- /dev/null +++ b/memdocs/intune/industry/education/tutorial-school-deployment/common-config-ipads-ai.md @@ -0,0 +1,52 @@ +--- +title: Common Education iPads Apple Intelligence configuration +description: Learn about common iPads Apple Intelligence configuration used by Education organizations in Intune. +ms.date: 10/16/2024 +ms.topic: tutorial +author: yegor-a +ms.author: egorabr +ms.manager: dougeby +no-loc: [Microsoft, Apple] +ms.collection: +- graph-interactive +--- + +# Apple Intelligence + +This article summarizes restrictions for Apple Intelligence introduced in iPadOS 18. + +To learn more, see: + +- [Use the settings catalog to configure settings on Windows, iOS/iPadOS and macOS devices](/mem/intune/configuration/settings-catalog) +- [Restrictions payload](https://developer.apple.com/documentation/devicemanagement/restrictions) +- [iPadOS 18](https://www.apple.com/ipados/ipados-18) + +> [!TIP] +> When creating a settings catalog profile in the Microsoft Intune admin center, you can copy a policy name from this article and paste it into the settings picker search field to find the desired policy. + +## [**Settings**](#tab/settings) + +| **Category** | **Property** | **Value** | **Notes** | **Payload property** | +|---|---|:---:|---|---| +| Restrictions | **:::no-loc text="Allow Genmoji":::** | False | Prohibits creating new Genmoji. | [:::no-loc text="allowGenmoji":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Image Playground":::** | False | Prohibits the use of image generation. | [:::no-loc text="allowImagePlayground":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Image Wand":::** | False | Prohibits the use of Image Wand. | [:::no-loc text="allowImageWand":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Personalized Handwriting Results":::** | False | | [:::no-loc text="allowPersonalizedHandwritingResults":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Writing Tool":::** | False | Disables Apple Intelligence writing tools. | [:::no-loc text="allowWritingTools":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | + +## [:::image type="icon" source="../../../media/icons/graph.svg"::: **Create policy using Graph Explorer**](#tab/graph) + +[!INCLUDE [graph-explorer-introduction](../../../includes/graph-explorer-intro.md)] + +This will create a policy in your tenant with the name **_MSLearn_Example_CommonEDU - iPads - Appple Intelligence**. + +```msgraph-interactive +POST https://graph.microsoft.com/beta/deviceManagement/configurationPolicies +Content-Type: application/json + +{"name":"_MSLearn_Example_CommonEDU - iPads - Apple Intelligence","description":"","platforms":"iOS","technologies":"mdm,appleRemoteManagement","roleScopeTagIds":["0"],"settings":[{"@odata.type":"#microsoft.graph.deviceManagementConfigurationSetting","settingInstance":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationGroupSettingCollectionInstance","settingDefinitionId":"com.apple.applicationaccess_com.apple.applicationaccess","groupSettingCollectionValue":[{"children":[{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowgenmoji","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowgenmoji_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowimageplayground","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowimageplayground_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowimagewand","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowimagewand_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowpersonalizedhandwritingresults","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowpersonalizedhandwritingresults_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowwritingtools","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowwritingtools_false","children":[]}}]}]}}]} +``` + +[!INCLUDE [graph-explorer-steps](../../../includes/graph-explorer-steps.md)] + +--- diff --git a/memdocs/intune/industry/education/tutorial-school-deployment/common-config-ipads-device-restrictions.md b/memdocs/intune/industry/education/tutorial-school-deployment/common-config-ipads-device-restrictions.md new file mode 100644 index 00000000000..15dde916548 --- /dev/null +++ b/memdocs/intune/industry/education/tutorial-school-deployment/common-config-ipads-device-restrictions.md @@ -0,0 +1,145 @@ +--- +title: Common Education iPads restrictions configuration +description: Learn about common iPads restrictions configuration used by Education organizations in Intune. +ms.date: 10/16/2024 +ms.topic: tutorial +author: yegor-a +ms.author: egorabr +ms.manager: dougeby +no-loc: [Microsoft, Apple] +ms.collection: +- graph-interactive +--- + +# Common Education iPad device restrictions + +This article summarizes the configurations that are most commonly used for student and teacher iPads in educational organizations. + +To learn more, see: + +- [Use the settings catalog to configure settings on Windows, iOS/iPadOS, and macOS devices](/mem/intune/configuration/settings-catalog) +- [Configure and secure devices with Microsoft Intune](/mem/intune/industry/education/tutorial-school-deployment/configure-device-settings) +- [Review MDM payloads for Apple devices](https://support.apple.com/guide/deployment/review-mdm-payloads-dep5370d089/web) +- [MDM payload list for iPhone and iPad devices](https://support.apple.com/guide/deployment/payload-list-for-iphone-and-ipad-depdca795ebd/1/web/1.0) + +> [!TIP] +> When creating a settings catalog profile in the Microsoft Intune admin center, you can copy a policy name from this article and paste it into the settings picker search field to find the desired policy. + +## General restrictions + +### [**Settings**](#tab/settings) + +| **Category** | **Property** | **Value** | **Notes** | **Payload property** | +|---|---|:---:|---|---| +| Restrictions | **:::no-loc text="Allow Activity Continuation":::** | False | | [:::no-loc text="allowActivityContinuation":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Adding Game Center Friends":::** | False | | [:::no-loc text="allowAddingGameCenterFriends":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow AirDrop":::** | False | | [:::no-loc text="allowAirDrop":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow App Cellular Data Modification":::** | False | | [:::no-loc text="allowAppCellularDataModification":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow App Installation":::** | False | Disables the App Store, and the system removes its icon from the Home screen. Users are unable to install or update their apps. In iOS 10 and later, MDM commands can override this restriction. | [:::no-loc text="allowAppInstallation":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Apple Personalized Advertising":::** | False | | [:::no-loc text="allowApplePersonalizedAdvertising":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Assistant":::** | False | Disables Siri. | [:::no-loc text="allowAssistant":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Assistant User Generated Content":::** | False | | [:::no-loc text="allowAssistantUserGeneratedContent":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Assistant While Locked":::** | False | | [:::no-loc text="allowAssistantWhileLocked":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Auto Unlock":::** | False | | [:::no-loc text="allowAutoUnlock":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Bookstore Erotica":::** | False | | [:::no-loc text="allowBookstoreErotica":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Cellular Plan Modification":::** | False | | [:::no-loc text="allowCellularPlanModification":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Chat":::** | False | Disables the use of iMessage with supervised devices. If the device supports text messaging, the user can still send and receive text messages. | [:::no-loc text="allowChat":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Cloud Backup":::** | False | Disables backing up the device to iCloud as it can't be restricted to Managed Apple ID only. | [:::no-loc text="allowCloudBackup":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Cloud Document Sync":::** | False | Disables document and key-value syncing to iCloud. | [:::no-loc text="allowCloudDocumentSync":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Cloud Keychain Sync":::** | False | Disables iCloud keychain synchronization. | [:::no-loc text="allowCloudKeychainSync":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Cloud Photo Library":::** | False | Disables iCloud Photo Library. The system removes any photos from local storage that aren't fully downloaded from iCloud Photo Library to the device. | [:::no-loc text="allowCloudPhotoLibrary":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Cloud Private Relay":::** | False | Disables iCloud Private Relay. | [:::no-loc text="allowCloudPrivateRelay":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Device Name Modification":::** | False | Prevents the user from changing the device name. Intune Remote Action can override this restriction. | [:::no-loc text="allowDeviceNameModification":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Enabling Restrictions":::** | False | Disables the Enable Restrictions option in the Restrictions UI in Settings. | [:::no-loc text="allowEnablingRestrictions":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Enterprise App Trust":::** | False | Removes the Trust Enterprise Developer button in *Settings > General > Profiles & Device Management*, which prevents provisioning apps by universal provisioning profiles. | [:::no-loc text="allowEnterpriseAppTrust":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow ESIM Modification":::** | False | | [:::no-loc text="allowESIMModification":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Explicit Content":::** | False | | [:::no-loc text="allowExplicitContent":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Files Network Drive Access":::** | False | | [:::no-loc text="allowFilesNetworkDriveAccess":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Files USB Drive Access":::** | False | | [:::no-loc text="allowFilesUSBDriveAccess":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Find My Friends":::** | False | | [:::no-loc text="allowFindMyFriends":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Find My Friends Modification":::** | False | | [:::no-loc text="allowFindMyFriendsModification":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Game Center":::** | False | | [:::no-loc text="allowGameCenter":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow In App Purchases":::** | False | | [:::no-loc text="allowInAppPurchases":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow iPhone Widgets On Mac":::** | False | | [:::no-loc text="allowiPhoneWidgetsOnMac":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow iTunes":::** | False | | [:::no-loc text="allowiTunes":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Lock Screen Control Center":::** | False | | [:::no-loc text="allowLockScreenControlCenter":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Lock Screen Notifications View":::** | False | | [:::no-loc text="allowLockScreenNotificationsView":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Lock Screen Today View":::** | False | | [:::no-loc text="allowLockScreenTodayView":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Managed Apps Cloud Sync":::** | False | Prevents managed apps from using iCloud sync. | [:::no-loc text="allowManagedAppsCloudSync":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Marketplace App Installation":::** | False | Prevents installation of alternative marketplace apps from the web and prevents any installed alternative marketplace apps from installing apps.

**Note:** For select markets. | [:::no-loc text="allowMarketplaceAppInstallation":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Multiplayer Gaming":::** | False | | [:::no-loc text="allowMultiplayerGaming":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Music Service":::** | False | | [:::no-loc text="allowMusicService":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow News":::** | False | | [:::no-loc text="allowNews":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Notifications Modification":::** | False | | [:::no-loc text="allowNotificationsModification":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Paired Watch":::** | False | | [:::no-loc text="allowPairedWatch":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Passbook While Locked":::** | False | Hides Passbook notifications from the lock screen. | [:::no-loc text="allowPassbookWhileLocked":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Password Proximity Requests":::** | False | Disables requesting passwords from nearby devices. | [:::no-loc text="allowPasswordProximityRequests":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Password Sharing":::** | False | | [:::no-loc text="allowPasswordSharing":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Personal Hotspot Modification":::** | False | | [:::no-loc text="allowPersonalHotspotModification":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Podcasts":::** | False | | [:::no-loc text="allowPodcasts":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Proximity Setup To New Device":::** | False | | [:::no-loc text="allowProximitySetupToNewDevice":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Radio Service":::** | False | | [:::no-loc text="allowRadioService":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Shared Stream":::** | False | Disables Shared Photo Stream. | [:::no-loc text="allowSharedStream":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Spotlight Internet Results":::** | False | Disables Spotlight Internet search results in Siri Suggestions. | [:::no-loc text="allowSpotlightInternetResults":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow System App Removal":::** | False | | [:::no-loc text="allowSystemAppRemoval":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow UI App Installation":::** | False | Disables the App Store, and the systems removes its icon from the Home screen. However, users can continue to use host apps such as iTunes or Configurator to install or update their apps. | [:::no-loc text="allowUIAppInstallation":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow UI Configuration Profile Installation":::** | False | Prohibits the user from installing configuration profiles and certificates interactively. | [:::no-loc text="allowUIConfigurationProfileInstallation":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow VPN Creation":::** | False | | [:::no-loc text="allowVPNCreation":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Wallpaper Modification":::** | False | | [:::no-loc text="allowWallpaperModification":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Web Distribution App Installation":::** | False | Prevents installation of apps directly from the web.

**Note:** For select markets. | [:::no-loc text="allowWebDistributionAppInstallation":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Force Assistant Profanity Filter":::** | True | Forces the use of the profanity filter assistant. | [:::no-loc text="forceAssistantProfanityFilter":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Force Limit Ad Tracking":::** | True | Disables app tracking and the Allow Apps to Request to Track setting. | [:::no-loc text="forceLimitAdTracking":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Force WiFi Power On":::** | True | | [:::no-loc text="forceWiFiPowerOn":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Safari Force Fraud Warning":::** | True | | [:::no-loc text="safariForceFraudWarning":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Web Content Filter | **:::no-loc text="Auto Filter Enabled":::** | True | Enables automatic filtering.

**Note:** iPadOS's built-in filter checks for adult content and doesn't cover categories that are educationally inappropriate. A separate filtering solution is recommended. | [:::no-loc text="AutoFilterEnabled":::](https://developer.apple.com/documentation/devicemanagement/webcontentfilter) | + +### [:::image type="icon" source="../../../media/icons/graph.svg"::: **Create policy using Graph Explorer**](#tab/graph) + +[!INCLUDE [graph-explorer-introduction](../../../includes/graph-explorer-intro.md)] + +This will create a policy in your tenant with the name **_MSLearn_Example_CommonEDU - iPads - Device restrictions**. + +```msgraph-interactive +POST https://graph.microsoft.com/beta/deviceManagement/configurationPolicies +Content-Type: application/json + +{"name":"_MSLearn_Example_CommonEDU - iPads - Device restrictions","description":"","platforms":"iOS","technologies":"mdm,appleRemoteManagement","roleScopeTagIds":["0"],"settings":[{"@odata.type":"#microsoft.graph.deviceManagementConfigurationSetting","settingInstance":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationGroupSettingCollectionInstance","settingDefinitionId":"com.apple.applicationaccess_com.apple.applicationaccess","groupSettingCollectionValue":[{"children":[{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowactivitycontinuation","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowactivitycontinuation_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowaddinggamecenterfriends","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowaddinggamecenterfriends_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowairdrop","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowairdrop_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowappcellulardatamodification","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowappcellulardatamodification_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowappinstallation","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowappinstallation_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowapplepersonalizedadvertising","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowapplepersonalizedadvertising_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowassistant","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowassistant_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowassistantusergeneratedcontent","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowassistantusergeneratedcontent_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowassistantwhilelocked","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowassistantwhilelocked_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowautounlock","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowautounlock_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowbookstoreerotica","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowbookstoreerotica_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowcellularplanmodification","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowcellularplanmodification_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowchat","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowchat_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowcloudbackup","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowcloudbackup_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowclouddocumentsync","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowclouddocumentsync_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowcloudkeychainsync","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowcloudkeychainsync_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowcloudphotolibrary","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowcloudphotolibrary_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowcloudprivaterelay","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowcloudprivaterelay_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowdevicenamemodification","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowdevicenamemodification_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowenablingrestrictions","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowenablingrestrictions_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowenterpriseapptrust","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowenterpriseapptrust_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowesimmodification","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowesimmodification_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowexplicitcontent","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowexplicitcontent_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowfilesnetworkdriveaccess","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowfilesnetworkdriveaccess_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowfilesusbdriveaccess","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowfilesusbdriveaccess_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowfindmydevice","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowfindmydevice_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowfindmyfriends","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowfindmyfriends_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowfindmyfriendsmodification","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowfindmyfriendsmodification_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowgamecenter","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowgamecenter_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowinapppurchases","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowinapppurchases_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowiphonewidgetsonmac","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowiphonewidgetsonmac_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowitunes","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowitunes_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowlockscreencontrolcenter","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowlockscreencontrolcenter_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowlockscreennotificationsview","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowlockscreennotificationsview_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowlockscreentodayview","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowlockscreentodayview_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowmanagedappscloudsync","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowmanagedappscloudsync_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowmarketplaceappinstallation","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowmarketplaceappinstallation_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowmultiplayergaming","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowmultiplayergaming_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowmusicservice","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowmusicservice_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allownews","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allownews_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allownotificationsmodification","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allownotificationsmodification_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowpairedwatch","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowpairedwatch_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowpassbookwhilelocked","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowpassbookwhilelocked_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowpasswordproximityrequests","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowpasswordproximityrequests_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowpasswordsharing","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowpasswordsharing_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowpersonalhotspotmodification","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowpersonalhotspotmodification_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowpodcasts","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowpodcasts_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowproximitysetuptonewdevice","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowproximitysetuptonewdevice_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowradioservice","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowradioservice_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowsharedstream","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowsharedstream_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowspotlightinternetresults","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowspotlightinternetresults_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowsystemappremoval","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowsystemappremoval_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowuiappinstallation","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowuiappinstallation_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowuiconfigurationprofileinstallation","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowuiconfigurationprofileinstallation_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowvpncreation","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowvpncreation_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowwallpapermodification","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowwallpapermodification_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowwebdistributionappinstallation","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowwebdistributionappinstallation_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_forceassistantprofanityfilter","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_forceassistantprofanityfilter_true","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_forcelimitadtracking","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_forcelimitadtracking_true","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_forcewifipoweron","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_forcewifipoweron_true","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_safariforcefraudwarning","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_safariforcefraudwarning_true","children":[]}}]}]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationSetting","settingInstance":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationGroupSettingCollectionInstance","settingDefinitionId":"com.apple.webcontent-filter_com.apple.webcontent-filter","groupSettingCollectionValue":[{"children":[{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.webcontent-filter_autofilterenabled","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.webcontent-filter_autofilterenabled_true","children":[]}}]}]}}]} +``` + +[!INCLUDE [graph-explorer-steps](../../../includes/graph-explorer-steps.md)] + +--- + +## Settings that require additional consideration + +> [!CAUTION] +> Enable these settings with caution after carefully evaluating their effect on your environment. + +### [**Settings**](#tab/settings) + +| **Category** | **Property** | **Value** | **Notes** | **Payload property** | +|---|---|:---:|---|---| +| Managed Settings > MDM Options | **:::no-loc text="Activation Lock Allowed While Supervised":::** | False | Does not register a supervised device with Activation Lock. | [:::no-loc text="activationLockAllowedWhileSupervised":::](https://developer.apple.com/documentation/devicemanagement/settingscommand/command/settings/mdmoptions/mdmoptions) | +| Restrictions | **:::no-loc text="Allow App Removal":::** | False | Disables removal of apps from an iOS device.

**Note:** Could result in devices running out of disk space. | [:::no-loc text="allowAppRemoval":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Erase Content And Settings":::** | False | Without an ability to locally reset the device it complicates device recovery. | [:::no-loc text="allowEraseContentAndSettings":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Unpaired External Boot To Recovery":::** | False | Does not allow devices to be booted into recovery by an unpaired device. | [:::no-loc text="allowUnpairedExternalBootToRecovery":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Untrusted TLS Prompt":::** | False | Websites with untrusted certificates will not be displayed. If you use a DNS filtering solution or need to accept certificate changes due to SSL inspection, distribute the root CA certificate of the changed certificate from MDM. | [:::no-loc text="allowUntrustedTLSPrompt":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Video Conferencing":::** | False | Hides the FaceTime app.

**Note:** Disabling may prevent screen sharing in some remote assistant apps used by IT Helpdesk. | [:::no-loc text="allowVideoConferencing":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Force WiFi To Allowed Networks Only":::** | True | Limits the device to only join Wi-Fi networks set up through a configuration profile.

**Note:** Could potentially leave the device in an unmanageable state if unable to connect to allowed networks. | [:::no-loc text="forceWiFiToAllowedNetworksOnly":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | + +### [:::image type="icon" source="../../../media/icons/graph.svg"::: **Create policy using Graph Explorer**](#tab/graph) + +[!INCLUDE [graph-explorer-introduction](../../../includes/graph-explorer-intro.md)] + +This will create a policy in your tenant with the name **_MSLearn_Example_CommonEDU - iPads - Device restrictions (require additional consideration)**. + +```msgraph-interactive +POST https://graph.microsoft.com/beta/deviceManagement/configurationPolicies +Content-Type: application/json + +{"name":"_MSLearn_Example_CommonEDU - iPads - Device restrictions (require additional consideration)","description":"","platforms":"iOS","technologies":"mdm,appleRemoteManagement","roleScopeTagIds":["0"],"settings":[{"@odata.type":"#microsoft.graph.deviceManagementConfigurationSetting","settingInstance":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationGroupSettingCollectionInstance","settingDefinitionId":"settings_item_mdmoptions","groupSettingCollectionValue":[{"children":[{"@odata.type":"#microsoft.graph.deviceManagementConfigurationGroupSettingCollectionInstance","settingDefinitionId":"settings_item_mdmoptions_mdmoptions","groupSettingCollectionValue":[{"children":[{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"settings_item_mdmoptions_mdmoptions_activationlockallowedwhilesupervised","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"settings_item_mdmoptions_mdmoptions_activationlockallowedwhilesupervised_false","children":[]}}]}]}]}]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationSetting","settingInstance":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationGroupSettingCollectionInstance","settingDefinitionId":"com.apple.applicationaccess_com.apple.applicationaccess","groupSettingCollectionValue":[{"children":[{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowappremoval","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowappremoval_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowerasecontentandsettings","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowerasecontentandsettings_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowunpairedexternalboottorecovery","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowunpairedexternalboottorecovery_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowuntrustedtlsprompt","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowuntrustedtlsprompt_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowvideoconferencing","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowvideoconferencing_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_forcewifitoallowednetworksonly","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_forcewifitoallowednetworksonly_true","children":[]}}]}]}}]} +``` + +[!INCLUDE [graph-explorer-steps](../../../includes/graph-explorer-steps.md)] + +--- diff --git a/memdocs/intune/industry/education/tutorial-school-deployment/common-config-ipads-nouser.md b/memdocs/intune/industry/education/tutorial-school-deployment/common-config-ipads-nouser.md new file mode 100644 index 00000000000..8d5c79bbd0a --- /dev/null +++ b/memdocs/intune/industry/education/tutorial-school-deployment/common-config-ipads-nouser.md @@ -0,0 +1,57 @@ +--- +title: Common Education iPads with no user affinity configuration +description: Learn about common iPads with no user affinity configuration used by Education organizations in Intune. +ms.date: 10/16/2024 +ms.topic: tutorial +author: yegor-a +ms.author: egorabr +ms.manager: dougeby +no-loc: [Microsoft, Apple] +ms.collection: +- graph-interactive +--- + +# iPads with no user affinity + +iPads used in earlier grades are commonly enrolled with no user affinity to simplify the user experience for younger students and to allow sharing of devices. For more information, please refer to [Enroll devices with Automated Device Enrollment](/mem/intune/industry/education/tutorial-school-deployment/enroll-ios-ade). + +These iPads generally have additional restrictions that are not suitable for 1:1 devices. + +To learn more, see: + +- [Use the settings catalog to configure settings on Windows, iOS/iPadOS and macOS devices](/mem/intune/configuration/settings-catalog) +- [Restrictions payload](https://developer.apple.com/documentation/devicemanagement/restrictions) + +> [!TIP] +> When creating a settings catalog profile in the Microsoft Intune admin center, you can copy a policy name from this article and paste it into the settings picker search field to find the desired policy. + +## [**Settings**](#tab/settings) + +| **Category** | **Property** | **Value** | **Notes** | **Payload property** | +|---|---|:---:|---|---| +| Restrictions | **:::no-loc text="Allow Account Modification":::** | False | Disables modification of accounts such as Apple IDs and Internet-based accounts such as Mail, Contacts, and Calendar. | [:::no-loc text="allowAccountModification":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Bookstore":::** | False | Removes the Book Store tab from the Books app. | [:::no-loc text="allowBookstore":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Enterprise Book Backup":::** | False | Disables backup of Enterprise books. | [:::no-loc text="allowEnterpriseBookBackup":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Enterprise Book Metadata Sync":::** | False | Disables sync of Enterprise books, notes, and highlights. | [:::no-loc text="allowEnterpriseBookMetadataSync":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Fingerprint For Unlock":::** | False | Prevents Touch ID or Face ID from unlocking a device. | [:::no-loc text="allowFingerprintForUnlock":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Fingerprint Modification":::** | False | Prevents the user from modifying Touch ID or Face ID. | [:::no-loc text="allowFingerprintModification":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Passcode Modification":::** | False | Prevents adding, changing, or removing the passcode. | [:::no-loc text="allowPasscodeModification":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Password Auto Fill":::** | False | | [:::no-loc text="allowPasswordAutoFill":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Safari Allow Autofill":::** | False | Disables Safari AutoFill for passwords, contact info, and credit cards and also prevents using the Keychain for AutoFill. | [:::no-loc text="safariAllowAutoFill":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | + +## [:::image type="icon" source="../../../media/icons/graph.svg"::: **Create policy using Graph Explorer**](#tab/graph) + +[!INCLUDE [graph-explorer-introduction](../../../includes/graph-explorer-intro.md)] + +This will create a policy in your tenant with the name **_MSLearn_Example_CommonEDU - iPads - No user affinity**. + +```msgraph-interactive +POST https://graph.microsoft.com/beta/deviceManagement/configurationPolicies +Content-Type: application/json + +{"name":"_MSLearn_Example_CommonEDU - iPads - No user affinity","description":"","platforms":"iOS","technologies":"mdm,appleRemoteManagement","roleScopeTagIds":["0"],"settings":[{"@odata.type":"#microsoft.graph.deviceManagementConfigurationSetting","settingInstance":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationGroupSettingCollectionInstance","settingDefinitionId":"com.apple.applicationaccess_com.apple.applicationaccess","groupSettingCollectionValue":[{"children":[{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowaccountmodification","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowaccountmodification_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowbookstore","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowbookstore_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowenterprisebookbackup","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowenterprisebookbackup_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowenterprisebookmetadatasync","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowenterprisebookmetadatasync_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowfingerprintforunlock","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowfingerprintforunlock_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowfingerprintmodification","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowfingerprintmodification_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowpasscodemodification","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowpasscodemodification_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowpasswordautofill","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowpasswordautofill_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_safariallowautofill","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_safariallowautofill_false","children":[]}}]}]}}]} +``` + +[!INCLUDE [graph-explorer-steps](../../../includes/graph-explorer-steps.md)] + +--- diff --git a/memdocs/intune/industry/education/tutorial-school-deployment/common-config-ipads-optional.md b/memdocs/intune/industry/education/tutorial-school-deployment/common-config-ipads-optional.md new file mode 100644 index 00000000000..dff086ba432 --- /dev/null +++ b/memdocs/intune/industry/education/tutorial-school-deployment/common-config-ipads-optional.md @@ -0,0 +1,60 @@ +--- +title: Common Education iPads optional configuration +description: Learn about common iPads optional configuration used by Education organizations in Intune. +ms.date: 10/16/2024 +ms.topic: tutorial +author: yegor-a +ms.author: egorabr +ms.manager: dougeby +no-loc: [Microsoft, Apple] +ms.collection: +- graph-interactive +--- + +# Optional restrictions + +Optional policies, while relatively common, are provided for more situational use cases. + +To learn more, see: + +- [Use the settings catalog to configure settings on Windows, iOS/iPadOS and macOS devices](/mem/intune/configuration/settings-catalog) +- [Restrictions payload](https://developer.apple.com/documentation/devicemanagement/restrictions) + +> [!TIP] +> When creating a settings catalog profile in the Microsoft Intune admin center, you can copy a policy name from this article and paste it into the settings picker search field to find the desired policy. + +## [**Settings**](#tab/settings) + +| **Category** | **Property** | **Value** | **Notes** | **Payload property** | +|---|---|:---:|---|---| +| Managed Settings > Bluetooth | **:::no-loc text="Enabled":::** | True | Enable the Bluetooth setting. | [:::no-loc text="Enabled":::](https://developer.apple.com/documentation/devicemanagement/settingscommand/command/settings/bluetooth) | +| Restrictions | **:::no-loc text="Force Automatic Date And Time":::** | True | Enables the Set Automatically feature in Date & Time and the user can't disable it.

**Note:**

| [:::no-loc text="forceAutomaticDateAndTime":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Managed Settings > Time Zone | **:::no-loc text="Time Zone":::** | **Example**:
America/Los_Angeles
Asia/Tokyo
Australia/Brisbane

See complete list in [:::no-loc text="IANA time zone database":::](https://data.iana.org/time-zones/tzdb/zone.tab). | If the **forceAutomaticDateAndTime** restriction is set in Restrictions, this setting fails with an error. Otherwise, setting this value disables automatic time zone logic. The user is still able to change the time zone; for example, by turning automatic date and time back on. The intention is to allow setting the time zone when automatic determination isn't available, such as when Location Services are off. | [:::no-loc text="TimeZone":::](https://developer.apple.com/documentation/devicemanagement/settingscommand/command/settings/timezone) | +| Restrictions | **:::no-loc text="Allow Bluetooth Modification":::** | False | Prevents modification of Bluetooth settings. | [:::no-loc text="allowBluetoothModification":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow USB Restricted Mode":::** | True | Allows iOS devices to always connect to USB accessories while locked. If the system has Lockdown mode enabled, it ignores this value. | [:::no-loc text="allowUSBRestrictedMode":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Blocked App Bundle IDs":::** | **Example:**
com.apple.facetime
com.apple.findmy
com.apple.Home
com.apple.MobileStore
com.apple.MobileSMS
com.apple.Music
com.apple.podcasts
com.apple.stocks
com.apple.tv
com.apple.store.Jolly
com.apple.supportapp | Prevents showing or launching apps with bundle IDs in the array. | [:::no-loc text="blockedAppBundleIDs":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Enforced Software Update Delay":::** | 30 | How many days to delay a software update on the device. | [:::no-loc text="enforcedSoftwareUpdateDelay":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Force Classroom Automatically Join Classes":::** | True | Automatically gives permission to the teacher's requests without prompting the student. | [:::no-loc text="forceClassroomAutomaticallyJoinClasses":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Force Classroom Request Permission To Leave Classes":::** | True | A student enrolled in an unmanaged course through Classroom needs to request permission from the teacher to leave the course. | [:::no-loc text="forceClassroomRequestPermissionToLeaveClasses":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Force Classroom Unprompted App And Device Lock":::** | True | Allows the teacher to lock apps or the device without prompting the student. | [:::no-loc text="forceClassroomUnpromptedAppAndDeviceLock":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Force Classroom Unprompted Screen Observation":::** | True | If true and ScreenObservationPermissionModificationAllowed is also true in the [Education](https://developer.apple.com/documentation/devicemanagement/educationconfiguration) payload, a student enrolled in a managed course through the Classroom app automatically gives permission to that course teacher's requests to observe the student's screen without prompting the student. | [:::no-loc text="forceClassroomUnpromptedScreenObservation":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Force Preserve ESIM On Erase":::** | True | Preserves eSIM when it erases the device due to too many failed password attempts or the Erase All Content and Settings option.

**Note:** Doesn't preserve eSIM if Find My initiates erasing the device. | [:::no-loc text="forcePreserveESIMOnErase":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| System Configuration > Lock Screen Message | **:::no-loc text="Asset Tag Information":::** | {{devicename}} | Displayed in the login window and Lock screen. | [:::no-loc text="AssetTagInformation":::](https://developer.apple.com/documentation/devicemanagement/lockscreenmessage) | +| System Configuration > Lock Screen Message | **:::no-loc text="Lock Screen Footnote":::** | **Example**:
School of Fine Art | The footnote displayed in the login window and Lock screen. | [:::no-loc text="LockScreenFootnote":::](https://developer.apple.com/documentation/devicemanagement/lockscreenmessage) | + +## [:::image type="icon" source="../../../media/icons/graph.svg"::: **Create policy using Graph Explorer**](#tab/graph) + +[!INCLUDE [graph-explorer-introduction](../../../includes/graph-explorer-intro.md)] + +This will create a policy in your tenant with the name **_MSLearn_Example_CommonEDU - iPads - Optional**. + +```msgraph-interactive +POST https://graph.microsoft.com/beta/deviceManagement/configurationPolicies +Content-Type: application/json + +{"name":"_MSLearn_Example_CommonEDU - iPads - Optional","description":"","platforms":"iOS","technologies":"mdm,appleRemoteManagement","roleScopeTagIds":["0"],"settings":[{"@odata.type":"#microsoft.graph.deviceManagementConfigurationSetting","settingInstance":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationGroupSettingCollectionInstance","settingDefinitionId":"settings_item_bluetooth","groupSettingCollectionValue":[{"children":[{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"settings_item_bluetooth_enabled","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"settings_item_bluetooth_enabled_true","children":[]}}]}]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationSetting","settingInstance":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationGroupSettingCollectionInstance","settingDefinitionId":"settings_item_timezone","groupSettingCollectionValue":[{"children":[{"@odata.type":"#microsoft.graph.deviceManagementConfigurationSimpleSettingInstance","settingDefinitionId":"settings_item_timezone_timezone","simpleSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationStringSettingValue","value":"America/Los_Angeles"}}]}]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationSetting","settingInstance":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationGroupSettingCollectionInstance","settingDefinitionId":"com.apple.applicationaccess_com.apple.applicationaccess","groupSettingCollectionValue":[{"children":[{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowbluetoothmodification","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowbluetoothmodification_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowusbrestrictedmode","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowusbrestrictedmode_true","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationSimpleSettingCollectionInstance","settingDefinitionId":"com.apple.applicationaccess_blockedappbundleids","simpleSettingCollectionValue":[{"value":"com.apple.facetime","@odata.type":"#microsoft.graph.deviceManagementConfigurationStringSettingValue"},{"value":"com.apple.findmy","@odata.type":"#microsoft.graph.deviceManagementConfigurationStringSettingValue"},{"value":"com.apple.Home","@odata.type":"#microsoft.graph.deviceManagementConfigurationStringSettingValue"},{"value":"com.apple.MobileStore","@odata.type":"#microsoft.graph.deviceManagementConfigurationStringSettingValue"},{"value":"com.apple.MobileSMS","@odata.type":"#microsoft.graph.deviceManagementConfigurationStringSettingValue"},{"value":"com.apple.Music","@odata.type":"#microsoft.graph.deviceManagementConfigurationStringSettingValue"},{"value":"com.apple.podcasts","@odata.type":"#microsoft.graph.deviceManagementConfigurationStringSettingValue"},{"value":"com.apple.stocks","@odata.type":"#microsoft.graph.deviceManagementConfigurationStringSettingValue"},{"value":"com.apple.tv","@odata.type":"#microsoft.graph.deviceManagementConfigurationStringSettingValue"},{"value":"com.apple.store.Jolly","@odata.type":"#microsoft.graph.deviceManagementConfigurationStringSettingValue"},{"value":"com.apple.supportapp","@odata.type":"#microsoft.graph.deviceManagementConfigurationStringSettingValue"}]},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationSimpleSettingInstance","settingDefinitionId":"com.apple.applicationaccess_enforcedsoftwareupdatedelay","simpleSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationIntegerSettingValue","value":30}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_forceautomaticdateandtime","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_forceautomaticdateandtime_true","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_forceclassroomautomaticallyjoinclasses","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_forceclassroomautomaticallyjoinclasses_true","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_forceclassroomrequestpermissiontoleaveclasses","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_forceclassroomrequestpermissiontoleaveclasses_true","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_forceclassroomunpromptedappanddevicelock","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_forceclassroomunpromptedappanddevicelock_true","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_forceclassroomunpromptedscreenobservation","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_forceclassroomunpromptedscreenobservation_true","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_forcepreserveesimonerase","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_forcepreserveesimonerase_true","children":[]}}]}]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationSetting","settingInstance":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationGroupSettingCollectionInstance","settingDefinitionId":"com.apple.shareddeviceconfiguration_com.apple.shareddeviceconfiguration","groupSettingCollectionValue":[{"children":[{"@odata.type":"#microsoft.graph.deviceManagementConfigurationSimpleSettingInstance","settingDefinitionId":"com.apple.shareddeviceconfiguration_assettaginformation","simpleSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationStringSettingValue","value":"{{devicename}}"}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationSimpleSettingInstance","settingDefinitionId":"com.apple.shareddeviceconfiguration_lockscreenfootnote","simpleSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationStringSettingValue","value":"MSLearn_Example_CommonEDU"}}]}]}}]} +``` + +[!INCLUDE [graph-explorer-steps](../../../includes/graph-explorer-steps.md)] + +--- diff --git a/memdocs/intune/industry/education/tutorial-school-deployment/common-config-overview.md b/memdocs/intune/industry/education/tutorial-school-deployment/common-config-overview.md index 8a94691e1ee..c89e98535ec 100644 --- a/memdocs/intune/industry/education/tutorial-school-deployment/common-config-overview.md +++ b/memdocs/intune/industry/education/tutorial-school-deployment/common-config-overview.md @@ -7,17 +7,32 @@ ms.topic: tutorial author: yegor-a ms.author: egorabr ms.manager: dougeby -no-loc: [Microsoft, Windows, Autopatch, Autopilot, Edge] +no-loc: [Microsoft, Windows, Autopatch, Autopilot, Edge, Apple] --- # Common Education configuration overview Intune is a powerful tool that can help Education organizations manage their devices and data efficiently. However, configuring the right settings can be a time-consuming task, especially for those new to the platform. To help accelerate the process, we have assembled common configurations based on customer engagements into this reference document. These settings can help ensure the security and compliance of your devices and data, while maximizing the user experience for your students and staff. Whether you're setting up a new tenant or need a quick reference guide, this document is a valuable resource for any Education organization looking to optimize their use of Intune. +## Guiding Principles and Methodology + +The recommended settings in this document are built from real-world customer configurations, reflecting how Education organizations are currently using Microsoft Intune to manage their Windows and iPadOS devices. The goal is to provide policies that prevent unintentional use, maintain consistency across devices, and ensure that devices are used solely for educational purposes. At the same time, these settings optimize the overall device experience for students. + +Key areas of focus include: + +- **Disabling AI capabilities**: Keep students focused by preventing distractions and the inappropriate use of OS AI features. +- **Update experience**: Ensure that devices are secure and up to date, while minimizing disruptions during class time. +- **Disabling changes to settings**: Maintain consistent device configurations and prevent tampering by locking critical settings. +- **Browsing experience**: Protect student privacy and data by ensuring a safe browsing environment, free from distractions and potential security risks. + +These policies are commonly used but not mandatory. Schools can tailor their configurations based on their specific needs, and optional policies are provided for more situational use cases. + > [!CAUTION] -> Adding these settings to your existing Intune tenant and assigning them to devices could potentially cause conflicts with your existing Intune policies. For more information, see [Compliance and device configuration policies that conflict](/mem/intune/configuration/device-profile-troubleshoot#conflicts). +> Adding these settings to your existing Intune tenant and assigning them to devices could potentially cause conflicts with your existing Intune policies. For more information, see [Compliance and device configuration policies that conflict](/mem/intune/configuration/device-profile-troubleshoot#conflicts) and [Avoiding policy conflicts](manage-avoid-policy-conflicts.md). + +## Intune policies for Windows in Education -## Configuration sections +### Configuration sections - [Device restrictions](/mem/intune/industry/education/tutorial-school-deployment/common-config-settings-catalog-device-restrictions) - [Windows Update](/mem/intune/industry/education/tutorial-school-deployment/common-config-windows-update) @@ -29,3 +44,10 @@ Intune is a powerful tool that can help Education organizations manage their dev - [Windows privacy](/mem/intune/industry/education/tutorial-school-deployment/common-config-settings-catalog-windows-privacy) - [Start menu customization](/mem/intune/industry/education/tutorial-school-deployment/common-config-settings-catalog-start-menu) - [OneDrive Known Folder Move](/mem/intune/industry/education/tutorial-school-deployment/common-config-settings-catalog-onedrive-knownfoldermove) + +## Intune policies for iPads in Education + +- [Device restrictions](common-config-ipads-device-restrictions.md) +- [Apple Intelligence](common-config-ipads-ai.md) +- [iPads with no user affinity](common-config-ipads-nouser.md) +- [Optional restrictions](common-config-ipads-optional.md) diff --git a/memdocs/intune/industry/education/tutorial-school-deployment/common-config-settings-catalog-device-restrictions.md b/memdocs/intune/industry/education/tutorial-school-deployment/common-config-settings-catalog-device-restrictions.md index 8360b845364..e2d4bc91e1f 100644 --- a/memdocs/intune/industry/education/tutorial-school-deployment/common-config-settings-catalog-device-restrictions.md +++ b/memdocs/intune/industry/education/tutorial-school-deployment/common-config-settings-catalog-device-restrictions.md @@ -9,7 +9,7 @@ ms.manager: dougeby no-loc: [Microsoft, Windows, Autopatch, Autopilot] --- -# Device restrictions +# Common Education device restrictions There are many device restriction settings and configuration options you have available. This article summarizes the configurations that are most commonly used for student and teacher devices. diff --git a/memdocs/intune/protect/compliance-policy-create-android-for-work.md b/memdocs/intune/protect/compliance-policy-create-android-for-work.md index b26d0e1a056..db02bedb17d 100644 --- a/memdocs/intune/protect/compliance-policy-create-android-for-work.md +++ b/memdocs/intune/protect/compliance-policy-create-android-for-work.md @@ -42,9 +42,9 @@ This feature applies to: As an Intune administrator, use these compliance settings to help protect your organizational resources. To learn more about compliance policies, and what they do, see [get started with device compliance](device-compliance-get-started.md). > [!IMPORTANT] -> Android compliance policies should only be targeted at groups of devices, not users. Compliance policies will be evaluated against the device and will appropriately reflect the compliance state in Intune. To allow users on dedicated devices to sign-in to resources protected by Conditional Access policies, consider using Android Enterprise dedicated devices with [*Microsoft Entra shared device mode*](../enrollment/android-kiosk-enroll.md). +> It's important to target compliance policies for dedicated devices at groups of devices, not users. Compliance policies will be evaluated against the device and will appropriately reflect the compliance state in Intune. To allow users on dedicated devices to sign in to resources protected by Conditional Access policies, consider using Android Enterprise dedicated devices with [*Microsoft Entra shared device mode*](../enrollment/android-kiosk-enroll.md). In scenarios with fully managed devices, or personal and corporate-owned work profiles, you can target compliance policies at groups of users or devices. > -> On Android Enterprise dedicated devices that are enrolled without Microsoft Entra shared device mode, users of the device will be unable to sign into resources protected by Conditional Access policies, even if the device is compliant in Intune. To learn more about shared device mode, see [*Overview of shared device mode*](/azure/active-directory/develop/msal-shared-devices) in the Microsoft Entra documentation. +> Users on dedicated devices enrolled without Microsoft Entra shared device mode can't sign into resources protected by Conditional Access policies, even if the device is compliant in Intune. To learn more about shared device mode, see [*Overview of shared device mode*](/azure/active-directory/develop/msal-shared-devices) in the Microsoft Entra documentation. diff --git a/memdocs/intune/protect/derived-credentials.md b/memdocs/intune/protect/derived-credentials.md index cfef3be419d..bbcb6d33ddc 100644 --- a/memdocs/intune/protect/derived-credentials.md +++ b/memdocs/intune/protect/derived-credentials.md @@ -141,7 +141,7 @@ The following are key considerations for each supported partner. Become familiar Review the platform-specific user workflow for the devices you'll use with derived credentials. -- [iOS and iPadOS](/intune-user-help/enroll-ios-device-disa-purebred) +- [iOS and iPadOS](/mem/intune/user-help/enroll-ios-device-disa-purebred) - [Android Enterprise](../user-help/enroll-android-device-disa-purebred.md) - *Corporate-Owned Work Profile* or *Fully managed devices* **Key requirements include**: @@ -167,7 +167,7 @@ For information getting and configuring the DISA Purebred app, see [Deploy the D Review the platform-specific user workflow for the devices you'll use with derived credentials. -- [iOS and iPadOS](/intune-user-help/enroll-ios-device-entrust-datacard) +- [iOS and iPadOS](/mem/intune/user-help/enroll-ios-device-entrust-datacard) - [Android Enterprise](../user-help/enroll-android-device-entrust-datacard.md)- *Corporate-Owned Work Profile* or *Fully managed devices* **Key requirements include**: @@ -191,7 +191,7 @@ Review the platform-specific user workflow for the devices you'll use with deriv Review the platform-specific user workflow for the devices you'll use with derived credentials. -- [iOS and iPadOS](/intune-user-help/enroll-ios-device-intercede) +- [iOS and iPadOS](/mem/intune/user-help/enroll-ios-device-intercede) - [Android Enterprise](../user-help/enroll-android-device-intercede.md) - *Corporate-Owned Work Profile* or *Fully managed devices* **Key requirements include**: diff --git a/memdocs/intune/protect/encrypt-devices-filevault.md b/memdocs/intune/protect/encrypt-devices-filevault.md index 1d0b5bb4cc8..21766c3a71b 100644 --- a/memdocs/intune/protect/encrypt-devices-filevault.md +++ b/memdocs/intune/protect/encrypt-devices-filevault.md @@ -1,24 +1,24 @@ --- # required metadata -title: Encrypt macOS devices with FileVault disk encryption with Intune +title: Encrypt macOS FileVault disk encryption with Intune policy titleSuffix: Microsoft Intune -description: Use Microsoft Intune encryption policy to encrypt macOS devices with FileVault, and manage recovery keys for encrypted macOS devices from within the Microsoft Intune admin center. +description: Use Microsoft Intune policy to configure FileVault on macOS devices, and use the admin center to manage their recovery keys. keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 06/21/2024 +ms.date: 10/25/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect ms.localizationpriority: high -ms.assetid: +ms.assetid: # optional metadata #audience: -ms.reviewer: annovich; aanavath +ms.reviewer: beflamm; aanavath ms.suite: ems search.appverid: MET150 #ms.tgt_pltfrm: @@ -30,7 +30,7 @@ ms.collection: --- -# Use FileVault disk encryption for macOS with Intune +# Use FileVault disk encryption for macOS with Intune Use Microsoft Intune to configure and manage macOS FileVault disk encryption. FileVault is a whole-disk encryption program that is included with macOS. With Intune you can deploy policies that configure FileVault, and then manage recovery keys on devices that run **macOS 10.13 or later**. @@ -66,62 +66,18 @@ You can add this permission and right to your own [custom RBAC roles](../fundame - Help Desk Operator - Endpoint Security Administrator -## Create device configuration policy for FileVault - -1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). - -2. Select **Devices** > **Manage devices** > **Configuration** > On the *Policies* tab, select **+ Create**. - -3. On the **Create a profile** page, set the following options, and then select **Create**: - - **Platform**: macOS - - **Profile type**: Templates - - **Template name**: Endpoint protection - - :::image type="content" source="./media/encrypt-devices-filevault/select-macos-filevault-dc.png" alt-text="Select the Endpoint protection profile."::: - -4. On the **Basics** page, enter the following properties: - - - **Name**: Enter a descriptive name for the policy. Name your policies so you can easily identify them later. For example, a good policy name might include the profile type and platform. - - - **Description**: Enter a description for the policy. This setting is optional, but recommended. - -5. On the **Configuration settings** page, select **FileVault** to expand the available settings: - - :::image type="content" source="./media/encrypt-devices-filevault/filevault-settings.png" alt-text="FileVault settings."::: - -6. Configure the following settings: - - - For *Enable FileVault*, select **Yes**. - - - For *Recovery key type*, select **Personal key**. - - - For *Escrow location description of personal recovery key*, add a message to help guide users on [how to retrieve the recovery key](#retrieve-a-personal-recovery-key) for their device. This information can be useful for your users when you use the setting for Personal recovery key rotation, which can automatically generate a new recovery key for a device periodically. - - For example: To retrieve a lost or recently rotated recovery key, sign in to the Intune Company Portal website from any device. In the portal, go to *Devices* and select the device that has FileVault enabled, and then select *Get recovery key*. The current recovery key is displayed. - - Configure the remaining [FileVault settings](endpoint-protection-macos.md#filevault) to meet your business needs, and then select **Next**. - -7. If applicable, on the **Scope (Tags)** page, choose **Select scope tags** to open the Select tags pane to assign scope tags to the profile. - - Select **Next** to continue. - -8. On the **Assignments** page, select groups to receive this profile. For more information on assigning profiles, see Assign user and device profiles. -Select **Next**. - -9. On the **Review + create** page, when you're done, choose **Create**. The new profile is displayed in the list when you select the policy type for the profile you created. - ## Create endpoint security policy for FileVault 1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). 2. Select **Endpoint security** > **Disk encryption** > **Create Policy**. -1. On the **Basics** page, enter the following properties, and then choose **Next**. -- **Platform**: macOS -- **Profile**: FileVault +3. On the **Basics** page, enter the following properties, and then choose **Next**. + - **Platform**: macOS + - **Profile**: FileVault ![Select the FileVault profile](./media/encrypt-devices-filevault/select-macos-filevault-es.png) - + 4. On the **Configuration settings** page: 1. Set *Enable FileVault* to **Yes**. 2. For *Recovery key type*, only **Personal Recovery Key** is supported. @@ -172,7 +128,7 @@ Select **Next**. 7. If applicable, on the **Scope (Tags)** page, choose **Select scope tags** to open the *Select tags* pane to assign scope tags to the profile. Select **Next** to continue. -8. On the **Assignments** page, select the groups that will receive this profile. For more information on assigning profiles, see Assign user and device profiles. Select **Next**. +8. On the **Assignments** page, select the groups that receive this profile. For more information on assigning profiles, see Assign user and device profiles. Select **Next**. 9. On the **Review + create** page, when you're done, select **Create**. The new profile is displayed in the list when you select the policy type for the profile you created. @@ -187,16 +143,61 @@ For devices that run macOS 14 and later, your settings catalog policy can also e - When *Await final Configuration* set to *Yes* for a device, you can then add the following Full Disk Encryption setting for FileVault in your settings catalog profile - FileVault > **Force Enable in Setup Assistant** – Set to **Enabled**. - + The following image shows the settings catalog profile configured with the core settings to enable FileVault and use the Setup Assistant to enforce encryption. In this example, the Location setting uses the simple name of our domain, *Contoso*: - - > [!IMPORTANT] > The **Defer** setting must be configured to **Enabled** to successfully enable FileVault in Setup Assistant for devices running macOS 14.4. - + :::image type="content" source="./media/encrypt-devices-filevault/filevault-setup-assistant-configuration.png" alt-text="Screenshot of the settings needed to enable File Vault in Setup Assistant."::: +## Create device configuration policy for FileVault (Deprecated) + +> [!NOTE] +> The macOS template for Endpoint Protection is deprecated and no longer supports creating new profiles. Instead, use the [Endpoint security](#create-endpoint-security-policy-for-filevault) or the [settings catalog](#create-settings-catalog-policy-for-filevault) to configure and manage new FileVault profiles. + +1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). + +2. Select **Devices** > **Manage devices** > **Configuration** > On the *Policies* tab, select **+ Create**. + +3. On the **Create a profile** page, set the following options, and then select **Create** > **New policy**: + - **Platform**: macOS + - **Profile type**: Templates + - **Template name**: Endpoint protection (Deprecated) + + :::image type="content" source="./media/encrypt-devices-filevault/select-macos-filevault-dc.png" alt-text="Screen shot that displays the the Endpoint protection profile."::: + +4. On the **Basics** page, enter the following properties: + + - **Name**: Enter a descriptive name for the policy. Name your policies so you can easily identify them later. For example, a good policy name might include the profile type and platform. + + - **Description**: Enter a description for the policy. This setting is optional, but recommended. + +5. On the **Configuration settings** page, select **FileVault** to expand the available settings: + + :::image type="content" source="./media/encrypt-devices-filevault/filevault-settings.png" alt-text="Screen shot that displays FileVault settings."::: + +6. Configure the following settings: + + - For *Enable FileVault*, select **Yes**. + + - For *Recovery key type*, select **Personal key**. + + - For *Escrow location description of personal recovery key*, add a message to help guide users on [how to retrieve the recovery key](#retrieve-a-personal-recovery-key) for their device. This information can be useful for your users when you use the setting for Personal recovery key rotation, which can automatically generate a new recovery key for a device periodically. + + For example: To retrieve a lost or recently rotated recovery key, sign in to the Intune Company Portal website from any device. In the portal, go to *Devices* and select the device that has FileVault enabled, and then select *Get recovery key*. The current recovery key is displayed. + + Configure the remaining [FileVault settings](endpoint-protection-macos.md#filevault) to meet your business needs, and then select **Next**. + +7. If applicable, on the **Scope (Tags)** page, choose **Select scope tags** to open the Select tags pane to assign scope tags to the profile. + + Select **Next** to continue. + +8. On the **Assignments** page, select groups to receive this profile. For more information on assigning profiles, see Assign user and device profiles. +Select **Next**. + +9. On the **Review + create** page, when you're done, choose **Create**. The new profile is displayed in the list when you select the policy type for the profile you created. + ## Manage FileVault To view information about devices that receive FileVault policy, see [Monitor disk encryption](../protect/encryption-monitor.md). @@ -224,7 +225,7 @@ Intune can’t manage FileVault disk encryption on a macOS device that is encryp - [Upload a personal recovery key to Intune](#upload-a-personal-recovery-key) – Use this method when the user knows their personal recovery key. - [The user generates a new recovery key on the device](#generate-a-new-recovery-key-on-the-device) – Use this method if the personal recovery key isn’t known by the user. -Both methods require that the device has active policy from Intune that manages FileVault encryption. To deliver this policy, you can use an [endpoint security disk encryption profile](#create-endpoint-security-policy-for-filevault), or a [device configuration endpoint protection profile](#create-device-configuration-policy-for-filevault) to encrypt devices with FileVault. +Both methods require that the device has active policy from Intune that manages FileVault encryption. To deliver this policy, use an [endpoint security disk encryption profile](#create-endpoint-security-policy-for-filevault). #### Upload a personal recovery key @@ -238,7 +239,7 @@ Upon upload, Intune rotates the key to create a new personal recovery key. Intun Before Intune can assume management of encryption of a user-encrypted device, that device must receive an Intune FileVault policy for disk encryption. - Use either an [endpoint security disk encryption profile](#create-endpoint-security-policy-for-filevault), or a [device configuration endpoint protection profile](#create-device-configuration-policy-for-filevault) to encrypt devices with FileVault. + Use an [endpoint security disk encryption profile](#create-endpoint-security-policy-for-filevault), to encrypt devices with FileVault. - **The user who encrypted the device must have access to their personal recovery key for the device and be directed to upload it to Intune.** @@ -271,7 +272,7 @@ To enable Intune to manage FileVault on a previously encrypted device, the user Before Intune can assume management of encryption of a user-encrypted device, that device must receive an Intune FileVault policy for disk encryption. - Use either an [endpoint security disk encryption profile](#create-endpoint-security-policy-for-filevault), or a [device configuration endpoint protection profile](#create-device-configuration-policy-for-filevault) to encrypt devices with FileVault. + Use an [endpoint security disk encryption profile](#create-endpoint-security-policy-for-filevault) to encrypt devices with FileVault. - **The device user must have access to the Terminal app on the encrypted device.** diff --git a/memdocs/intune/protect/endpoint-protection-macos.md b/memdocs/intune/protect/endpoint-protection-macos.md index 6363abf7bfc..3f6f0889110 100644 --- a/memdocs/intune/protect/endpoint-protection-macos.md +++ b/memdocs/intune/protect/endpoint-protection-macos.md @@ -7,7 +7,7 @@ keywords: author: lenewsad ms.author: lanewsad manager: dougeby -ms.date: 08/15/2022 +ms.date: 10/25/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: protect @@ -32,7 +32,9 @@ ms.collection: # macOS endpoint protection settings in Intune > [!IMPORTANT] -> The macOS endpoint protection template has been deprecated. Existing policies remain unchanged, but you can no longer create new policies using this template. We recommend using the settings catalog to create new configuration policies for FileVault, Firewall, and System Policy Control (Gatekeeper) payloads. For more information, see [macOS settings catalog](../configuration/settings-catalog.md). +> The macOS endpoint protection template has been deprecated. Existing policies remain unchanged, but you can no longer create new policies using this template. > Instead, use one of the following options: +> - Use Endpoint security policies like [disk encryption](../protect/endpoint-security-disk-encryption-policy.md) for Filevault, or [Firewall](../protect/endpoint-security-firewall-policy.md) policy. +> - Use the Settings catalog to create new configuration policies for FileVault, Firewall, and System Policy Control (Gatekeeper) payloads. For more information, see [macOS settings catalog](../configuration/settings-catalog.md). This article shows you the endpoint protection settings that you can configure for devices that run macOS. You configure these settings by using a macOS device configuration profile for [endpoint protection](endpoint-protection-configure.md) in Intune. diff --git a/memdocs/intune/protect/mde-security-integration.md b/memdocs/intune/protect/mde-security-integration.md index a2a6bf9e890..0a8576fb1ae 100644 --- a/memdocs/intune/protect/mde-security-integration.md +++ b/memdocs/intune/protect/mde-security-integration.md @@ -7,7 +7,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 09/30/2024 +ms.date: 10/30/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -68,19 +68,19 @@ When a supported device onboards to Microsoft Defender for Endpoint: - For devices that aren't fully Microsoft Entra registered, a synthetic device identity is created in Microsoft Entra ID that allows the device to retrieve policies. Fully registered devices use their current registration. - Policies retrieved from Microsoft Intune are enforced on the device by Microsoft Defender for Endpoint. -Security settings management isn't yet supported with Government clouds. For more information, see [Feature parity with commercial](/microsoft-365/security/defender-endpoint/gov#feature-parity-with-commercial) in *Microsoft Defender for Endpoint for US Government customers*. - ### Government cloud support -As a public preview, the Defender for Endpoint security settings management scenario is supported in the following tenants: +The Defender for Endpoint security settings management scenario is supported in the following government tenants: -- US Government Community (GCC) High +- US Government Community Cloud (GCC) +- US Government Community High (GCC High) - Department of Defense (DoD) For more information, see: - [Intune US Government service description](../fundamentals/intune-govt-service-description.md) - [Microsoft Defender for Endpoint for US Government customers](/microsoft-365/security/defender-endpoint/gov) +- [Feature parity with commercial](/microsoft-365/security/defender-endpoint/gov#feature-parity-with-commercial) in *Microsoft Defender for Endpoint for US Government customers*. ### Connectivity requirements diff --git a/memdocs/intune/protect/media/encrypt-devices-filevault/select-macos-filevault-dc.png b/memdocs/intune/protect/media/encrypt-devices-filevault/select-macos-filevault-dc.png index 508706d6685..5ed1319e5ad 100644 Binary files a/memdocs/intune/protect/media/encrypt-devices-filevault/select-macos-filevault-dc.png and b/memdocs/intune/protect/media/encrypt-devices-filevault/select-macos-filevault-dc.png differ diff --git a/memdocs/intune/protect/microsoft-tunnel-conditional-access.md b/memdocs/intune/protect/microsoft-tunnel-conditional-access.md index 419931c07f8..1b95225dfd6 100644 --- a/memdocs/intune/protect/microsoft-tunnel-conditional-access.md +++ b/memdocs/intune/protect/microsoft-tunnel-conditional-access.md @@ -39,7 +39,7 @@ Before you can configure Conditional Access policies for the tunnel, you must en 2. Download the PowerShell script named **mst-ca-provisioning.ps1** from aka.ms/mst-ca-provisioning. -3. Using credentials that have the Azure Role permissions [equivalent to **Global Administrator**](/azure/active-directory/roles/permissions-reference#global-administrator), run the script from any location in your environment, to provision your tenant. +3. Using credentials that have the Azure Role permissions [equivalent to **Intune Administrator**](/azure/active-directory/roles/permissions-reference#global-administrator), run the script from any location in your environment, to provision your tenant. The script modifies your tenant by creating a service principal with the following details: diff --git a/memdocs/intune/protect/microsoft-tunnel-configure.md b/memdocs/intune/protect/microsoft-tunnel-configure.md index 4b03dd64f99..4b1fe3e74dc 100644 --- a/memdocs/intune/protect/microsoft-tunnel-configure.md +++ b/memdocs/intune/protect/microsoft-tunnel-configure.md @@ -5,7 +5,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 09/26/2024 +ms.date: 10/31/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -191,7 +191,7 @@ However, if you plan to install the Microsoft Tunnel Gateway to a rootless Podma Alternatively, create a link to the private key file in **/etc/mstunnel/private/site.key**. For example: `ln -s [full path to key file] /etc/mstunnel/private/site.key` This key shouldn't be encrypted with a password. The private key file name must be **site.key**. -6. After setup installs the certificate and creates the Tunnel Gateway services, you're prompted to sign in and authenticate with Intune. The user account must have either the Intune Administrator or Global Administrator roles assigned. The account you use to complete the authentication must have an Intune license. The credentials of this account aren't saved and are only used for initial sign-in to Microsoft Entra ID. After successful authentication, Azure app IDs/secret keys are used for authentication between the Tunnel Gateway and Microsoft Entra. +6. After setup installs the certificate and creates the Tunnel Gateway services, you're prompted to sign in and authenticate with Intune. The user account must be assigned permissions equivalent to the Intune Administrator. The account you use to complete the authentication must have an Intune license. The credentials of this account aren't saved and are only used for initial sign-in to Microsoft Entra ID. After successful authentication, Azure app IDs/secret keys are used for authentication between the Tunnel Gateway and Microsoft Entra. This authentication registers Tunnel Gateway with Microsoft Intune and your Intune tenant. diff --git a/memdocs/intune/protect/microsoft-tunnel-prerequisites.md b/memdocs/intune/protect/microsoft-tunnel-prerequisites.md index 78756e9d0bd..31dbf62708b 100644 --- a/memdocs/intune/protect/microsoft-tunnel-prerequisites.md +++ b/memdocs/intune/protect/microsoft-tunnel-prerequisites.md @@ -5,7 +5,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 09/06/2024 +ms.date: 10/24/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -34,6 +34,8 @@ At a high level, the Microsoft Tunnel requires: - An Azure subscription. - A *Microsoft Intune Plan 1* subscription. + > [!NOTE] + > This prerequisite is for *Microsoft Tunnel*, and does not include [Microsoft Tunnel for Mobile Application Management](../protect/microsoft-tunnel-mam.md), which is an [Intune add-on](../fundamentals/intune-add-ons.md) that requires a *Microsoft Intune Plan 2* subscription. - A Linux server that runs containers. The server can be on-premises or in the cloud, and supports one of the following container types: - **Podman** for Red Hat Enterprise Linux (RHEL). See the [Linux server](#linux-server) requirements. - **Docker** for all other Linux distributions. @@ -48,7 +50,6 @@ The following sections detail the prerequisites for the Microsoft Tunnel, and pr > [!NOTE] > Tunnel and Global Secure Access (GSA) cannot be use simultaneously on the same device. - ## Linux server Set up a Linux based virtual machine or a physical server on which to install the Microsoft Tunnel Gateway. @@ -111,7 +112,7 @@ Set up a Linux based virtual machine or a physical server on which to install th - [Install Podman on Red Hat Enterprise Linux 8.4 and later (scroll down to RHEL8)](https://podman.io/get-started). - These versions of RHEL don't support Docker. Instead, these versions use Podman, and *podman* is part of a module called "container-tools". In this context, a module is a set of RPM packages that represent a component and that usually install together. A typical module contains packages with an application, packages with the application-specific dependency libraries, packages with documentation for the application, and packages with helper utilities. For more information, see [Introduction to modules](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/installing_managing_and_removing_user-space_components/introduction-to-modules_using-appstream) in the Red Hat documentation. + These versions of RHEL don't support Docker. Instead, these versions use Podman, and *podman* is part of a module called "container-tools". In this context, a module is a set of RPM packages that represent a component and that usually install together. A typical module contains packages with an application, packages with the application-specific dependency libraries, packages with documentation for the application, and packages with helper utilities. For more information, see [Introduction to modules](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/installing_managing_and_removing_user-space_components/managing-versions-of-appstream-content_using-appstream) in the Red Hat documentation. > [!NOTE] > @@ -134,6 +135,11 @@ Set up a Linux based virtual machine or a physical server on which to install th - The TLS certificate can be in **PEM** or **pfx** format. - To support the *TLS certificate revocation* health check, ensure the Online Certificate Status Protocol (OCSP) or certificate revocation list (CRL) address as defined by the TLS certificate is accessible from the server. + + - Configure the Tunnel clients certificate with a key that is 2048-bits or larger. We recommend larger keys to help your deployment stay in support for future and evolving SSL/TLS requirements by various SSL/TLS library solutions. + + > [!TIP] + > Periodically review the requirements of your chosen SSL/TLS library to ensure your infrastructure and certificates remain supported and in compliance to recent changes for that library, and reissue Tunnel client certificates when necessary to stay current with your solutions evolving requirements. - **TLS version**: By default, connections between Microsoft Tunnel clients and servers use TLS 1.3. When TLS 1.3 isn't available, the connection can fall back to use TLS 1.2. @@ -204,6 +210,24 @@ Podman uses the file **/etc/cni/net.d as 87-podman-bridge.conflist** to configur For more information, see [Configuring container networking with Podman](https://www.redhat.com/sysadmin/container-networking-podman) in the Red Hat documentation. +### Linux system auditing + +Linux system auditing can help identify security-relevant information or security violations on a Linux server that hosts Microsoft Tunnel. Linux system auditing is recommended for Microsoft Tunnel, but not required. To use system auditing, a Linux server must have the **auditd** package installed to `/etc/audit/auditd.conf`. + +Details on how to implement auditing depend on the Linux platform you use: + +- **Red Hat**: Versions of Red Had Enterprise Linux 7 and later install the *auditd* package by default. However, if the package isn't installed, you can use the following command line on the Linux server to install it: `sudo dnf install audit audispd-plugins` + + Typically, the *auditd* package is available from the default repository of each REHL version. + + For more information about using system auditing on RHEL, see [Configure Linux system auditing with auditd](https://www.redhat.com/blog/configure-linux-auditing-auditd) in the Red Hat Blog. + +- **Ubuntu**: To use system auditing with Ubuntu you must manually install the *auditd* package. To do so, use the following command line on the Linux server: `sudo apt install auditd audispd-plugins` + + Typically, the *auditd* package is available from the default repository of each Ubuntu version. + + For more information about using system auditing on Ubuntu, see [How to setup and Install Auditd on Ubuntu](https://dev.to/ajaykdl/how-to-setup-auditd-on-ubuntu-jfk), an article that is available on the dev.to website that was originally published at kubefront.com. + ## Network - **Enable packet forwarding for IPv4**: Each Linux server that hosts the Tunnel server software must have IP forwarding for IPv4 enabled. To check on the status of IP forwarding, on the server run one of the following generic commands as *root* or *sudo*. Both commands return a value of **0** for *disabled* and a value of **1** for *enabled*: diff --git a/memdocs/intune/protect/microsoft-tunnel-upgrade.md b/memdocs/intune/protect/microsoft-tunnel-upgrade.md index 1a1d32e5f3b..a0e1dd50474 100644 --- a/memdocs/intune/protect/microsoft-tunnel-upgrade.md +++ b/memdocs/intune/protect/microsoft-tunnel-upgrade.md @@ -130,6 +130,19 @@ The Microsoft Tunnel version for a server isn’t available in the Intune UI at > Container releases take place in stages. If you notice that your container images are not the most recent, please be assured that they will be updated and delivered within the following week. +### October 2, 2024 + +Image hash values: + +- **agentImageDigest**: sha256:7921c2e97217fa17de4ab69396d943e4975d323417b8b813211e2f8b639f64e1 + +- **serverImageDigest**: sha256:0efab5013351bcd81f186973e75ed5d9f91bbe6271e3be481721500f946fc9ec + +Changes in this release: +-Upgrade from .NET 6 to .NET 8 +- Upgrade ocserv to version 1.3.0 +- Fix rootless container bug in installer + ### September 12, 2024 Image hash values: diff --git a/memdocs/intune/toc.yml b/memdocs/intune/toc.yml index be7ef34645b..6850eb4bfd6 100644 --- a/memdocs/intune/toc.yml +++ b/memdocs/intune/toc.yml @@ -1865,6 +1865,16 @@ items: href: ./industry/education/tutorial-school-deployment/common-config-settings-catalog-start-menu.md - name: OneDrive Known Folder Move href: ./industry/education/tutorial-school-deployment/common-config-settings-catalog-onedrive-knownfoldermove.md + - name: Intune policies for iPads in Education + items: + - name: Device restrictions + href: ./industry/education/tutorial-school-deployment/common-config-ipads-device-restrictions.md + - name: Apple Intelligence + href: ./industry/education/tutorial-school-deployment/common-config-ipads-ai.md + - name: iPads with no user affinity + href: ./industry/education/tutorial-school-deployment/common-config-ipads-nouser.md + - name: Optional restrictions + href: ./industry/education/tutorial-school-deployment/common-config-ipads-optional.md - name: Intune for Education docs href: /intune-education/ diff --git a/windows-365/enterprise/assign-users-as-local-admin.md b/windows-365/enterprise/assign-users-as-local-admin.md index 4ff38b43105..094e4dc8273 100644 --- a/windows-365/enterprise/assign-users-as-local-admin.md +++ b/windows-365/enterprise/assign-users-as-local-admin.md @@ -35,7 +35,7 @@ ms.collection: The **User settings** page lets IT administrators manage the following settings for the user: - **Enable local admin**: If enabled, each user in the assigned groups is elevated to a local administrator of each of their own Cloud PCs. These permissions apply at the user level. -- **Enable users to reset their Cloud PCs**: If enabled, a **Reset** option is shown in the Windows 365 app and portal for users in the assigned groups. Resetting wipes and reprovisions the Cloud PC, deleting all user data and apps. +- **Enable users to reset their Cloud PCs**: If enabled, a **Reset** option is shown in the Windows App and portal for users in the assigned groups. Resetting wipes and reprovisions the Cloud PC, deleting all user data and apps. - **Allow user to initiate restore service**: If enabled, each user in the assigned groups can restore their own Cloud PCs to any available backup version. When managing settings, keep the following points in mind: diff --git a/windows-365/enterprise/azure-network-connections.md b/windows-365/enterprise/azure-network-connections.md index 29ded36f1fa..54e0de3dff1 100644 --- a/windows-365/enterprise/azure-network-connections.md +++ b/windows-365/enterprise/azure-network-connections.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 08/28/2024 +ms.date: 10/30/2024 ms.topic: overview ms.service: windows-365 ms.subservice: windows-365-enterprise @@ -47,8 +47,8 @@ There are two kinds of ANCs based on their join type. Both let you manage traffi When a Cloud PC is provisioned, the information in the ANC is used by the provisioning policy to provision the Cloud PC in the Azure subnet. The information required in an ANC includes: -- **Network details**: The Azure subscription, resource group, virtual network, and subnet that the Cloud PC will be associated with. When a provisioning policy runs, it creates a Cloud PC in the Microsoft hosted Azure subscription. To connect to a customer's on-premises network, a virtual network interface card (vNic) is injected into a customer-provided Azure virtual network (vNet). To create this vNic, Windows 365 needs sufficient access to an Azure subscription. -- **Active Directory domain**: The Active Directory domain to join, an Organizational Unit (OU) destination for the computer object, and Active Directory user credentials with sufficient permissions to perform the domain join. When a provisioning policy runs, the Cloud PC is joined to this Active Directory domain. The credentials will be stored securely in the Windows 365 service. +- **Network details**: The Azure subscription, resource group, virtual network, and subnet to associate with the Cloud PC. When a provisioning policy runs, it creates a Cloud PC in the Microsoft hosted Azure subscription. To connect to a customer's on-premises network, a virtual network interface card (vNic) is injected into a customer-provided Azure virtual network (vNet). To create this vNic, Windows 365 needs sufficient access to an Azure subscription. +- **Active Directory domain**: The Active Directory domain to join, an Organizational Unit (OU) destination for the computer object, and Active Directory user credentials with sufficient permissions to perform the domain join. When a provisioning policy runs, the Cloud PC is joined to this Active Directory domain. The credentials are stored securely in the Windows 365 service. During provisioning, the Cloud PC is connected to the Azure subnet and joined to a domain (either Windows Server Active Directory or Microsoft Entra ID). This process results in a Cloud PC that is: @@ -61,7 +61,7 @@ The ANC settings are applied to the Cloud PC only at the time of provisioning. ### Alternate ANCs -To help make provisioning Cloud PCs more reliable in the rare case of capacity constraints in a region, you have the option to assign alternate ANCs to a provisioning policy. You can define the priority order of the ANCs that the policy will use. If the first ANC is unavailable, the policy will automatically use the second ANC in the priority list. If the second one is unavailable, it will move on to the next, and so on. This lets administrators prepare multiple ANCs in different Azure regions, making provisioning more reliable. You don't have to use multiple ANCs. For more information about using alternate ANCs when creating your provisioning policies, see [Create provisioning policies](create-provisioning-policy.md). +To help make provisioning Cloud PCs more reliable in the rare case of capacity constraints in a region, you can assign alternate ANCs to a provisioning policy. You can define the priority order of the ANCs that the policy uses. If the first ANC is unavailable, the policy automatically uses the second ANC in the priority list. If the second one is unavailable, it moves on to the next, and so on. This process lets administrators prepare multiple ANCs in different Azure regions, making provisioning more reliable. You don't have to use multiple ANCs. For more information about using alternate ANCs when creating your provisioning policies, see [Create provisioning policies](create-provisioning-policy.md). ## First health check @@ -81,7 +81,7 @@ After provisioning, the information in an ANC is also used to monitor: - the connection health between your network-based resources - the Cloud PC hosted in the Microsoft hosted subscription -Windows 365 will report configuration issues that may cause provisioning failures or poor end-user experiences. This monitoring reduces your management overhead. For more information on these periodic checks, see [Azure network connection health checks](health-checks.md). +Windows 365 reports configuration issues that may cause provisioning failures or poor end-user experiences. This monitoring reduces your management overhead. For more information on these periodic checks, see [Azure network connection health checks](health-checks.md). ## Health check frequency @@ -102,13 +102,13 @@ The ANC wizard requires access to Azure and, optionally, on-premises domain reso - [Intune Administrator](/azure/active-directory/roles/permissions-reference#intune-administrator) or [Windows 365 Administrator](/azure/active-directory/roles/permissions-reference) role. - An Active Directory user account with sufficient permissions to join the AD domain into this Organizational Unit (Microsoft Entra hybrid join ANCs only). -To create or edit an ANC, you must at least have the Subscription Reader role in the Azure Subscription where the VNET associated with the ANC was located. +To create or edit an ANC, you must have at least the Subscription Reader role in the Azure Subscription where the VNET associated with the ANC was located. For a full list of requirements, see [Windows 365 requirements](requirements.md). ## Changing an Azure network connection -Changing the settings in an ANC won’t affect Cloud PCs previously provisioned with that ANC. Only Cloud PCs provisioned after the changes to the ANC will reflect such later changes. +Changing the settings in an ANC won’t affect Cloud PCs previously provisioned with that ANC. Only Cloud PCs provisioned after the changes to the ANC reflect such later changes. If you want to change the ANC related settings on a previously provisioned Cloud PC, you must reprovision the Cloud PC. Reprovisioning is a destructive action, so be sure it's an action you really want to take. For more information, see [reprovisioning](provisioning.md#reprovisioning). @@ -125,6 +125,10 @@ After completing either of these operations, you can delete the ANC. Each tenant has a limit of 10 Azure network connections. If your organization needs more than 10 Azure network connections, contact support. +## Inactive ANCs + +ANCs that are unused for a period of time become inactive. Inactive ANCs pause running health checks and can't be assigned to a provisioning policy until the ANC is reactivated and health checks complete successfully. + ## User sign-in When users attempt to sign in to their Cloud PC, user authentication occurs. diff --git a/windows-365/enterprise/create-azure-network-connection.md b/windows-365/enterprise/create-azure-network-connection.md index 148daf8c7ba..fdc0e74ec34 100644 --- a/windows-365/enterprise/create-azure-network-connection.md +++ b/windows-365/enterprise/create-azure-network-connection.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 04/01/2024 +ms.date: 10/30/2024 ms.topic: how-to ms.service: windows-365 ms.subservice: windows-365-enterprise @@ -68,7 +68,7 @@ When planning your ANC VNets with ExpressRoute as the on-premises connectivity m ![Screenshot of Name field](./media/create-azure-network-connection/connection-name.png) -4. Select a **Subscription** and **Resource group** for the new connection. Create a new resource group to contain your Cloud PC resources. Optionally, you can instead select an existing resource group in the list (which grant Windows 365 permissions to the existing resource group). If you don’t have a [healthy ANC](health-checks.md), you won't be able to proceed. +4. Select a **Subscription** and **Resource group** for the new connection. Create a new resource group to contain your Cloud PC resources. Optionally, you can instead select an existing resource group in the list (which grant Windows 365 permissions to the existing resource group). If you don’t have a [healthy ANC](health-checks.md), you can't proceed. 5. Select a **Virtual network** and **Subnet**. 6. Select **Next**. 7. For hybrid Microsoft Entra join ANCs, on the **AD domain** page, provide the following information: @@ -88,6 +88,8 @@ When planning your ANC VNets with ExpressRoute as the on-premises connectivity m 8. Select **Next**. 9. On the **Review + Create** page, select **Create**. +When an ANC is in use, it can't be deleted and certain configuration settings can't be edited. For more information, see [Edit Azure network connection](edit-azure-network-connection.md) and [Delete Azure network connection](delete-azure-network-connection.md). + ## Next steps diff --git a/windows-365/enterprise/delete-azure-network-connection.md b/windows-365/enterprise/delete-azure-network-connection.md index c0c171bbbd8..6bb0972bec7 100644 --- a/windows-365/enterprise/delete-azure-network-connection.md +++ b/windows-365/enterprise/delete-azure-network-connection.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 07/25/2024 +ms.date: 10/30/2024 ms.topic: how-to ms.service: windows-365 ms.subservice: windows-365-enterprise @@ -31,18 +31,29 @@ ms.collection: # Delete Azure network connection -Only an unassigned Azure network connection (ANC) can be deleted. If an ANC is in use by a provisioning policy, then you must take one of the following steps: +Only an unused Azure network connection (ANC) can be deleted. -- Remove the ANC from all provisioning policies. -- Delete the ANC. - -To delete an Azure network connection: +To delete an unused ANC: 1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) > **Devices** > **Windows 365** (under **Provisioning**) > **Azure network connection**. You must have [Intune Administrator](/azure/active-directory/roles/permissions-reference#intune-administrator) or [Windows 365 Administrator](/azure/active-directory/roles/permissions-reference) permissions. ![Screenshot of delete connection](./media/delete-azure-network-connection/delete-connection.png) 2. Select the ellipses (**…**) next to the connection you want to delete > **Delete**. 3. Select **Confirm** when asked to delete the connection. +## In use ANCs + +ANCs that are in use can't be deleted. In use ANCs include ANCs that are: + +- Referenced by a provisioning policy, including as an alternate ANC. +- Used by a Cloud PC. +- Configured as backup ANCs for [cross region disaster recovery](cross-region-disaster-recovery.md). + +If an ANC is in use, then you must take one of the following steps before you can delete it: + +- Remove the ANC from all provisioning policies. +- Move Cloud PCs to another ANC or deprovision the Cloud PCs. +- Remove the ANC from all cross region disaster recovery user settings. + ## Next steps diff --git a/windows-365/enterprise/edit-azure-network-connection.md b/windows-365/enterprise/edit-azure-network-connection.md index 6d82413976b..9df54919f76 100644 --- a/windows-365/enterprise/edit-azure-network-connection.md +++ b/windows-365/enterprise/edit-azure-network-connection.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 07/25/2024 +ms.date: 10/30/2024 ms.topic: how-to ms.service: windows-365 ms.subservice: windows-365-enterprise @@ -44,10 +44,16 @@ To edit an Azure network connection: 1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) > **Devices** > **Windows 365** (under **Provisioning**) > **Azure network connection** > select the connection you want to edit > **Properties**. 2. For all ANCs, you can edit the **General** settings by selecting **Edit** next to each header. You can edit all settings except **Join type**. For Microsoft Entra hybrid join connections, you can also edit the **AD domain** settings. -After the edits have been saved, the ANC checks are run to verify the configuration. +After the edits are saved, the ANC checks are run to verify the configuration. You can't edit an ANC if it's running checks. You must wait for the checks to pass/fail before edit functionality becomes available. +Some configuration settings can't be edited for ANCs that are: + +- Referenced by a provisioning policy, including as an alternate ANC. +- Used by a Cloud PC. +- Configured as backup ANCs for [cross region disaster recovery](cross-region-disaster-recovery.md). + ## Next steps diff --git a/windows-365/enterprise/health-checks.md b/windows-365/enterprise/health-checks.md index 2f762ce4be8..18591c09fab 100644 --- a/windows-365/enterprise/health-checks.md +++ b/windows-365/enterprise/health-checks.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 08/28/2024 +ms.date: 10/30/2024 ms.topic: how-to ms.service: windows-365 ms.subservice: windows-365-enterprise @@ -44,12 +44,13 @@ Statuses include: - **Running checks**: The health checks are currently running. The ANC list view automatically refreshes every five minutes. Wait for the checks to complete before attempting to assign it to a provisioning policy. - **Checks successful**: All health checks passed. The ANC is ready for use. -- **Checks successful with warnings**: All critical health checks passed. However at least one non-critical check may have issues. An example of a check that may trigger this state is the Microsoft Entra hybrid join sync check. Microsoft Entra hybrid join sync can take up to 90 minutes, so we check much of the Microsoft Entra hybrid join sync service but can’t confirm the device sync succeeded until later. ANCs with this status can be used by provisioning policies. -- **Checks failed**: One or more required checks failed. An ANC can’t be used if it's in a failed state. You’ll have to resolve the underlying issue and Retry the health checks. +- **Checks successful with warnings**: All critical health checks passed. However at least one noncritical check may have issues. An example of a check that may trigger this state is the Microsoft Entra hybrid join sync check. Microsoft Entra hybrid join sync can take up to 90 minutes. Therefore, we check much of the Microsoft Entra hybrid join sync service but can’t confirm that the device sync succeeded until later. Provisioning policies can use ANCs with this status. +- **Checks failed**: One or more required checks failed. An ANC can’t be used if it's in a failed state. Resolve the underlying issue and Retry the health checks. +- **Inactive**: The ANC is inactive and health checks are paused. Reactivate the ANC to restart the health checks. After the health checks are passed, the ANC is ready for use. ## Status error details -Every failed ANC or success with warning error state includes the technical details behind the failure. Select the **View details** link for each failed check to view more information on the failure. After you’ve fixed the underlying issue, **Retry** the health check to rerun the tests. To retry the health check, you must: +Every failed ANC or success with warning error state includes the technical details behind the failure. Select the **View details** link for each failed check to view more information on the failure. After you fix the underlying issue, **Retry** the health check to rerun the tests. To retry the health check, you must: - Have the [Intune Administrator](/azure/active-directory/roles/permissions-reference#intune-administrator) or [Windows 365 Administrator](/azure/active-directory/roles/permissions-reference) role. diff --git a/windows-365/enterprise/in-development.md b/windows-365/enterprise/in-development.md index 4b4111565ca..9e764f6baff 100644 --- a/windows-365/enterprise/in-development.md +++ b/windows-365/enterprise/in-development.md @@ -64,20 +64,6 @@ In a future update, Windows 365 Cloud PC gallery images with Microsoft 365 appli - Windows 10 Enterprise + Microsoft 365 Apps 22H2 - Windows 10 Enterprise + Microsoft 365 Apps 21H2 -### Azure network connections inactive state - -In a future update, Azure network connections that meet either of the following conditions for more than four weeks will be marked as inactive: - -- ANCs that aren't associated with provisioning policies. -- ANCs with provisioning policies that have no Cloud PCs associate with them. - -Inactive ANCs: - -- Can't be assigned to provisioning policies. -- Are skipped during health checks. - -You'll be able to reactive such ANCs. - @@ -95,10 +81,6 @@ You'll be able to reactive such ANCs. End users will be able to manually run connectivity checks on their Cloud PCs from [windows365.microsoft.com](https://windows365.microsoft.com). -### Update to Cloud PC action status report - -The Cloud PC action status report will show batches of devices in which actions have been triggered. Customers will be able to see the batch current progress. - ### Remoting connections report deprecation The remoting connection report will be retired on December 31st, 2024. After this date, refer to the [Cloud PC connection quality report](report-cloud-pc-connection-quality.md). @@ -115,7 +97,6 @@ The remoting connection report will be retired on December 31st, 2024. After thi - ## Next steps For details about recent developments, see [What's new in Windows 365](whats-new.md). diff --git a/windows-365/enterprise/introduction-windows-365-government.md b/windows-365/enterprise/introduction-windows-365-government.md index e0ddc1624cb..4a17755c7dc 100644 --- a/windows-365/enterprise/introduction-windows-365-government.md +++ b/windows-365/enterprise/introduction-windows-365-government.md @@ -45,7 +45,7 @@ For more information about Cloud PCs and Windows 365, see [What is Windows 365?] ## Features not yet supported Windows 365 Government -The following features aren't yet supported for Windows 365 GCC or GCC High. +The following features aren't yet supported for Windows 365 GCC or GCC High. - Unified dashboard - Windows 365 Security baseline @@ -68,6 +68,7 @@ The following features aren't yet supported for Windows 365 GCC or GCC High. - [Support for Omnissa Horizon clients and the Blast protocol](set-up-omnissa-horizon.md) - [Microsoft Purview Customer Key](purview-customer-key.md) - [HP Anyware for Windows 365](hp-anyware-set-up.md) +- Bulk Troubleshoot action ## Next steps diff --git a/windows-365/enterprise/partner-integration-scenarios.md b/windows-365/enterprise/partner-integration-scenarios.md index 04c8f71bcb3..a37893f4727 100644 --- a/windows-365/enterprise/partner-integration-scenarios.md +++ b/windows-365/enterprise/partner-integration-scenarios.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 10/09/2024 +ms.date: 10/23/2024 ms.topic: overview ms.service: windows-365 ms.subservice: windows-365-enterprise @@ -33,11 +33,11 @@ ms.collection: The following partner integration scenarios support partner protocols on top of Windows 365, without compromising the simplicity and predictability that Windows 365 delivers. -| Partner | Supported clients | Gateway service | Connection protocol | -| --- | --- | --- | --- | -| Citrix | Citrix Workspace web client
Citrix Workspace desktop clients for supported platforms | Citrix Cloud Gateway Service | Citrix HDX | -| HP | HP Anyware web client
HP Anyware desktop clients for supported platforms | HP Anyware Cloud Gateway Service | HP Anyware | -| Omnissa | Omnissa Workspace ONE web client
Omnissa ONE desktop clients for supported platforms | Omnissa Cloud Gateway Service | Omnissa Blast | +| Partner | Supported clients | Gateway service | Connection protocol | Supported service plans | +| --- | --- | --- | --- | --- | +| Citrix | Citrix Workspace web client
Citrix Workspace desktop clients for supported platforms | Citrix Cloud Gateway Service | Citrix HDX | Enterprise, Frontline +| HP | HP Anyware web client
HP Anyware desktop clients for supported platforms | HP Anyware Cloud Gateway Service | HP Anyware | Enterprise | +| Omnissa | Omnissa Workspace ONE web client
Omnissa ONE desktop clients for supported platforms | Omnissa Cloud Gateway Service | Omnissa Blast | Enterprise | While scenarios not listed here might still work in customers’ production environment, they aren't supported by Microsoft. diff --git a/windows-365/enterprise/report-cloud-pc-actions.md b/windows-365/enterprise/report-cloud-pc-actions.md index d968c398635..8f2dcd3cb12 100644 --- a/windows-365/enterprise/report-cloud-pc-actions.md +++ b/windows-365/enterprise/report-cloud-pc-actions.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 12/6/2023 +ms.date: 10/30/2024 ms.topic: overview ms.service: windows-365 ms.subservice: windows-365-enterprise @@ -31,7 +31,12 @@ ms.collection: # Cloud PC actions report (preview) -This report shows you what actions admins have taken on which Cloud PCs, and the status of those actions. +This report shows you the status and completion progress of actions admins have taken on Cloud PCs, for both: + +- Single actions on the **Devices** tab. +- Multiple devices using **Bulk device actions** on the **Bulk batches** tab. + + The report shows action statuses for the last 90 days. The Cloud PC actions report is in [public preview](..\public-preview.md). @@ -39,11 +44,11 @@ The Cloud PC actions report is in [public preview](..\public-preview.md). To get to the **Cloud PC actions** report, sign in to [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Devices** > **Monitor** > **Cloud PC actions (preview)**. -## Report data +## Devices tab :::image type="content" source="./media/report-cloud-pc-actions/report.png" alt-text="Screenshot of the Cloud PC actions report." lightbox="./media/report-cloud-pc-actions/report.png"::: -The report shows the following columns: +The tab shows the following columns: - **Device name** - **Primary user UPN** @@ -64,6 +69,17 @@ The report shows the following columns: - **Review required**: An admin must take action to complete the action. For example, assigning a target license to a device in **Resize Pending License** state for the **Resize** action. - **Date initiated** +## Bulk batches tab + +When an admin takes an action on multiple Cloud PCs at once using **Bulk device actions**, the actions are combined into a batch. + +The tab shows the following columns: + +- **Batch name** - An automatically generated name for a batch of devices undergoing a remote action. +- **Action** - Same as **Devices** tab. +- **Completion** - The progress of the action on the batch of devices. +- **Date initiated** + ## Next steps diff --git a/windows-365/enterprise/report-cloud-pc-recommendations.md b/windows-365/enterprise/report-cloud-pc-recommendations.md index b790a3ed7da..d58276759b9 100644 --- a/windows-365/enterprise/report-cloud-pc-recommendations.md +++ b/windows-365/enterprise/report-cloud-pc-recommendations.md @@ -42,11 +42,9 @@ An evolving model analyzes this data to determine whether Cloud PCs are: - Under-used. - Sized appropriately. -The Cloud PC recommendations report is in [public preview](..\public-preview.md). - ## Use the Cloud PC recommendations report -To get to the **Cloud PC recommendations** report, sign in to [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Reports** > **Cloud PC Overview** > **Cloud PC recommendations (preview)**. +To get to the **Cloud PC recommendations** report, sign in to [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Reports** > **Cloud PC Overview** > **Cloud PC recommendations**. ![Screenshot of Cloud PC recommendation report.](media/report-cloud-pc-recommendations/report-cloud-pc-recommendations.png) diff --git a/windows-365/enterprise/requirements.md b/windows-365/enterprise/requirements.md index 7563cd8e369..aedc7dd898a 100644 --- a/windows-365/enterprise/requirements.md +++ b/windows-365/enterprise/requirements.md @@ -63,7 +63,7 @@ A subscription in Azure Government is required for Windows 365 Government custom ## Microsoft Entra ID and Intune requirements - A valid and working Intune and Microsoft Entra tenant. -- Intune device type enrollment restrictions set to Allow Windows (MDM) platform for corporate enrollment. +- Intune default device type enrollment restrictions must be set to Allow Windows (MDM) platform for corporate enrollment. For more information, see [Device Enrollment Restrictions Limitations](/mem/intune/enrollment/enrollment-restrictions-set#limitations). - Infrastructure configuration: If you plan on provisioning Microsoft Entra hybrid joined Cloud PCs, you must configure your infrastructure to automatically Microsoft Entra hybrid join any devices that domain join to the on-premises Active Directory. This [configuration lets them be recognized and managed in the cloud](/azure/active-directory/devices/overview). - Microsoft Entra Domain Services isn't supported because it doesn't support Microsoft Entra hybrid join. diff --git a/windows-365/enterprise/troubleshoot-windows-365-boot.md b/windows-365/enterprise/troubleshoot-windows-365-boot.md index a78fd5ff600..48e7ac9b159 100644 --- a/windows-365/enterprise/troubleshoot-windows-365-boot.md +++ b/windows-365/enterprise/troubleshoot-windows-365-boot.md @@ -70,7 +70,7 @@ Get-AppxPackage –AllUsers -name *MicrosoftCorporationII* This command shows all the Microsoft-maintained apps (like QuickAssist, Microsoft Family, and so on) on the physical device. In order for Windows 365 Boot to work correctly, confirm the following versions: -- Windows 365 app version 1.1.162.0 or later. +- Windows App version 1.1.162.0 or later. - Azure Virtual Desktop (HostApp) app version 1.2.4159. or later. Windows 365 Boot also requires the latest version of Windows 11. diff --git a/windows-365/enterprise/whats-new.md b/windows-365/enterprise/whats-new.md index 6501698b24d..00bb7ba8121 100644 --- a/windows-365/enterprise/whats-new.md +++ b/windows-365/enterprise/whats-new.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 10/15/2024 +ms.date: 10/31/2024 ms.topic: conceptual ms.service: windows-365 ms.subservice: windows-365-enterprise @@ -55,6 +55,47 @@ For more information about public preview items, see [Public preview in Windows ### Windows 365 app --> + +## Week of October 28, 2024 (Service release 2410) + + +### Device management + +#### Bulk Troubleshoot action now generally available + +The Troubleshoot action in bulk has moved out of preview and into general availability. + +For more information, see [Remotely manage Windows 365 devices](remotely-manage-cloud-pc.md). + +#### Microsoft Remote Desktop iOS client now supports Yubikey smart card redirection + +The Microsoft Remote Desktop iOS client now supports smart card redirection for YubiKeys using USB-C or Lightning connector. This enables in-session smart card usage. + + +### Monitor and troubleshoot + +### Update to Cloud PC action status report + +The Cloud PC action status report now shows batches of devices on which actions were triggered. You can see the batch current progress. For more information, see [Cloud PC actions report ](report-cloud-pc-actions.md). + +### Azure network connections inactive state + +Azure network connections that meet either of the following conditions for more than four weeks are now marked as inactive: + +- ANCs that aren't associated with provisioning policies. +- ANCs with provisioning policies that have no Cloud PCs associate with them. + +#### Cloud PC connection quality report now available for Windows 365 Government + +The Cloud PC connection quality report is now available for Windows 365 Government, both Government Community Cloud (GCC) and GCC-High. For more information, see [Cloud PC connection quality report](report-cloud-pc-connection-quality.md). + + +## Week of October 21, 2024 + +#### Windows 365 support for AVC mixed mode when MMR isn't enabled (preview) + +AVC Mixed Mode is now available in the default graphics profile. When MMR isn't enabled, AVC/h.264 is used to encode detected image content instead of the RemoteFX image encoder. This improves performance when encoding images relative to bitrate and framerate in network-constrained scenarios. + ## Week of October 14, 2024 @@ -65,8 +106,6 @@ For more information about public preview items, see [Public preview in Windows Core TCP-based RDP traffic for Cloud PC connections uses the *.wvd.microsoft.com wildcard fully qualified domain name (FQDN). The FQDN remains unchanged, but the underlying IP addresses associated with it will shortly be changed to a single subnet. This will simplify optimization of this traffic and reduce the need for future change management. -For more information, see [Plan for change: New Windows 365 IP Subnet for RDP Connectivity](https://iridias.microsoft.com/messagecenter?id=894574) Message Center post. - ### Device management