--- title: What's new in MDM enrollment and management description: This topic provides information about what's new and breaking changes in Windows 10 mobile device management (MDM) enrollment and management experience across all Windows 10 devices. MS-HAID: - 'p\_phdevicemgmt.mdm\_enrollment\_and\_management\_overview' - 'p\_phDeviceMgmt.new\_in\_windows\_mdm\_enrollment\_management' ms.assetid: 9C42064F-091C-4901-BC73-9ABE79EE4224 ms.reviewer: manager: dansimp ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman ms.localizationpriority: medium ms.date: 07/01/2019 --- # What's new in mobile device enrollment and management This topic provides information about what's new and breaking changes in Windows 10 mobile device management (MDM) enrollment and management experience across all Windows 10 devices. For details about Microsoft mobile device management protocols for Windows 10 see [\[MS-MDM\]: Mobile Device Management Protocol](https://go.microsoft.com/fwlink/p/?LinkId=619346) and [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( http://go.microsoft.com/fwlink/p/?LinkId=619347). - **What’s new in MDM for Windows 10 versions** - [What’s new in MDM for Windows 10, version 1909](#whats-new-in-mdm-for-windows-10-version-1909) - [What’s new in MDM for Windows 10, version 1903](#whats-new-in-mdm-for-windows-10-version-1903) - [What’s new in MDM for Windows 10, version 1809](#whats-new-in-mdm-for-windows-10-version-1809) - [What’s new in MDM for Windows 10, version 1803](#whats-new-in-mdm-for-windows-10-version-1803) - [What’s new in MDM for Windows 10, version 1709](#whats-new-in-mdm-for-windows-10-version-1709) - [What’s new in MDM for Windows 10, version 1703](#whats-new-in-mdm-for-windows-10-version-1703) - [What’s new in MDM for Windows 10, version 1607](#whats-new-in-mdm-for-windows-10-version-1607) - [What’s new in MDM for Windows 10, version 1511](#whats-new-in-mdm-for-windows-10-version-1511) - **Breaking changes and known issues** - [Get command inside an atomic command is not supported](#get-command-inside-an-atomic-command-is-not-supported) - [Notification channel URI not preserved during upgrade from Windows 8.1 to Windows 10](#notification-channel-uri-not-preserved-during-upgrade-from-windows-81-to-windows-10) - [Apps installed using WMI classes are not removed](#apps-installed-using-wmi-classes-are-not-removed) - [Passing CDATA in SyncML does not work](#passing-cdata-in-syncml-does-not-work) - [SSL settings in IIS server for SCEP must be set to "Ignore"](#ssl-settings-in-iis-server-for-scep-must-be-set-to-ignore) - [MDM enrollment fails on the mobile device when traffic is going through proxy](#mdm-enrollment-fails-on-the-mobile-device-when-traffic-is-going-through-proxy) - [Server-initiated unenrollment failure](#server-initiated-unenrollment-failure) - [Certificates causing issues with Wi-Fi and VPN](#certificates-causing-issues-with-wi-fi-and-vpn) - [Version information for mobile devices](#version-information-for-mobile-devices) - [Upgrading Windows Phone 8.1 devices with app whitelisting using ApplicationRestriction policy has issues](#upgrading-windows-phone-81-devices-with-app-whitelisting-using-applicationrestriction-policy-has-issues) - [Apps dependent on Microsoft Frameworks may get blocked in phones prior to build 10586.218](#apps-dependent-on-microsoft-frameworks-may-get-blocked-in-phones-prior-to-build-10586218) - [Multiple certificates might cause Wi-Fi connection instabilities in Windows 10 Mobile](#multiple-certificates-might-cause-wi-fi-connection-instabilities-in-windows-10-mobile) - [Remote PIN reset not supported in Azure Active Directory joined mobile devices](#remote-pin-reset-not-supported-in-azure-active-directory-joined-mobile-devices) - [MDM client will immediately check-in with the MDM server after client renews WNS channel URI](#mdm-client-will-immediately-check-in-with-the-mdm-server-after-client-renews-wns-channel-uri) - [User provisioning failure in Azure Active Directory joined Windows 10 PC](#user-provisioning-failure-in-azure-active-directory-joined-windows-10-pc) - [Requirements to note for VPN certificates also used for Kerberos Authentication](#requirements-to-note-for-vpn-certificates-also-used-for-kerberos-authentication) - [Device management agent for the push-button reset is not working](#device-management-agent-for-the-push-button-reset-is-not-working) - **Frequently Asked Questions** - [Can there be more than 1 MDM server to enroll and manage devices in Windows 10?](#can-there-be-more-than-1-mdm-server-to-enroll-and-manage-devices-in-windows-10) - [How do I set the maximum number of Azure Active Directory joined devices per user?](#how-do-i-set-the-maximum-number-of-azure-active-directory-joined-devices-per-user) - [What is dmwappushsvc?](#what-is-dmwappushsvc) - **Change history in MDM documentation** - [October 2019](#october-2019) - [September 2019](#september-2019) - [August 2019](#august-2019) - [July 2019](#july-2019) - [June 2019](#june-2019) - [May 2019](#may-2019) - [April 2019](#april-2019) - [March 2019](#march-2019) - [February 2019](#february-2019) - [January 2019](#january-2019) - [December 2018](#december-2018) - [September 2018](#september-2018) - [August 2018](#august-2018) - [July 2018](#july-2018) - [June 2018](#june-2018) - [May 2018](#may-2018) - [April 2018](#april-2018) - [March 2018](#march-2018) - [February 2018](#february-2018) - [January 2018](#january-2018) - [December 2017](#december-2017) - [November 2017](#november-2017) - [October 2017](#october-2017) - [September 2017](#september-2017) - [August 2017](#august-2017) ## What’s new in MDM for Windows 10, version 1909
New or updated topic Description
BitLocker CSP
Added the following new nodes in Windows 10, version 1909:

ConfigureRecoveryPasswordRotation, RotateRecoveryPasswords, RotateRecoveryPasswordsStatus, RotateRecoveryPasswordsRequestID.
## What’s new in MDM for Windows 10, version 1903
New or updated topic Description
Policy CSP

Added the following new policies in Windows 10, version 1903:

Policy CSP - Audit

Added new Audit policies in Windows 10, version 1903.

ApplicationControl CSP

Added new CSP in Windows 10, version 1903.

DiagnosticLog CSP
DiagnosticLog DDF

Added version 1.4 of the CSP in Windows 10, version 1903. Added the new 1.4 version of the DDF. Added the following new nodes:
Policy, Policy/Channels, Policy/Channels/ChannelName, Policy/Channels/ChannelName/MaximumFileSize, Policy/Channels/ChannelName/SDDL, Policy/Channels/ChannelName/ActionWhenFull, Policy/Channels/ChannelName/Enabled, DiagnosticArchive, DiagnosticArchive/ArchiveDefinition, DiagnosticArchive/ArchiveResults.

EnrollmentStatusTracking CSP

Added new CSP in Windows 10, version 1903.

PassportForWork CSP

Added the following new nodes in Windows 10, version 1903:
SecurityKey, SecurityKey/UseSecurityKeyForSignin
## What’s new in MDM for Windows 10, version 1809
New or updated topic Description
Policy CSP

Added the following new policies in Windows 10, version 1809:

  • ApplicationManagement/LaunchAppAfterLogOn
  • ApplicationManagement/ScheduleForceRestartForUpdateFailures
  • Authentication/EnableFastFirstSignIn (Preview mode only)
  • Authentication/EnableWebSignIn (Preview mode only)
  • Authentication/PreferredAadTenantDomainName
  • Browser/AllowFullScreenMode
  • Browser/AllowPrelaunch
  • Browser/AllowPrinting
  • Browser/AllowSavingHistory
  • Browser/AllowSideloadingOfExtensions
  • Browser/AllowTabPreloading
  • Browser/AllowWebContentOnNewTabPage
  • Browser/ConfigureFavoritesBar
  • Browser/ConfigureHomeButton
  • Browser/ConfigureKioskMode
  • Browser/ConfigureKioskResetAfterIdleTimeout
  • Browser/ConfigureOpenMicrosoftEdgeWith
  • Browser/ConfigureTelemetryForMicrosoft365Analytics
  • Browser/PreventCertErrorOverrides
  • Browser/SetHomeButtonURL
  • Browser/SetNewTabPageURL
  • Browser/UnlockHomeButton
  • Defender/CheckForSignaturesBeforeRunningScan
  • Defender/DisableCatchupFullScan
  • Defender/DisableCatchupQuickScan
  • Defender/EnableLowCPUPriority
  • Defender/SignatureUpdateFallbackOrder
  • Defender/SignatureUpdateFileSharesSources
  • DeviceGuard/ConfigureSystemGuardLaunch
  • DeviceInstallation/AllowInstallationOfMatchingDeviceIDs
  • DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses
  • DeviceInstallation/PreventDeviceMetadataFromNetwork
  • DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings
  • DmaGuard/DeviceEnumerationPolicy
  • Experience/AllowClipboardHistory
  • Experience/DoNotSyncBrowserSettings
  • Experience/PreventUsersFromTurningOnBrowserSyncing
  • Kerberos/UPNNameHints
  • Privacy/AllowCrossDeviceClipboard
  • Privacy/DisablePrivacyExperience
  • Privacy/UploadUserActivities
  • Security/RecoveryEnvironmentAuthentication
  • System/AllowDeviceNameInDiagnosticData
  • System/ConfigureMicrosoft365UploadEndpoint
  • System/DisableDeviceDelete
  • System/DisableDiagnosticDataViewer
  • Storage/RemovableDiskDenyWriteAccess
  • TaskManager/AllowEndTask
  • Update/EngagedRestartDeadlineForFeatureUpdates
  • Update/EngagedRestartSnoozeScheduleForFeatureUpdates
  • Update/EngagedRestartTransitionScheduleForFeatureUpdates
  • Update/SetDisablePauseUXAccess
  • Update/SetDisableUXWUAccess
  • WindowsDefenderSecurityCenter/DisableClearTpmButton
  • WindowsDefenderSecurityCenter/DisableTpmFirmwareUpdateWarning
  • WindowsDefenderSecurityCenter/HideWindowsSecurityNotificationAreaControl
  • WindowsLogon/DontDisplayNetworkSelectionUI
PassportForWork CSP

Added new settings in Windows 10, version 1809.

EnterpriseModernAppManagement CSP

Added NonRemovable setting under AppManagement node in Windows 10, version 1809.

Win32CompatibilityAppraiser CSP

Added new configuration service provider in Windows 10, version 1809.

WindowsLicensing CSP

Added S mode settings and SyncML examples in Windows 10, version 1809.

SUPL CSP

Added 3 new certificate nodes in Windows 10, version 1809.

Defender CSP

Added a new node Health/ProductStatus in Windows 10, version 1809.

BitLocker CSP

Added a new node AllowStandardUserEncryption in Windows 10, version 1809. Added support for Windows 10 Pro.

DevDetail CSP

Added a new node SMBIOSSerialNumber in Windows 10, version 1809.

Wifi CSP

Added a new node WifiCost in Windows 10, version 1809.

WindowsDefenderApplicationGuard CSP

Added new settings in Windows 10, version 1809.

RemoteWipe CSP

Added new settings in Windows 10, version 1809.

TenantLockdown CSP

Added new CSP in Windows 10, version 1809.

Office CSP

Added FinalStatus setting in Windows 10, version 1809.
## What’s new in MDM for Windows 10, version 1803
New or updated topic Description
Policy CSP

Added the following new policies for Windows 10, version 1803:

  • ApplicationDefaults/EnableAppUriHandlers
  • ApplicationManagement/MSIAllowUserControlOverInstall
  • ApplicationManagement/MSIAlwaysInstallWithElevatedPrivileges
  • Bluetooth/AllowPromptedProximalConnections
  • Browser/AllowConfigurationUpdateForBooksLibrary
  • Browser/AlwaysEnableBooksLibrary
  • Browser/EnableExtendedBooksTelemetry
  • Browser/UseSharedFolderForBooks
  • Connectivity/AllowPhonePCLinking
  • DeliveryOptimization/DODelayBackgroundDownloadFromHttp
  • DeliveryOptimization/DODelayForegroundDownloadFromHttp
  • DeliveryOptimization/DOGroupIdSource
  • DeliveryOptimization/DOPercentageMaxBackDownloadBandwidth
  • DeliveryOptimization/DOPercentageMaxForeDownloadBandwidth
  • DeliveryOptimization/DORestrictPeerSelectionBy
  • DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth
  • DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth
  • Display/DisablePerProcessDpiForApps
  • Display/EnablePerProcessDpi
  • Display/EnablePerProcessDpiForApps
  • Experience/AllowWindowsSpotlightOnSettings
  • KioskBrowser/BlockedUrlExceptions
  • KioskBrowser/BlockedUrls
  • KioskBrowser/DefaultURL
  • KioskBrowser/EnableEndSessionButton
  • KioskBrowser/EnableHomeButton
  • KioskBrowser/EnableNavigationButtons
  • KioskBrowser/RestartOnIdleTime
  • LanmanWorkstation/EnableInsecureGuestLogons
  • LocalPoliciesSecurityOptions/Devices_AllowUndockWithoutHavingToLogon
  • LocalPoliciesSecurityOptions/Devices_AllowedToFormatAndEjectRemovableMedia
  • LocalPoliciesSecurityOptions/Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters
  • LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly
  • LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways
  • LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptSecureChannelDataWhenPossible
  • LocalPoliciesSecurityOptions/DomainMember_DisableMachineAccountPasswordChanges
  • LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior
  • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees
  • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers
  • LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways
  • LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees
  • LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts
  • LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares
  • LocalPoliciesSecurityOptions/NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares
  • LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM
  • LocalPoliciesSecurityOptions/NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange
  • LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel
  • LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers
  • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication
  • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic
  • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic
  • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers
  • LocalPoliciesSecurityOptions/Shutdown_ClearVirtualMemoryPageFile
  • LocalPoliciesSecurityOptions/SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems
  • LocalPoliciesSecurityOptions/UserAccountControl_DetectApplicationInstallationsAndPromptForElevation
  • LocalPoliciesSecurityOptions/UserAccountControl_UseAdminApprovalMode
  • Notifications/DisallowCloudNotification
  • RestrictedGroups/ConfigureGroupMembership
  • Search/AllowCortanaInAAD
  • Search/DoNotUseWebResults
  • Security/ConfigureWindowsPasswords
  • Start/DisableContextMenus
  • System/FeedbackHubAlwaysSaveDiagnosticsLocally
  • SystemServices/ConfigureHomeGroupListenerServiceStartupMode
  • SystemServices/ConfigureHomeGroupProviderServiceStartupMode
  • SystemServices/ConfigureXboxAccessoryManagementServiceStartupMode
  • SystemServices/ConfigureXboxLiveAuthManagerServiceStartupMode
  • SystemServices/ConfigureXboxLiveGameSaveServiceStartupMode
  • SystemServices/ConfigureXboxLiveNetworkingServiceStartupMode
  • TaskScheduler/EnableXboxGameSaveTask
  • TextInput/EnableTouchKeyboardAutoInvokeInDesktopMode
  • TextInput/ForceTouchKeyboardDockedState
  • TextInput/TouchKeyboardDictationButtonAvailability
  • TextInput/TouchKeyboardEmojiButtonAvailability
  • TextInput/TouchKeyboardFullModeAvailability
  • TextInput/TouchKeyboardHandwritingModeAvailability
  • TextInput/TouchKeyboardNarrowModeAvailability
  • TextInput/TouchKeyboardSplitModeAvailability
  • TextInput/TouchKeyboardWideModeAvailability
  • Update/ConfigureFeatureUpdateUninstallPeriod
  • UserRights/AccessCredentialManagerAsTrustedCaller
  • UserRights/AccessFromNetwork
  • UserRights/ActAsPartOfTheOperatingSystem
  • UserRights/AllowLocalLogOn
  • UserRights/BackupFilesAndDirectories
  • UserRights/ChangeSystemTime
  • UserRights/CreateGlobalObjects
  • UserRights/CreatePageFile
  • UserRights/CreatePermanentSharedObjects
  • UserRights/CreateSymbolicLinks
  • UserRights/CreateToken
  • UserRights/DebugPrograms
  • UserRights/DenyAccessFromNetwork
  • UserRights/DenyLocalLogOn
  • UserRights/DenyRemoteDesktopServicesLogOn
  • UserRights/EnableDelegation
  • UserRights/GenerateSecurityAudits
  • UserRights/ImpersonateClient
  • UserRights/IncreaseSchedulingPriority
  • UserRights/LoadUnloadDeviceDrivers
  • UserRights/LockMemory
  • UserRights/ManageAuditingAndSecurityLog
  • UserRights/ManageVolume
  • UserRights/ModifyFirmwareEnvironment
  • UserRights/ModifyObjectLabel
  • UserRights/ProfileSingleProcess
  • UserRights/RemoteShutdown
  • UserRights/RestoreFilesAndDirectories
  • UserRights/TakeOwnership
  • WindowsDefenderSecurityCenter/DisableAccountProtectionUI
  • WindowsDefenderSecurityCenter/DisableDeviceSecurityUI
  • WindowsDefenderSecurityCenter/HideRansomwareDataRecovery
  • WindowsDefenderSecurityCenter/HideSecureBoot
  • WindowsDefenderSecurityCenter/HideTPMTroubleshooting

Security/RequireDeviceEncryption - updated to show it is supported in desktop.

BitLocker CSP

Updated the description for AllowWarningForOtherDiskEncryption to describe changes added in Windows 10, version 1803.

DMClient CSP

Added ./User/Vendor/MSFT/DMClient/Provider/[ProviderID]/FirstSyncStatus node. Also added the following nodes in Windows 10, version 1803:

  • AADSendDeviceToken
  • BlockInStatusPage
  • AllowCollectLogsButton
  • CustomErrorText
  • SkipDeviceStatusPage
  • SkipUserStatusPage
Defender CSP

Added new node (OfflineScan) in Windows 10, version 1803.

UEFI CSP

Added a new CSP in Windows 10, version 1803.

Update CSP

Added the following nodes in Windows 10, version 1803:

  • Rollback
  • Rollback/FeatureUpdate
  • Rollback/QualityUpdateStatus
  • Rollback/FeatureUpdateStatus
AssignedAccess CSP

Added the following nodes in Windows 10, version 1803:

  • Status
  • ShellLauncher
  • StatusConfiguration

Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in HoloLens (1st gen) Commercial Suite. Added example for HoloLens (1st gen) Commercial Suite.

MultiSIM CSP

Added a new CSP in Windows 10, version 1803.

EnterpriseModernAppManagement CSP

Added the following node in Windows 10, version 1803:

  • MaintainProcessorArchitectureOnUpdate
eUICCs CSP

Added the following node in Windows 10, version 1803:

  • IsEnabled
DeviceStatus CSP

Added the following node in Windows 10, version 1803:

  • OS/Mode
AccountManagement CSP

Added a new CSP in Windows 10, version 1803.

RootCATrustedCertificates CSP

Added the following node in Windows 10, version 1803:

  • UntrustedCertificates
NetworkProxy CSP

Added the following node in Windows 10, version 1803:

  • ProxySettingsPerUser
Accounts CSP

Added a new CSP in Windows 10, version 1803.

MDM Migration Analysis Too (MMAT)

Updated version available. MMAT is a tool you can use to determine which Group Policies are set on a target user/computer and cross-reference them against the list of supported MDM policies.

CSP DDF files download

Added the DDF download of Windows 10, version 1803 configuration service providers.
## What’s new in MDM for Windows 10, version 1709
Item Description
The [MS-MDE2]: Mobile Device Enrollment Protocol Version 2

The Windows 10 enrollment protocol was updated. The following elements were added to the RequestSecurityToken message:

  • UXInitiated - boolean value that indicates whether the enrollment is user initiated from the Settings page.
  • ExternalMgmtAgentHint - a string the agent uses to give hints the enrollment server may need.
  • DomainName - fully qualified domain name if the device is domain-joined.

For examples, see section 4.3.1 RequestSecurityToken of the MS-MDE2 protocol documentation.

Firewall CSP

Added new CSP in Windows 10, version 1709.

eUICCs CSP

Added new CSP in Windows 10, version 1709.

WindowsDefenderApplicationGuard CSP New CSP added in Windows 10, version 1709. Also added the DDF topic WindowsDefenderApplicationGuard DDF file.
CM_ProxyEntries CSP and CMPolicy CSP In Windows 10, version 1709, support for desktop SKUs were added to these CSPs. The table of SKU information in the Configuration service provider reference was updated.
WindowsDefenderApplicationGuard CSP New CSP added in Windows 10, version 1709. Also added the DDF topic WindowsDefenderApplicationGuard DDF file.
VPNv2 CSP

Added DeviceTunnel and RegisterDNS settings in Windows 10, version 1709.

DeviceStatus CSP

Added the following settings in Windows 10, version 1709:

  • DeviceStatus/DomainName
  • DeviceStatus/DeviceGuard/VirtualizationBasedSecurityHwReq
  • DeviceStatus/DeviceGuard/VirtualizationBasedSecurityStatus
  • DeviceStatus/DeviceGuard/LsaCfgCredGuardStatus
AssignedAccess CSP

Added the following setting in Windows 10, version 1709.

  • Configuration

Starting in Windows 10, version 1709, AssignedAccess CSP is supported in Windows 10 Pro.

DeviceManageability CSP

Added the following settings in Windows 10, version 1709:

  • Provider/ProviderID/ConfigInfo
  • Provider/ProviderID/EnrollmentInfo
Office CSP

Added the following setting in Windows 10, version 1709:

  • Installation/CurrentStatus
DMClient CSP

Added new nodes to the DMClient CSP in Windows 10, version 1709. Updated the CSP and DDF topics.

Bitlocker CSP

Changed the minimum personal identification number (PIN) length to 4 digits in SystemDrivesRequireStartupAuthentication and SystemDrivesMinimumPINLength in Windows 10, version 1709.

ADMX-backed policies in Policy CSP

Added new policies.

Microsoft Store for Business and Microsoft Store

Windows Store for Business name changed to Microsoft Store for Business. Windows Store name changed to Microsoft Store.

MDM enrollment of Windows-based devices

New features in the Settings app:

  • User sees installation progress of critical policies during MDM enrollment.
  • User knows what policies, profiles, apps MDM has configured
  • IT helpdesk can get detailed MDM diagnostic information using client tools

For details, see Managing connection and Collecting diagnostic logs

Enroll a Windows 10 device automatically using Group Policy

Added new topic to introduce a new Group Policy for automatic MDM enrollment.

Policy CSP

Added the following new policies for Windows 10, version 1709:

  • Authentication/AllowAadPasswordReset
  • Authentication/AllowFidoDeviceSignon
  • Browser/LockdownFavorites
  • Browser/ProvisionFavorites
  • Cellular/LetAppsAccessCellularData
  • Cellular/LetAppsAccessCellularData_ForceAllowTheseApps
  • Cellular/LetAppsAccessCellularData_ForceDenyTheseApps
  • Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps
  • CredentialProviders/DisableAutomaticReDeploymentCredentials
  • DeviceGuard/EnableVirtualizationBasedSecurity
  • DeviceGuard/RequirePlatformSecurityFeatures
  • DeviceGuard/LsaCfgFlags
  • DeviceLock/MinimumPasswordAge
  • ExploitGuard/ExploitProtectionSettings
  • Games/AllowAdvancedGamingServices
  • Handwriting/PanelDefaultModeDocked
  • LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts
  • LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly
  • LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount
  • LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount
  • LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked
  • LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayLastSignedIn
  • LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayUsernameAtSignIn
  • LocalPoliciesSecurityOptions/Interactivelogon_DoNotRequireCTRLALTDEL
  • LocalPoliciesSecurityOptions/InteractiveLogon_MachineInactivityLimit
  • LocalPoliciesSecurityOptions/InteractiveLogon_MessageTextForUsersAttemptingToLogOn
  • LocalPoliciesSecurityOptions/InteractiveLogon_MessageTitleForUsersAttemptingToLogOn
  • LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests
  • LocalPoliciesSecurityOptions/RecoveryConsole_AllowAutomaticAdministrativeLogon
  • LocalPoliciesSecurityOptions/Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn
  • LocalPoliciesSecurityOptions/UserAccountControl_AllowUIAccessApplicationsToPromptForElevation
  • LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForAdministrators
  • LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers
  • LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated
  • LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations
  • LocalPoliciesSecurityOptions/UserAccountControl_RunAllAdministratorsInAdminApprovalMode
  • LocalPoliciesSecurityOptions/UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation
  • LocalPoliciesSecurityOptions/UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations
  • Power/DisplayOffTimeoutOnBattery
  • Power/DisplayOffTimeoutPluggedIn
  • Power/HibernateTimeoutOnBattery
  • Power/HibernateTimeoutPluggedIn
  • Power/StandbyTimeoutOnBattery
  • Power/StandbyTimeoutPluggedIn
  • Privacy/EnableActivityFeed
  • Privacy/PublishUserActivities
  • Defender/AttackSurfaceReductionOnlyExclusions
  • Defender/AttackSurfaceReductionRules
  • Defender/CloudBlockLevel
  • Defender/CloudExtendedTimeout
  • Defender/ControlledFolderAccessAllowedApplications
  • Defender/ControlledFolderAccessProtectedFolders
  • Defender/EnableControlledFolderAccess
  • Defender/EnableNetworkProtection
  • Education/DefaultPrinterName
  • Education/PreventAddingNewPrinters
  • Education/PrinterNames
  • Search/AllowCloudSearch
  • Security/ClearTPMIfNotReady
  • Settings/AllowOnlineTips
  • Start/HidePeopleBar
  • Storage/AllowDiskHealthModelUpdates
  • System/DisableEnterpriseAuthProxy
  • System/LimitEnhancedDiagnosticDataWindowsAnalytics
  • Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork
  • Update/DisableDualScan
  • Update/ManagePreviewBuilds
  • Update/ScheduledInstallEveryWeek
  • Update/ScheduledInstallFirstWeek
  • Update/ScheduledInstallFourthWeek
  • Update/ScheduledInstallSecondWeek
  • Update/ScheduledInstallThirdWeek
  • WindowsDefenderSecurityCenter/CompanyName
  • WindowsDefenderSecurityCenter/DisableAppBrowserUI
  • WindowsDefenderSecurityCenter/DisableEnhancedNotifications
  • WindowsDefenderSecurityCenter/DisableFamilyUI
  • WindowsDefenderSecurityCenter/DisableHealthUI
  • WindowsDefenderSecurityCenter/DisableNetworkUI
  • WindowsDefenderSecurityCenter/DisableNotifications
  • WindowsDefenderSecurityCenter/DisableVirusUI
  • WindowsDefenderSecurityCenter/DisallowExploitProtectionOverride
  • WindowsDefenderSecurityCenter/Email
  • WindowsDefenderSecurityCenter/EnableCustomizedToasts
  • WindowsDefenderSecurityCenter/EnableInAppCustomization
  • WindowsDefenderSecurityCenter/Phone
  • WindowsDefenderSecurityCenter/URL
  • WirelessDisplay/AllowMdnsAdvertisement
  • WirelessDisplay/AllowMdnsDiscovery
## What’s new in MDM for Windows 10, version 1703
Item Description

Update CSP

Added the following nodes:

  • FailedUpdates/Failed Update Guid/RevisionNumber
  • InstalledUpdates/Installed Update Guid/RevisionNumber
  • PendingRebootUpdates/Pending Reboot Update Guid/RevisionNumber
CM_CellularEntries CSP

To PurposeGroups setting, added the following values:

  • Purchase - 95522B2B-A6D1-4E40-960B-05E6D3F962AB
  • Administrative - 2FFD9261-C23C-4D27-8DCF-CDE4E14A3364

CertificateStore CSP

Added the following setting:

  • My/WSTEP/Renew/RetryAfterExpiryInterval

ClientCertificateInstall CSP

Added the following setting:

  • SCEP/UniqueID/Install/AADKeyIdentifierList

DMAcc CSP

Added the following setting:

  • AccountUID/EXT/Microsoft/InitiateSession

DMClient CSP

Added the following nodes and settings:

  • HWDevID
  • Provider/ProviderID/ManagementServerToUpgradeTo
  • Provider/ProviderID/CustomEnrollmentCompletePage
  • Provider/ProviderID/CustomEnrollmentCompletePage/Title
  • Provider/ProviderID/CustomEnrollmentCompletePage/BodyText
  • Provider/ProviderID/CustomEnrollmentCompletePage/HyperlinkHref
  • Provider/ProviderID/CustomEnrollmentCompletePage/HyperlinkText

CellularSettings CSP

CM_CellularEntries CSP

EnterpriseAPN CSP

For these CSPs, support was added for Windows 10 Home, Pro, Enterprise, and Education editions.

SecureAssessment CSP

Added the following settings:

  • AllowTextSuggestions
  • RequirePrinting
EnterpriseAPN CSP

Added the following setting:

  • Roaming
Messaging CSP

Added new CSP. This CSP is only supported in Windows 10 Mobile and Mobile Enterprise editions.
Policy CSP

Added the following new policies:

  • Accounts/AllowMicrosoftAccountSignInAssistant
  • ApplicationDefaults/DefaultAssociationsConfiguration
  • Browser/AllowAddressBarDropdown
  • Browser/AllowFlashClickToRun
  • Browser/AllowMicrosoftCompatibilityList
  • Browser/AllowSearchEngineCustomization
  • Browser/ClearBrowsingDataOnExit
  • Browser/ConfigureAdditionalSearchEngines
  • Browser/DisableLockdownOfStartPages
  • Browser/PreventFirstRunPage
  • Browser/PreventLiveTileDataCollection
  • Browser/SetDefaultSearchEngine
  • Browser/SyncFavoritesBetweenIEAndMicrosoftEdge
  • Connectivity/AllowConnectedDevices
  • DeliveryOptimization/DOAllowVPNPeerCaching
  • DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload
  • DeliveryOptimization/DOMinDiskSizeAllowedToPeer
  • DeliveryOptimization/DOMinFileSizeToCache
  • DeliveryOptimization/DOMinRAMAllowedToPeer
  • DeviceLock/MaxInactivityTimeDeviceLockWithExternalDisplay
  • Display/TurnOffGdiDPIScalingForApps
  • Display/TurnOnGdiDPIScalingForApps
  • EnterpriseCloudPrint/CloudPrinterDiscoveryEndPoint
  • EnterpriseCloudPrint/CloudPrintOAuthAuthority
  • EnterpriseCloudPrint/CloudPrintOAuthClientId
  • EnterpriseCloudPrint/CloudPrintResourceId
  • EnterpriseCloudPrint/DiscoveryMaxPrinterLimit
  • EnterpriseCloudPrint/MopriaDiscoveryResourceId
  • Experience/AllowFindMyDevice
  • Experience/AllowTailoredExperiencesWithDiagnosticData
  • Experience/AllowWindowsSpotlightOnActionCenter
  • Experience/AllowWindowsSpotlightWindowsWelcomeExperience
  • Location/EnableLocation
  • Messaging/AllowMMS
  • Messaging/AllowRCS
  • Privacy/LetAppsAccessTasks
  • Privacy/LetAppsAccessTasks_ForceAllowTheseApps
  • Privacy/LetAppsAccessTasks_ForceDenyTheseApps
  • Privacy/LetAppsAccessTasks_UserInControlOfTheseApps
  • Privacy/LetAppsGetDiagnosticInfo
  • Privacy/LetAppsGetDiagnosticInfo_ForceAllowTheseApps
  • Privacy/LetAppsGetDiagnosticInfo_ForceDenyTheseApps
  • Privacy/LetAppsGetDiagnosticInfo_UserInControlOfTheseApps
  • Privacy/LetAppsRunInBackground
  • Privacy/LetAppsRunInBackground_ForceAllowTheseApps
  • Privacy/LetAppsRunInBackground_ForceDenyTheseApps
  • Privacy/LetAppsRunInBackground_UserInControlOfTheseApps
  • Settings/ConfigureTaskbarCalendar
  • Settings/PageVisibilityList
  • SmartScreen/EnableAppInstallControl
  • SmartScreen/EnableSmartScreenInShell
  • SmartScreen/PreventOverrideForFilesInShell
  • Start/AllowPinnedFolderDocuments
  • Start/AllowPinnedFolderDownloads
  • Start/AllowPinnedFolderFileExplorer
  • Start/AllowPinnedFolderHomeGroup
  • Start/AllowPinnedFolderMusic
  • Start/AllowPinnedFolderNetwork
  • Start/AllowPinnedFolderPersonalFolder
  • Start/AllowPinnedFolderPictures
  • Start/AllowPinnedFolderSettings
  • Start/AllowPinnedFolderVideos
  • Start/HideAppList
  • Start/HideChangeAccountSettings
  • Start/HideFrequentlyUsedApps
  • Start/HideHibernate
  • Start/HideLock
  • Start/HidePowerButton
  • Start/HideRecentJumplists
  • Start/HideRecentlyAddedApps
  • Start/HideRestart
  • Start/HideShutDown
  • Start/HideSignOut
  • Start/HideSleep
  • Start/HideSwitchAccount
  • Start/HideUserTile
  • Start/ImportEdgeAssets
  • Start/NoPinningToTaskbar
  • System/AllowFontProviders
  • System/DisableOneDriveFileSync
  • TextInput/AllowKeyboardTextSuggestions
  • TimeLanguageSettings/AllowSet24HourClock
  • Update/ActiveHoursMaxRange
  • Update/AutoRestartDeadlinePeriodInDays
  • Update/AutoRestartNotificationSchedule
  • Update/AutoRestartRequiredNotificationDismissal
  • Update/DetectionFrequency
  • Update/EngagedRestartDeadline
  • Update/EngagedRestartSnoozeSchedule
  • Update/EngagedRestartTransitionSchedule
  • Update/IgnoreMOAppDownloadLimit
  • Update/IgnoreMOUpdateDownloadLimit
  • Update/PauseFeatureUpdatesStartTime
  • Update/PauseQualityUpdatesStartTime
  • Update/SetAutoRestartNotificationDisable
  • Update/SetEDURestart
  • WiFi/AllowWiFiDirect
  • WindowsLogon/HideFastUserSwitching
  • WirelessDisplay/AllowProjectionFromPC
  • WirelessDisplay/AllowProjectionFromPCOverInfrastructure
  • WirelessDisplay/AllowProjectionToPCOverInfrastructure
  • WirelessDisplay/AllowUserInputFromWirelessDisplayReceiver

Removed TextInput/AllowLinguisticDataCollection

Starting in Windows 10, version 1703, Update/UpdateServiceUrl is not supported in Windows 10 Mobile Enterprise and IoT Enterprise

Starting in Windows 10, version 1703, the maximum value of Update/DeferFeatureUpdatesPeriodInDays has been increased from 180 days, to 365 days.

Starting in Windows 10, version 1703, in Browser/HomePages you can use the "<about:blank>" value if you don’t want to send traffic to Microsoft.

Starting in Windows 10, version 1703, Start/StartLayout can now be set on a per-device basis in addition to the pre-existing per-user basis.

Added the ConfigOperations/ADMXInstall node and setting, which is used to ingest ADMX files.

DevDetail CSP

Added the following setting:

  • DeviceHardwareData
CleanPC CSP

Added new CSP.
DeveloperSetup CSP

Added new CSP.
NetworkProxy CSP

Added new CSP.
BitLocker CSP

Added new CSP.

Added the following setting:

  • AllowWarningForOtherDiskEncryption
EnterpriseDataProtection CSP

Starting in Windows 10, version 1703, AllowUserDecryption is no longer supported.

Added the following settings:

  • RevokeOnMDMHandoff
  • SMBAutoEncryptedFileExtensions
DynamicManagement CSP

Added new CSP.
Implement server-side support for mobile application management on Windows

New mobile application management (MAM) support added in Windows 10, version 1703.

PassportForWork CSP

Added the following new node and settings:

  • TenantId/Policies/ExcludeSecurityDevices (only for ./Device/Vendor/MSFT)
  • TenantId/Policies/ExcludeSecurityDevices/TPM12 (only for ./Device/Vendor/MSFT)
  • TenantId/Policies/EnablePinRecovery
Office CSP

Added new CSP.
Personalization CSP

Added new CSP.
EnterpriseAppVManagement CSP

Added new CSP.
HealthAttestation CSP

Added the following settings:

  • HASEndpoint - added in Windows 10, version 1607, but not documented
  • TpmReadyStatus - added in the March service release of Windows 10, version 1607

SurfaceHub CSP

Added the following nodes and settings:

  • InBoxApps/SkypeForBusiness
  • InBoxApps/SkypeForBusiness/DomainName
  • InBoxApps/Connect
  • InBoxApps/Connect/AutoLaunch
  • Properties/DefaultVolume
  • Properties/ScreenTimeout
  • Properties/SessionTimeout
  • Properties/SleepTimeout
  • Properties/AllowSessionResume
  • Properties/AllowAutoProxyAuth
  • Properties/DisableSigninSuggestions
  • Properties/DoNotShowMyMeetingsAndFiles
NetworkQoSPolicy CSP

Added new CSP.

WindowsLicensing CSP

Added the following setting:

  • ChangeProductKey
WindowsAdvancedThreatProtection CSP

Added the following setting:

  • Configuration/TelemetryReportingFrequency
DMSessionActions CSP

Added new CSP.

SharedPC CSP

Added new settings in Windows 10, version 1703.

  • RestrictLocalStorage
  • KioskModeAUMID
  • KioskModeUserTileDisplayText
  • InactiveThreshold
  • MaxPageFileSizeMB

The default value for SetEduPolicies changed to false. The default value for SleepTimeout changed to 300.

RemoteLock CSP

Added following setting:

  • LockAndRecoverPIN
NodeCache CSP

Added following settings:

  • ChangedNodesData
  • AutoSetExpectedValue
Download all the DDF files for Windows 10, version 1703

Added a zip file containing the DDF XML files of the CSPs. The link to the download is available in the DDF topics of various CSPs.

RemoteWipe CSP

Added new setting in Windows 10, version 1703.

  • doWipeProtected
MDM Bridge WMI Provider

Added new classes and properties.

Understanding ADMX-backed policies

Added a section describing SyncML examples of various ADMX elements.

Win32 and Desktop Bridge app policy configuration New topic.
Deploy and configure App-V apps using MDM

Added a new topic describing how to deploy and configure App-V apps using MDM.

EnterpriseDesktopAppManagement CSP

Added new setting in the March service release of Windows 10, version 1607.

  • MSI/UpgradeCode/[Guid]
Reporting CSP

Added new settings in Windows 10, version 1703.

  • EnterpriseDataProtection/RetrieveByTimeRange/Type
  • EnterpriseDataProtection/RetrieveByCount/Type
Connecting your Windows 10-based device to work using a deep link

Added following deep link parameters to the table:

  • Username
  • Servername
  • Accesstoken
  • Deviceidentifier
  • Tenantidentifier
  • Ownership
MDM support for Windows 10 S

Updated the following topics to indicate MDM support in Windows 10 S.

TPMPolicy CSP New CSP added in Windows 10, version 1703.
  ## What’s new in MDM for Windows 10, version 1607
Item Description

Sideloading of apps

Starting in Windows 10, version 1607, sideloading of apps is only allowed through EnterpriseModernAppManagement CSP. Product keys (5x5) will no longer be supported to enable sideloading on Windows 10, version 1607 devices.

New value for NodeCache CSP

In NodeCache CSP, the value of NodeCache root node starting in Windows 10, version 1607 is com.microsoft/1.0/MDM/NodeCache.
EnterpriseDataProtection CSP

New CSP.
Policy CSP

Removed the following policies:

  • DataProtection/AllowAzureRMSForEDP - moved this policy to EnterpriseDataProtection CSP
  • DataProtection/AllowUserDecryption - moved this policy to EnterpriseDataProtection CSP
  • DataProtection/EDPEnforcementLevel - moved this policy to EnterpriseDataProtection CSP
  • DataProtection/RequireProtectionUnderLockConfig - moved this policy to EnterpriseDataProtection CSP
  • DataProtection/RevokeOnUnenroll - moved this policy to EnterpriseDataProtection CSP
  • DataProtection/EnterpriseCloudResources - moved this policy to NetworkIsolation policy
  • DataProtection/EnterpriseInternalProxyServers - moved this policy to NetworkIsolation policy
  • DataProtection/EnterpriseIPRange - moved this policy to NetworkIsolation policy
  • DataProtection/EnterpriseNetworkDomainNames - moved this policy to NetworkIsolation policy
  • DataProtection/EnterpriseProxyServers - moved this policy to NetworkIsolation policy
  • Security/AllowAutomaticDeviceEncryptionForAzureADJoinedDevices - this policy has been deprecated.

Added the WiFi/AllowManualWiFiConfiguration and WiFi/AllowWiFi policies for Windows 10, version 1607:

  • Windows 10 Pro
  • Windows 10 Enterprise
  • Windows 10 Education

Added the following new policies:

  • AboveLock/AllowCortanaAboveLock
  • ApplicationManagement/DisableStoreOriginatedApps
  • Authentication/AllowSecondaryAuthenticationDevice
  • Bluetooth/AllowPrepairing
  • Browser/AllowExtensions
  • Browser/PreventAccessToAboutFlagsInMicrosoftEdge
  • Browser/ShowMessageWhenOpeningSitesInInternetExplorer
  • DeliveryOptimization/DOAbsoluteMaxCacheSize
  • DeliveryOptimization/DOMaxDownloadBandwidth
  • DeliveryOptimization/DOMinBackgroundQoS
  • DeliveryOptimization/DOModifyCacheDrive
  • DeliveryOptimization/DOMonthlyUploadDataCap
  • DeliveryOptimization/DOPercentageMaxDownloadBandwidth
  • DeviceLock/EnforceLockScreenAndLogonImage
  • DeviceLock/EnforceLockScreenProvider
  • Defender/PUAProtection
  • Experience/AllowThirdPartySuggestionsInWindowsSpotlight
  • Experience/AllowWindowsSpotlight
  • Experience/ConfigureWindowsSpotlightOnLockScreen
  • Experience/DoNotShowFeedbackNotifications
  • Licensing/AllowWindowsEntitlementActivation
  • Licensing/DisallowKMSClientOnlineAVSValidation
  • LockDown/AllowEdgeSwipe
  • Maps/EnableOfflineMapsAutoUpdate
  • Maps/AllowOfflineMapsDownloadOverMeteredConnection
  • Messaging/AllowMessageSync
  • NetworkIsolation/EnterpriseCloudResources
  • NetworkIsolation/EnterpriseInternalProxyServers
  • NetworkIsolation/EnterpriseIPRange
  • NetworkIsolation/EnterpriseIPRangesAreAuthoritative
  • NetworkIsolation/EnterpriseNetworkDomainNames
  • NetworkIsolation/EnterpriseProxyServers
  • NetworkIsolation/EnterpriseProxyServersAreAuthoritative
  • NetworkIsolation/NeutralResources
  • Notifications/DisallowNotificationMirroring
  • Privacy/DisableAdvertisingId
  • Privacy/LetAppsAccessAccountInfo
  • Privacy/LetAppsAccessAccountInfo_ForceAllowTheseApps
  • Privacy/LetAppsAccessAccountInfo_ForceDenyTheseApps
  • Privacy/LetAppsAccessAccountInfo_UserInControlOfTheseApps
  • Privacy/LetAppsAccessCalendar
  • Privacy/LetAppsAccessCalendar_ForceAllowTheseApps
  • Privacy/LetAppsAccessCalendar_ForceDenyTheseApps
  • Privacy/LetAppsAccessCalendar_UserInControlOfTheseApps
  • Privacy/LetAppsAccessCallHistory
  • Privacy/LetAppsAccessCallHistory_ForceAllowTheseApps
  • Privacy/LetAppsAccessCallHistory_ForceDenyTheseApps
  • Privacy/LetAppsAccessCallHistory_UserInControlOfTheseApps
  • Privacy/LetAppsAccessCamera
  • Privacy/LetAppsAccessCamera_ForceAllowTheseApps
  • Privacy/LetAppsAccessCamera_ForceDenyTheseApps
  • Privacy/LetAppsAccessCamera_UserInControlOfTheseApps
  • Privacy/LetAppsAccessContacts
  • Privacy/LetAppsAccessContacts_ForceAllowTheseApps
  • Privacy/LetAppsAccessContacts_ForceDenyTheseApps
  • Privacy/LetAppsAccessContacts_UserInControlOfTheseApps
  • Privacy/LetAppsAccessEmail
  • Privacy/LetAppsAccessEmail_ForceAllowTheseApps
  • Privacy/LetAppsAccessEmail_ForceDenyTheseApps
  • Privacy/LetAppsAccessEmail_UserInControlOfTheseApps
  • Privacy/LetAppsAccessLocation
  • Privacy/LetAppsAccessLocation_ForceAllowTheseApps
  • Privacy/LetAppsAccessLocation_ForceDenyTheseApps
  • Privacy/LetAppsAccessLocation_UserInControlOfTheseApps
  • Privacy/LetAppsAccessMessaging
  • Privacy/LetAppsAccessMessaging_ForceAllowTheseApps
  • Privacy/LetAppsAccessMessaging_ForceDenyTheseApps
  • Privacy/LetAppsAccessMessaging_UserInControlOfTheseApps
  • Privacy/LetAppsAccessMicrophone
  • Privacy/LetAppsAccessMicrophone_ForceAllowTheseApps
  • Privacy/LetAppsAccessMicrophone_ForceDenyTheseApps
  • Privacy/LetAppsAccessMicrophone_UserInControlOfTheseApps
  • Privacy/LetAppsAccessMotion
  • Privacy/LetAppsAccessMotion_ForceAllowTheseApps
  • Privacy/LetAppsAccessMotion_ForceDenyTheseApps
  • Privacy/LetAppsAccessMotion_UserInControlOfTheseApps
  • Privacy/LetAppsAccessNotifications
  • Privacy/LetAppsAccessNotifications_ForceAllowTheseApps
  • Privacy/LetAppsAccessNotifications_ForceDenyTheseApps
  • Privacy/LetAppsAccessNotifications_UserInControlOfTheseApps
  • Privacy/LetAppsAccessPhone
  • Privacy/LetAppsAccessPhone_ForceAllowTheseApps
  • Privacy/LetAppsAccessPhone_ForceDenyTheseApps
  • Privacy/LetAppsAccessPhone_UserInControlOfTheseApps
  • Privacy/LetAppsAccessRadios
  • Privacy/LetAppsAccessRadios_ForceAllowTheseApps
  • Privacy/LetAppsAccessRadios_ForceDenyTheseApps
  • Privacy/LetAppsAccessRadios_UserInControlOfTheseApps
  • Privacy/LetAppsAccessTrustedDevices
  • Privacy/LetAppsAccessTrustedDevices_ForceAllowTheseApps
  • Privacy/LetAppsAccessTrustedDevices_ForceDenyTheseApps
  • Privacy/LetAppsAccessTrustedDevices_UserInControlOfTheseApps
  • Privacy/LetAppsSyncWithDevices
  • Privacy/LetAppsSyncWithDevices_ForceAllowTheseApps
  • Privacy/LetAppsSyncWithDevices_ForceDenyTheseApps
  • Privacy/LetAppsSyncWithDevices_UserInControlOfTheseApps
  • Security/PreventAutomaticDeviceEncryptionForAzureADJoinedDevices
  • Settings/AllowEditDeviceName
  • Speech/AllowSpeechModelUpdate
  • System/TelemetryProxy
  • Update/ActiveHoursStart
  • Update/ActiveHoursEnd
  • Update/AllowMUUpdateService
  • Update/BranchReadinessLevel
  • Update/DeferFeatureUpdatesPeriodInDays
  • Update/DeferQualityUpdatesPeriodInDays
  • Update/ExcludeWUDriversInQualityUpdate
  • Update/PauseFeatureUpdates
  • Update/PauseQualityUpdates
  • Update/UpdateServiceUrlAlternate (Added in the January service release of Windows 10, version 1607)
  • WindowsInkWorkspace/AllowWindowsInkWorkspace
  • WindowsInkWorkspace/AllowSuggestedAppsInWindowsInkWorkspace
  • WirelessDisplay/AllowProjectionToPC
  • WirelessDisplay/RequirePinForPairing

Updated the Privacy/AllowAutoAcceptPairingAndPrivacyConsentPrompts description to remove outdated information.

Updated DeliveryOptimization/DODownloadMode to add new values.

Updated Experience/AllowCortana description to clarify what each supported value does.

Updated Security/AntiTheftMode description to clarify what each supported value does.
DMClient CSP

Added the following settings:

  • ManagementServerAddressList
  • AADDeviceID
  • EnrollmentType
  • HWDevID
  • CommercialID

Removed the EnrollmentID setting.
DeviceManageability CSP

New CSP.
DeviceStatus CSP

Added the following new settings:

  • DeviceStatus/TPM/SpecificationVersion
  • DeviceStatus/OS/Edition
  • DeviceStatus/Antivirus/SignatureStatus
  • DeviceStatus/Antivirus/Status
  • DeviceStatus/Antispyware/SignatureStatus
  • DeviceStatus/Antispyware/Status
  • DeviceStatus/Firewall/Status
  • DeviceStatus/UAC/Status
  • DeviceStatus/Battery/Status
  • DeviceStatus/Battery/EstimatedChargeRemaining
  • DeviceStatus/Battery/EstimatedRuntime
AssignedAccess CSP

Added SyncML examples.
EnterpriseAssignedAccess CSP
  • Added a new Folder table entry in the AssignedAccess/AssignedAccessXml description.
  • Updated the DDF and XSD file sections.
SecureAssessment CSP

New CSP for Windows 10, version 1607
DiagnosticLog CSP

DiagnosticLog DDF

Added version 1.3 of the CSP with two new settings. Added the new 1.3 version of the DDF. Added the following new settings in Windows 10, version 1607.

  • DeviceStateData
  • DeviceStateData/MdmConfiguration
Reboot CSP

New CSP for Windows 10, version 1607
CMPolicyEnterprise CSP

New CSP for Windows 10, version 1607
VPNv2 CSP

Added the following settings for Windows 10, version 1607

  • ProfileName/RouteList/routeRowId/ExclusionRoute
  • ProfileName/DomainNameInformationList/dniRowId/AutoTrigger
  • ProfileName/DomainNameInformationList/dniRowId/Persistent
  • ProfileName/ProfileXML
  • ProfileName/DeviceCompliance/Enabled
  • ProfileName/DeviceCompliance/Sso
  • ProfileName/DeviceCompliance/Sso/Enabled
  • ProfileName/DeviceCompliance/Sso/IssuerHash
  • ProfileName/DeviceCompliance/Sso/Eku
  • ProfileName/NativeProfile/CryptographySuite
  • ProfileName/NativeProfile/CryptographySuite/AuthenticationTransformConstants
  • ProfileName/NativeProfile/CryptographySuite/CipherTransformConstants
  • ProfileName/NativeProfile/CryptographySuite/EncryptionMethod
  • ProfileName/NativeProfile/CryptographySuite/IntegrityCheckMethod
  • ProfileName/NativeProfile/CryptographySuite/DHGroup
  • ProfileName/NativeProfile/CryptographySuite/PfsGroup
  • ProfileName/NativeProfile/L2tpPsk
Win32AppInventory CSP

Win32AppInventory DDF

New CSP for Windows 10, version 1607.
SharedPC CSP

New CSP for Windows 10, version 1607.
WindowsAdvancedThreatProtection CSP

New CSP for Windows 10, version 1607.
MDM Bridge WMI Provider

Added new classes for Windows 10, version 1607.
MDM enrollment of Windows devices

Topic renamed from "Enrollment UI".

Completely updated enrollment procedures and screenshots.
UnifiedWriteFilter CSP

UnifiedWriteFilter DDF File

Added the following new setting for Windows 10, version 1607:

  • NextSession/HORMEnabled
CertificateStore CSP

CertificateStore DDF file

Added the following new settings in Windows 10, version 1607:

  • My/WSTEP/Renew/LastRenewalAttemptTime
  • My/WSTEP/Renew/RenewNow

WindowsLicensing CSP

Added the following new node and settings in Windows 10, version 1607, but not documented:

  • Subscriptions
  • Subscriptions/SubscriptionId
  • Subscriptions/SubscriptionId/Status
  • Subscriptions/SubscriptionId/Name

WiFi CSP

Deprecated the following node in Windows 10, version 1607:

  • DisableInternetConnectivityChecks
## What’s new in MDM for Windows 10, version 1511
Item Description

New configuration service providers added in Windows 10, version 1511

New and updated policies in Policy CSP

The following policies have been added to the Policy CSP:

  • ApplicationManagement/AllowWindowsBridgeForAndroidAppsExecution
  • Bluetooth/ServicesAllowedList
  • DataProtection/AllowAzureRMSForEDP
  • DataProtection/RevokeOnUnenroll
  • DeviceLock/DevicePasswordExpiration
  • DeviceLock/DevicePasswordHistory
  • TextInput/AllowInputPanel
  • Update/PauseDeferrals
  • Update/RequireDeferUpdate
  • Update/RequireUpdateApproval

The following policies have been updated in the Policy CSP:

  • System/AllowLocation
  • Update/RequireDeferUpgrade

The following policies have been deprecated in the Policy CSP:

  • TextInput/AllowKoreanExtendedHanja
  • WiFi/AllowWiFiHotSpotReporting

Management tool for the Microsoft Store for Business

New topics. The Store for Business has a new web service designed for the enterprise to acquire, manage, and distribute applications in bulk. It enables several capabilities that are required for the enterprise to manage the lifecycle of applications from acquisition to updates.

Custom header for generic alert

The MDM-GenericAlert is a new custom header that hosts one or more alert information provided in the http messages sent by the device to the server during an OMA DM session. The generic alert is sent if the session is triggered by the device due to one or more critical or fatal alerts. Here is alert format:

MDM-GenericAlert: <AlertType1><AlertType2>

If present, the MDM-GenericAlert is presented in every the outgoing MDM message in the same OMA DM session. For more information about generic alerts, see section 8.7 in the OMA Device Management Protocol, Approved Version 1.2.1 in this OMA website.

Alert message for slow client response

When the MDM server sends a configuration request, sometimes it takes the client longer than the HTTP timeout to get all information together and then the session ends unexpectedly due to timeout. By default, the MDM client does not send an alert that a DM request is pending.

To work around the timeout, you can use EnableOmaDmKeepAliveMessage setting to keep the session alive by sending a heartbeat message back to the server. This is achieved by sending a SyncML message with a specific device alert element in the body until the client is able to respond back to the server with the requested information. For details, see EnableOmaDmKeepAliveMessage node in the DMClient CSP.

New node in DMClient CSP

Added a new node EnableOmaDmKeepAliveMessage to the DMClient CSP and updated the ManagementServerAddress to indicate that it can contain a list of URLs.

New nodes in EnterpriseModernAppManagement CSP

Added the following nodes to the EnterpriseModernAppManagement CSP:

  • AppManagement/GetInventoryQuery
  • AppManagement/GetInventoryResults
  • .../PackageFamilyName/AppSettingPolicy/SettingValue
  • AppLicenses/StoreLicenses/LicenseID/LicenseCategory
  • AppLicenses/StoreLicenses/LicenseID/LicenseUsage
  • AppLicenses/StoreLicenses/LicenseID/RequesterID
  • AppLicenses/StoreLicenses/LicenseID/GetLicenseFromStore

New nodes in EnterpriseExt CSP

Added the following nodes to the EnterpriseExt CSP:

  • DeviceCustomData (CustomID, CustomeString)
  • Brightness (Default, MaxAuto)
  • LedAlertNotification (State, Intensity, Period, DutyCycle, Cyclecount)

New node in EnterpriseExtFileSystem CSP

Added OemProfile node to EnterpriseExtFileSystem CSP.

New nodes in PassportForWork CSP

Added the following nodes to PassportForWork CSP:

  • TenantId/Policies/PINComplexity/History
  • TenantId/Policies/PINComplexity/Expiration
  • TenantId/Policies/Remote/UseRemotePassport (only for ./Device/Vendor/MSFT)
  • Biometrics/UseBiometrics (only for ./Device/Vendor/MSFT)
  • Biometrics/FacialFeaturesUseEnhancedAntiSpoofing (only for ./Device/Vendor/MSFT)

Updated EnterpriseAssignedAccess CSP

Here are the changes to the EnterpriseAssignedAccess CSP:

  • In AssignedAccessXML node, added new page settings and quick action settings.
  • In AssignedAccessXML node, added an example about how to pin applications in multiple app packages using the AUMID.
  • Updated the EnterpriseAssignedAccess XSD topic.

New nodes in the DevDetail CSP

Here are the changes to the DevDetail CSP:

  • Added TotalStore and TotalRAM settings.
  • Added support for Replace command for the DeviceName setting.

Handling large objects

Added support for the client to handle uploading of large objects to the server.
## Breaking changes and known issues ### Get command inside an atomic command is not supported In Windows 10, a Get command inside an atomic command is not supported. This was allowed in Windows Phone 8 and Windows Phone 8.1. ### Notification channel URI not preserved during upgrade from Windows 8.1 to Windows 10 During an upgrade from Windows 8.1 to Windows 10, the notification channel URI information is not preserved. In addition, the MDM client loses the PFN, AppID, and client secret. After upgrading to Windows 10, you should call MDM\_WNSConfiguration class to recreate the notification channel URI. ### Apps installed using WMI classes are not removed Applications installed using WMI classes are not removed when the MDM account is removed from device. ### Passing CDATA in SyncML does not work Passing CDATA in data in SyncML to ConfigManager and CSPs does not work in Windows 10. It worked in Windows Phone 8. ### SSL settings in IIS server for SCEP must be set to "Ignore" The certificate setting under "SSL Settings" in the IIS server for SCEP must be set to "Ignore" in Windows 10. In Windows Phone 8.1, when you set the client certificate to "Accept," it works fine. ![ssl settings](images/ssl-settings.png) ### MDM enrollment fails on the mobile device when traffic is going through proxy When the mobile device is configured to use a proxy that requires authentication, the enrollment will fail. To work around this issue, the user can use a proxy that does not require authentication or remove the proxy setting from the connected network. ### Server-initiated unenrollment failure Server-initiated unenrollment for a device enrolled by adding a work account silently fails leaving the MDM account active. MDM policies and resources are still in place and the client can continue to sync with the server. Remote server unenrollment is disabled for mobile devices enrolled via Azure Active Directory Join. It returns an error message to the server. The only way to remove enrollment for a mobile device that is Azure AD joined is by remotely wiping the device. ### Certificates causing issues with Wi-Fi and VPN Currently in Windows 10, version 1511, when using the ClientCertificateInstall to install certificates to the device store and the user store and both certificates are sent to the device in the same MDM payload, the certificate intended for the device store will also get installed in the user store. This may cause issues with Wi-Fi or VPN when choosing the correct certificate to establish a connection. We are working to fix this issue. ### Version information for mobile devices The software version information from **DevDetail/SwV** does not match the version in **Settings** under **System/About**. ### Upgrading Windows Phone 8.1 devices with app whitelisting using ApplicationRestriction policy has issues - When you upgrade Windows Phone 8.1 devices to Windows 10 Mobile using ApplicationRestrictions with a list of allowed apps, some Windows inbox apps get blocked causing unexpected behavior. To work around this issue, you must include the [inbox apps](applocker-csp.md#inboxappsandcomponents) that you need to your list of allowed apps. Here's additional guidance for the upgrade process: - Use Windows 10 product IDs for the apps listed in [inbox apps](applocker-csp.md#inboxappsandcomponents). - Use the new Microsoft publisher name (PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US") and Publisher="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" if you are using the publisher policy. Do not remove the Windows Phone 8.1 publisher rule if you are using it. - In the SyncML, you must use lowercase product ID. - Do not duplicate a product ID. Messaging and Skype Video use the same product ID. Duplicates cause an error. - Silverlight xaps may not install even if publisher policy is specified using Windows Phone 8.1 publisher rule. For example, Silverlight app "Level" will not install even if you specify <Publisher PublisherName=”Microsoft Corporation” />. To workaround this issue, remove the Windows Phone 8.1 publisher rule and add the specific product ID for each Silverlight app you want to allow to the allowed app list. - Some apps (specifically those that are published in Microsoft Store as AppX Bundles) are blocked from installing even when they are included in the app list. No workaround is available at this time. An OS update to fix this issue is coming soon. ### Apps dependent on Microsoft Frameworks may get blocked in phones prior to build 10586.218 Applies only to phone prior to build 10586.218: When ApplicationManagement/ApplicationRestrictions policy is deployed to Windows 10 Mobile, installation and update of apps dependent on Microsoft Frameworks may get blocked with error 0x80073CF9. To work around this issue, you must include the Microsoft Framework Id to your list of allowed apps. ```xml ``` ### Multiple certificates might cause Wi-Fi connection instabilities in Windows 10 Mobile In your deployment, if you have multiple certificates provisioned on the device and the Wi-Fi profile provisioned does not have a strict filtering criteria, you may see connection failures when connecting to Wi-Fi. The solution is to ensure that the Wi-Fi profile provisioned has strict filtering criteria such that it matches only one certificate. Enterprises deploying certificate based EAP authentication for VPN/Wi-Fi can face a situation where there are multiple certificates that meet the default criteria for authentication. This can lead to issues such as: - The user may be prompted to select the certificate. - The wrong certificate may get auto selected and cause an authentication failure. A production ready deployment must have the appropriate certificate details as part of the profile being deployed. The following information explains how to create or update an EAP Configuration XML such that the extraneous certificates are filtered out and the appropriate certificate can be used for the authentication. EAP XML must be updated with relevant information for your environment This can be done either manually by editing the XML sample below, or by using the step by step UI guide. After the EAP XML is updated, refer to instructions from your MDM to deploy the updated configuration as follows: - For Wi-Fi, look for the <EAPConfig> section of your current WLAN Profile XML (This is what you specify for the WLanXml node in the Wi-Fi CSP). Within these tags you will find the complete EAP configuration. Replace the section under <EAPConfig> with your updated XML and update your Wi-Fi profile. You might need to refer to your MDM’s guidance on how to deploy a new Wi-Fi profile. - For VPN, EAP Configuration is a separate field in the MDM Configuration. Work with your MDM provider to identify and update the appropriate Field. For information about EAP Settings, see For information about generating an EAP XML, see [EAP configuration](eap-configuration.md) For more information about extended key usage, see For information about adding extended key usage (EKU) to a certificate, see The following list describes the prerequisites for a certificate to be used with EAP: - The certificate must have at least one of the following EKU (Extended Key Usage) properties: - Client Authentication - As defined by RFC 5280, this is a well-defined OID with Value 1.3.6.1.5.5.7.3.2 - Any Purpose - An EKU Defined and published by Microsoft, is a well-defined OID with value 1.3.6.1.4.1.311.10.12.1. The inclusion of this OID implies that the certificate can be used for any purpose. The advantage of this EKU over the All Purpose EKU is that additional non-critical or custom EKUs can still be added to the certificate for effective filtering. - All Purpose - As defined by RFC 5280, If a CA includes extended key usages to satisfy some application needs, but does not want to restrict usage of the key, the CA can add an Extended Key Usage Value of 0. A certificate with such an EKU can be used for all purposes. - The user or the computer certificate on the client chains to a trusted root CA - The user or the computer certificate does not fail any one of the checks that are performed by the CryptoAPI certificate store, and the certificate passes requirements in the remote access policy. - The user or the computer certificate does not fail any one of the certificate object identifier checks that are specified in the Internet Authentication Service (IAS)/Radius Server. - The Subject Alternative Name (SubjectAltName) extension in the certificate contains the user principal name (UPN) of the user. The following XML sample explains the properties for the EAP TLS XML including certificate filtering. > [!NOTE] >For PEAP or TTLS Profiles the EAP TLS XML is embedded within some PEAP or TTLS specific elements. ```xml 13 0 0 0 13 true false false false false ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ContostoITEKU 1.3.6.1.4.1.311.42.1.15 ContostoITEKU Example1 true ``` > [!NOTE] >The EAP TLS XSD is located at **%systemdrive%\\Windows\\schemas\\EAPMethods\\eaptlsconnectionpropertiesv3.xsd** Alternatively you can use the following procedure to create an EAP Configuration XML. 1. Follow steps 1 through 7 in the [EAP configuration](eap-configuration.md) topic. 2. In the Microsoft VPN SelfHost Properties dialog box, select **Microsoft : Smart Card or other Certificate** from the drop down (this selects EAP TLS.) ![vpn selfhost properties window](images/certfiltering1.png) > **Note**  For PEAP or TTLS, select the appropriate method and continue following this procedure. 3. Click the **Properties** button underneath the drop down menu. 4. In the **Smart Card or other Certificate Properties** menu, select the **Advanced** button. ![smart card or other certificate properties window](images/certfiltering2.png) 5. In the **Configure Certificate Selection** menu, adjust the filters as needed. ![configure certificate selection window](images/certfiltering3.png) 6. Click **OK** to close the windows to get back to the main rasphone.exe dialog box. 7. Close the rasphone dialog box. 8. Continue following the procedure in the [EAP configuration](eap-configuration.md) topic from Step 9 to get an EAP TLS profile with appropriate filtering. > [!NOTE] >You can also set all the other applicable EAP Properties through this UI as well. A guide for what these properties mean can be found in the [Extensible Authentication Protocol (EAP) Settings for Network Access](https://technet.microsoft.com/library/hh945104.aspx) topic. ### Remote PIN reset not supported in Azure Active Directory joined mobile devices In Windows 10 Mobile, remote PIN reset in Azure AD joined devices are not supported. Devices are wiped when you issue a remote PIN reset command using the RemoteLock CSP. ### MDM client will immediately check-in with the MDM server after client renews WNS channel URI Starting in Windows 10, after the MDM client automatically renews the WNS channel URI, the MDM client will immediately check-in with the MDM server. Henceforth, for every MDM client check-in, the MDM server should send a GET request for "ProviderID/Push/ChannelURI" to retrieve the latest channel URI and compare it with the existing channel URI; then update the channel URI if necessary. ### User provisioning failure in Azure Active Directory joined Windows 10 PC In Azure AD joined Windows 10 PC, provisioning /.User resources fails when the user is not logged in as an Azure AD user. If you attempt to join Azure AD from **Settings** > **System** > **About** user interface, make sure to log off and log on with Azure AD credentials to get your organizational configuration from your MDM server. This behavior is by design. ### Requirements to note for VPN certificates also used for Kerberos Authentication If you want to use the certificate used for VPN authentication also for Kerberos authentication (required if you need access to on-premises resources using NTLM or Kerberos), the user's certificate must meet the requirements for smart card certificate, the Subject field should contain the DNS domain name in the DN or the SAN should contain a fully qualified UPN so that the DC can be located from the DNS registrations. If certificates that do not meet these requirements are used for VPN, users may fail to access resources that require Kerberos authentication. This issue primarily impacts Windows Phone. ### Device management agent for the push-button reset is not working The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware/commercialize/manufacture/desktop/push-button-reset-overview) keeps the registry settings for OMA DM sessions, but deletes the task schedules. The client enrollment is retained, but it never syncs with the MDM service. ## Frequently Asked Questions ### **Can there be more than 1 MDM server to enroll and manage devices in Windows 10?** No. Only one MDM is allowed. ### **How do I set the maximum number of Azure Active Directory joined devices per user?** 1. Login to the portal as tenant admin: https://manage.windowsazure.com. 2. Click Active Directory on the left pane. 3. Choose your tenant. 4. Click **Configure**. 5. Set quota to unlimited. ![aad maximum joined devices](images/faq-max-devices.png) ### **What is dmwappushsvc?** Entry | Description --------------- | -------------------- What is dmwappushsvc? | It is a Windows service that ships in Windows 10 operating system as a part of the windows management platform. It is used internally by the operating system as a queue for categorizing and processing all WAP messages, which include Windows management messages, MMS, NabSync, and Service Indication/Service Loading (SI/SL). The service also initiates and orchestrates management sync sessions with the MDM server. | What data is handled by dmwappushsvc? | It is a component handling the internal workings of the management platform and involved in processing messages that have been received by the device remotely for management. The messages in the queue are serviced by another component that is also part of the Windows management stack to process messages. The service also routes and authenticates WAP messages received by the device to internal OS components that process them further: MMS, NabSync, SI/SL. | How do I turn if off? | The service can be stopped from the "Services" console on the device (Start > Run > services.msc). However, since this is a component part of the OS and required for the proper functioning of the device, we strongly recommend not to do this. | ## Change history in MDM documentation ### October 2019 |New or updated topic | Description| |--- | ---| |[BitLocker CSP](bitlocker-csp.md)|Added the following new nodes:
ConfigureRecoveryPasswordRotation, RotateRecoveryPasswords, RotateRecoveryPasswordsStatus, RotateRecoveryPasswordsRequestID| ### September 2019 |New or updated topic | Description| |--- | ---| |[EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md)|Added the following new node:
IsStub| |[Policy CSP - Defender](policy-csp-defender.md)|Updated the supported value list for Defender/ScheduleScanDay policy.| |[Policy CSP - DeviceInstallation](policy-csp-deviceinstallation.md)|Added the following new policies:
DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs, DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs.| ### August 2019 |New or updated topic | Description| |--- | ---| |[DiagnosticLog CSP](diagnosticlog-csp.md)
[DiagnosticLog DDF](diagnosticlog-ddf.md)|Added version 1.4 of the CSP in Windows 10, version 1903. Added the new 1.4 version of the DDF. Added the following new nodes:
Policy, Policy/Channels, Policy/Channels/ChannelName, Policy/Channels/ChannelName/MaximumFileSize, Policy/Channels/ChannelName/SDDL, Policy/Channels/ChannelName/ActionWhenFull, Policy/Channels/ChannelName/Enabled, DiagnosticArchive, DiagnosticArchive/ArchiveDefinition, DiagnosticArchive/ArchiveResults.| |[Enroll a Windows 10 device automatically using Group Policy](enroll-a-windows-10-device-automatically-using-group-policy.md)|Enhanced the article to include additional reference links and the following two topics:
Verify auto-enrollment requirements and settings, Troubleshoot auto-enrollment of devices.| ### July 2019 |New or updated topic | Description| |--- | ---| |[Policy CSP](policy-configuration-service-provider.md)|Added the following list:
Policies supported by HoloLens 2| |[ApplicationControl CSP](applicationcontrol-csp.md)|Added new CSP in Windows 10, version 1903.| |[PassportForWork CSP](passportforwork-csp.md)|Added the following new nodes in Windows 10, version 1903:
SecurityKey, SecurityKey/UseSecurityKeyForSignin| |[Policy CSP - Privacy](policy-csp-privacy.md)|Added the following new policies:
LetAppsActivateWithVoice, LetAppsActivateWithVoiceAboveLock| |Create a custom configuration service provider|Deleted the following documents from the CSP reference because extensibility via CSPs is not currently supported:
Create a custom configuration service provider
Design a custom configuration service provider
IConfigServiceProvider2
IConfigServiceProvider2::ConfigManagerNotification
IConfigServiceProvider2::GetNode
ICSPNode
ICSPNode::Add
ICSPNode::Clear
ICSPNode::Copy
ICSPNode::DeleteChild
ICSPNode::DeleteProperty
ICSPNode::Execute
ICSPNode::GetChildNodeNames
ICSPNode::GetProperty
ICSPNode::GetPropertyIdentifiers
ICSPNode::GetValue
ICSPNode::Move
ICSPNode::SetProperty
ICSPNode::SetValue
ICSPNodeTransactioning
ICSPValidate
Samples for writing a custom configuration service provider| ### June 2019 |New or updated topic | Description| |--- | ---| |[Policy CSP - DeviceHealthMonitoring](policy-csp-devicehealthmonitoring.md)|Added the following new policies:
AllowDeviceHealthMonitoring, ConfigDeviceHealthMonitoringScope, ConfigDeviceHealthMonitoringUploadDestination.| |[Policy CSP - TimeLanguageSettings](policy-csp-timelanguagesettings.md)|Added the following new policy:
ConfigureTimeZone.| ### May 2019 |New or updated topic | Description| |--- | ---| |[DeviceStatus CSP](devicestatus-csp.md)|Updated description of the following nodes:
DeviceStatus/Antivirus/SignatureStatus, DeviceStatus/Antispyware/SignatureStatus.| |[EnrollmentStatusTracking CSP](enrollmentstatustracking-csp.md)|Added new CSP in Windows 10, version 1903.| |[Policy CSP - DeliveryOptimization](policy-csp-deliveryoptimization.md)|Added the following new policies:
DODelayCacheServerFallbackBackground, DODelayCacheServerFallbackForeground.

Updated description of the following policies:
DOMinRAMAllowedToPeer, DOMinFileSizeToCache, DOMinDiskSizeAllowedToPeer.| |[Policy CSP - Experience](policy-csp-experience.md)|Added the following new policy:
ShowLockOnUserTile.| |[Policy CSP - InternetExplorer](policy-csp-internetexplorer.md)|Added the following new policies:
AllowEnhancedSuggestionsInAddressBar, DisableActiveXVersionListAutoDownload, DisableCompatView, DisableFeedsBackgroundSync, DisableGeolocation, DisableWebAddressAutoComplete, NewTabDefaultPage.| |[Policy CSP - Power](policy-csp-power.md)|Added the following new policies:
EnergySaverBatteryThresholdOnBattery, EnergySaverBatteryThresholdPluggedIn, SelectLidCloseActionOnBattery, SelectLidCloseActionPluggedIn, SelectPowerButtonActionOnBattery, SelectPowerButtonActionPluggedIn, SelectSleepButtonActionOnBattery, SelectSleepButtonActionPluggedIn, TurnOffHybridSleepOnBattery, TurnOffHybridSleepPluggedIn, UnattendedSleepTimeoutOnBattery, UnattendedSleepTimeoutPluggedIn.| |[Policy CSP - Search](policy-csp-search.md)|Added the following new policy:
AllowFindMyFiles.| |[Policy CSP - ServiceControlManager](policy-csp-servicecontrolmanager.md)|Added the following new policy:
SvchostProcessMitigation.| |[Policy CSP - System](policy-csp-system.md)|Added the following new policies:
AllowCommercialDataPipeline, TurnOffFileHistory.| |[Policy CSP - Troubleshooting](policy-csp-troubleshooting.md)|Added the following new policy:
AllowRecommendations.| |[Policy CSP - Update](policy-csp-update.md)|Added the following new policies:
AutomaticMaintenanceWakeUp, ConfigureDeadlineForFeatureUpdates, ConfigureDeadlineForQualityUpdates, ConfigureDeadlineGracePeriod, ConfigureDeadlineNoAutoReboot.| |[Policy CSP - WindowsLogon](policy-csp-windowslogon.md)|Added the following new policies:
AllowAutomaticRestartSignOn, ConfigAutomaticRestartSignOn, EnableFirstLogonAnimation.

Removed the following policy:
SignInLastInteractiveUserAutomaticallyAfterASystemInitiatedRestart. This policy is replaced by AllowAutomaticRestartSignOn.| ### April 2019 | New or updated topic | Description | |-------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | [Win32 and Desktop Bridge app policy configuration](win32-and-centennial-app-policy-configuration.md) | Added the following warning at the end of the Overview section:
Some operating system components have built in functionality to check devices for domain membership. MDM enforces the configured policy values only if the devices are domain joined, otherwise it does not. However, you can still import ADMX files and set ADMX-backed policies regardless of whether the device is domain joined or non-domain joined. | | [Policy CSP - UserRights](policy-csp-userrights.md) | Added a note stating if you use Intune custom profiles to assign UserRights policies, you must use the CDATA tag () to wrap the data fields. | ### March 2019 |New or updated topic | Description| |--- | ---| |[Policy CSP - Storage](policy-csp-storage.md)|Updated ADMX Info of the following policies:
AllowStorageSenseGlobal, AllowStorageSenseTemporaryFilesCleanup, ConfigStorageSenseCloudContentDehydrationThreshold, ConfigStorageSenseDownloadsCleanupThreshold, ConfigStorageSenseGlobalCadence, ConfigStorageSenseRecycleBinCleanupThreshold.

Updated description of ConfigStorageSenseDownloadsCleanupThreshold.| ### February 2019 |New or updated topic | Description| |--- | ---| |[Policy CSP](policy-configuration-service-provider.md)|Updated supported policies for Holographic.| ### January 2019 |New or updated topic | Description| |--- | ---| |[Policy CSP - Storage](policy-csp-storage.md)|Added the following new policies: AllowStorageSenseGlobal, ConfigStorageSenseGlobalCadence, AllowStorageSenseTemporaryFilesCleanup, ConfigStorageSenseRecycleBinCleanupThreshold, ConfigStorageSenseDownloadsCleanupThreshold, and ConfigStorageSenseCloudContentCleanupThreshold.| |[SharedPC CSP](sharedpc-csp.md)|Updated values and supported operations.| |[Mobile device management](index.md)|Updated information about MDM Security Baseline.| ### December 2018 |New or updated topic | Description| |--- | ---| |[BitLocker CSP](bitlocker-csp.md)|Updated AllowWarningForOtherDiskEncryption policy description to describe silent and non-silent encryption scenarios, as well as where and how the recovery key is backed up for each scenario.| ### September 2018 |New or updated topic | Description| |--- | ---| |[Mobile device management](index.md#mmat) | Added information about the MDM Migration Analysis Tool (MMAT).| |[Policy CSP - DeviceGuard](policy-csp-deviceguard.md) | Updated ConfigureSystemGuardLaunch policy and replaced EnableSystemGuard with it.| ### August 2018
New or updated topic Description
BitLocker CSP

Added support for Windows 10 Pro starting in the version 1809.

Office CSP

Added FinalStatus setting in Windows 10, version 1809.

RemoteWipe CSP

Added new settings in Windows 10, version 1809.

TenantLockdown CSP

Added new CSP in Windows 10, version 1809.

WindowsDefenderApplicationGuard CSP

Added new settings in Windows 10, version 1809.

Policy DDF file

Posted an updated version of the Policy DDF for Windows 10, version 1809.

Policy CSP

Added the following new policies in Windows 10, version 1809:

  • Browser/AllowFullScreenMode
  • Browser/AllowPrelaunch
  • Browser/AllowPrinting
  • Browser/AllowSavingHistory
  • Browser/AllowSideloadingOfExtensions
  • Browser/AllowTabPreloading
  • Browser/AllowWebContentOnNewTabPage
  • Browser/ConfigureFavoritesBar
  • Browser/ConfigureHomeButton
  • Browser/ConfigureKioskMode
  • Browser/ConfigureKioskResetAfterIdleTimeout
  • Browser/ConfigureOpenMicrosoftEdgeWith
  • Browser/ConfigureTelemetryForMicrosoft365Analytics
  • Browser/PreventCertErrorOverrides
  • Browser/SetHomeButtonURL
  • Browser/SetNewTabPageURL
  • Browser/UnlockHomeButton
  • Experience/DoNotSyncBrowserSettings
  • Experience/PreventUsersFromTurningOnBrowserSyncing
  • Kerberos/UPNNameHints
  • Privacy/AllowCrossDeviceClipboard
  • Privacy/DisablePrivacyExperience
  • Privacy/UploadUserActivities
  • System/AllowDeviceNameInDiagnosticData
  • System/ConfigureMicrosoft365UploadEndpoint
  • System/DisableDeviceDelete
  • System/DisableDiagnosticDataViewer
  • Storage/RemovableDiskDenyWriteAccess
  • Update/UpdateNotificationLevel

Start/DisableContextMenus - added in Windows 10, version 1803.

RestrictedGroups/ConfigureGroupMembership - added new schema to apply and retrieve the policy.
### July 2018
New or updated topic Description
AssignedAccess CSP

Added the following note:

  • You can only assign one single app kiosk profile to an individual user account on a device. The single app profile does not support domain groups.
PassportForWork CSP

Added new settings in Windows 10, version 1809.

EnterpriseModernAppManagement CSP

Added NonRemovable setting under AppManagement node in Windows 10, version 1809.

Win32CompatibilityAppraiser CSP

Added new configuration service provider in Windows 10, version 1809.

WindowsLicensing CSP

Added S mode settings and SyncML examples in Windows 10, version 1809.

SUPL CSP

Added 3 new certificate nodes in Windows 10, version 1809.

Defender CSP

Added a new node Health/ProductStatus in Windows 10, version 1809.

BitLocker CSP

Added a new node AllowStandardUserEncryption in Windows 10, version 1809.

DevDetail CSP

Added a new node SMBIOSSerialNumber in Windows 10, version 1809.

Policy CSP

Added the following new policies in Windows 10, version 1809:

  • ApplicationManagement/LaunchAppAfterLogOn
  • ApplicationManagement/ScheduleForceRestartForUpdateFailures
  • Authentication/EnableFastFirstSignIn (Preview mode only)
  • Authentication/EnableWebSignIn (Preview mode only)
  • Authentication/PreferredAadTenantDomainName
  • Defender/CheckForSignaturesBeforeRunningScan
  • Defender/DisableCatchupFullScan
  • Defender/DisableCatchupQuickScan
  • Defender/EnableLowCPUPriority
  • Defender/SignatureUpdateFallbackOrder
  • Defender/SignatureUpdateFileSharesSources
  • DeviceGuard/ConfigureSystemGuardLaunch
  • DeviceInstallation/AllowInstallationOfMatchingDeviceIDs
  • DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses
  • DeviceInstallation/PreventDeviceMetadataFromNetwork
  • DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings
  • DmaGuard/DeviceEnumerationPolicy
  • Experience/AllowClipboardHistory
  • Security/RecoveryEnvironmentAuthentication
  • TaskManager/AllowEndTask
  • WindowsDefenderSecurityCenter/DisableClearTpmButton
  • WindowsDefenderSecurityCenter/DisableTpmFirmwareUpdateWarning
  • WindowsDefenderSecurityCenter/HideWindowsSecurityNotificationAreaControl
  • WindowsLogon/DontDisplayNetworkSelectionUI

Recent changes:

  • DataUsage/SetCost3G - deprecated in Windows 10, version 1809.
### June 2018
New or updated topic Description
Wifi CSP

Added a new node WifiCost in Windows 10, version 1809.

Diagnose MDM failures in Windows 10

Recent changes:

  • Added procedure for collecting logs remotely from Windows 10 Holographic.
  • Added procedure for downloading the MDM Diagnostic Information log.
Bitlocker CSP

Added new node AllowStandardUserEncryption in Windows 10, version 1809.

Policy CSP

Recent changes:

  • AccountPoliciesAccountLockoutPolicy/AccountLockoutDuration - removed from docs. Not supported.
  • AccountPoliciesAccountLockoutPolicy/AccountLockoutThreshold - removed from docs. Not supported.
  • AccountPoliciesAccountLockoutPolicy/ResetAccountLockoutCounterAfter - removed from docs. Not supported.
  • LocalPoliciesSecurityOptions/NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers - removed from docs. Not supported.
  • System/AllowFontProviders is not supported in HoloLens (1st gen) Commercial Suite.
  • Security/RequireDeviceEncryption is supported in the Home SKU.
  • Start/StartLayout - added a table of SKU support information.
  • Start/ImportEdgeAssets - added a table of SKU support information.

Added the following new policies in Windows 10, version 1809:

  • Update/EngagedRestartDeadlineForFeatureUpdates
  • Update/EngagedRestartSnoozeScheduleForFeatureUpdates
  • Update/EngagedRestartTransitionScheduleForFeatureUpdates
  • Update/SetDisablePauseUXAccess
  • Update/SetDisableUXWUAccess
WiredNetwork CSP New CSP added in Windows 10, version 1809.
### May 2018
New or updated topic Description
Policy DDF file

Updated the DDF files in the Windows 10 version 1703 and 1709.
### April 2018
New or updated topic Description
WindowsDefenderApplicationGuard CSP

Added the following node in Windows 10, version 1803:

  • Settings/AllowVirtualGPU
  • Settings/SaveFilesToHost
NetworkProxy CSP

Added the following node in Windows 10, version 1803:

  • ProxySettingsPerUser
Accounts CSP

Added a new CSP in Windows 10, version 1803.

MDM Migration Analysis Too (MMAT)

Updated version available. MMAT is a tool you can use to determine which Group Policies are set on a target user/computer and cross-reference them against the list of supported MDM policies.

CSP DDF files download

Added the DDF download of Windows 10, version 1803 configuration service providers.

Policy CSP

Added the following new policies for Windows 10, version 1803:

  • Bluetooth/AllowPromptedProximalConnections
  • KioskBrowser/EnableEndSessionButton
  • LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways
  • LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptSecureChannelDataWhenPossible
  • LocalPoliciesSecurityOptions/DomainMember_DisableMachineAccountPasswordChanges
  • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication
  • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic
  • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic
  • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers
### March 2018
New or updated topic Description
eUICCs CSP

Added the following node in Windows 10, version 1803:

  • IsEnabled
DeviceStatus CSP

Added the following node in Windows 10, version 1803:

  • OS/Mode
Understanding ADMX-backed policies

Added the following videos:

AccountManagement CSP

Added a new CSP in Windows 10, version 1803.

RootCATrustedCertificates CSP

Added the following node in Windows 10, version 1803:

  • UntrustedCertificates
Policy CSP

Added the following new policies for Windows 10, version 1803:

  • ApplicationDefaults/EnableAppUriHandlers
  • ApplicationManagement/MSIAllowUserControlOverInstall
  • ApplicationManagement/MSIAlwaysInstallWithElevatedPrivileges
  • Connectivity/AllowPhonePCLinking
  • Notifications/DisallowCloudNotification
  • Notifications/DisallowTileNotification
  • RestrictedGroups/ConfigureGroupMembership

The following existing policies were updated:

  • Browser/AllowCookies - updated the supported values. There are 3 values - 0, 1, 2.
  • InternetExplorer/AllowSiteToZoneAssignmentList - updated the description and added an example SyncML
  • TextInput/AllowIMENetworkAccess - introduced new suggestion services in Japanese IME in addition to cloud suggestion.

Added a new section:

  • Policies supported by Group Policy - list of policies in Policy CSP that has corresponding Group Policy. The policy description contains the GP information, such as GP policy name and variable name.
Policy CSP - Bluetooth

Added new section ServicesAllowedList usage guide.

MultiSIM CSP

Added SyncML examples and updated the settings descriptions.

RemoteWipe CSP

Reverted back to Windows 10, version 1709. Removed previous draft documentation for version 1803.
### February 2018
New or updated topic Description
Policy CSP

Added the following new policies for Windows 10, version 1803:

  • Display/DisablePerProcessDpiForApps
  • Display/EnablePerProcessDpi
  • Display/EnablePerProcessDpiForApps
  • Experience/AllowWindowsSpotlightOnSettings
  • TextInput/ForceTouchKeyboardDockedState
  • TextInput/TouchKeyboardDictationButtonAvailability
  • TextInput/TouchKeyboardEmojiButtonAvailability
  • TextInput/TouchKeyboardFullModeAvailability
  • TextInput/TouchKeyboardHandwritingModeAvailability
  • TextInput/TouchKeyboardNarrowModeAvailability
  • TextInput/TouchKeyboardSplitModeAvailability
  • TextInput/TouchKeyboardWideModeAvailability
VPNv2 ProfileXML XSD

Updated the XSD and Plug-in profile example for VPNv2 CSP.

AssignedAccess CSP

Added the following nodes in Windows 10, version 1803:

  • Status
  • ShellLauncher
  • StatusConfiguration

Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in HoloLens (1st gen) Commercial Suite. Added example for HoloLens (1st gen) Commercial Suite.

MultiSIM CSP

Added a new CSP in Windows 10, version 1803.

EnterpriseModernAppManagement CSP

Added the following node in Windows 10, version 1803:

  • MaintainProcessorArchitectureOnUpdate
### January 2018
New or updated topic Description
Policy CSP

Added the following new policies for Windows 10, version 1803:

  • Browser/AllowConfigurationUpdateForBooksLibrary
  • Browser/AlwaysEnableBooksLibrary
  • Browser/EnableExtendedBooksTelemetry
  • Browser/UseSharedFolderForBooks
  • DeliveryOptimization/DODelayBackgroundDownloadFromHttp
  • DeliveryOptimization/DODelayForegroundDownloadFromHttp
  • DeliveryOptimization/DOGroupIdSource
  • DeliveryOptimization/DOPercentageMaxBackDownloadBandwidth
  • DeliveryOptimization/DOPercentageMaxForeDownloadBandwidth
  • DeliveryOptimization/DORestrictPeerSelectionBy
  • DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth
  • DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth
  • KioskBrowser/BlockedUrlExceptions
  • KioskBrowser/BlockedUrls
  • KioskBrowser/DefaultURL
  • KioskBrowser/EnableHomeButton
  • KioskBrowser/EnableNavigationButtons
  • KioskBrowser/RestartOnIdleTime
  • LocalPoliciesSecurityOptions/Devices_AllowUndockWithoutHavingToLogon
  • LocalPoliciesSecurityOptions/Devices_AllowedToFormatAndEjectRemovableMedia
  • LocalPoliciesSecurityOptions/Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters
  • LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly
  • LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior
  • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees
  • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers
  • LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways
  • LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees
  • LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts
  • LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares
  • LocalPoliciesSecurityOptions/NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares
  • LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM
  • LocalPoliciesSecurityOptions/NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange
  • LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel
  • LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers
  • LocalPoliciesSecurityOptions/Shutdown_ClearVirtualMemoryPageFile
  • LocalPoliciesSecurityOptions/SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems
  • LocalPoliciesSecurityOptions/UserAccountControl_DetectApplicationInstallationsAndPromptForElevation
  • LocalPoliciesSecurityOptions/UserAccountControl_UseAdminApprovalMode
  • RestrictedGroups/ConfigureGroupMembership
  • Search/AllowCortanaInAAD
  • Search/DoNotUseWebResults
  • Security/ConfigureWindowsPasswords
  • System/FeedbackHubAlwaysSaveDiagnosticsLocally
  • SystemServices/ConfigureHomeGroupListenerServiceStartupMode
  • SystemServices/ConfigureHomeGroupProviderServiceStartupMode
  • SystemServices/ConfigureXboxAccessoryManagementServiceStartupMode
  • SystemServices/ConfigureXboxLiveAuthManagerServiceStartupMode
  • SystemServices/ConfigureXboxLiveGameSaveServiceStartupMode
  • SystemServices/ConfigureXboxLiveNetworkingServiceStartupMode
  • TaskScheduler/EnableXboxGameSaveTask
  • TextInput/EnableTouchKeyboardAutoInvokeInDesktopMode
  • Update/ConfigureFeatureUpdateUninstallPeriod
  • UserRights/AccessCredentialManagerAsTrustedCaller
  • UserRights/AccessFromNetwork
  • UserRights/ActAsPartOfTheOperatingSystem
  • UserRights/AllowLocalLogOn
  • UserRights/BackupFilesAndDirectories
  • UserRights/ChangeSystemTime
  • UserRights/CreateGlobalObjects
  • UserRights/CreatePageFile
  • UserRights/CreatePermanentSharedObjects
  • UserRights/CreateSymbolicLinks
  • UserRights/CreateToken
  • UserRights/DebugPrograms
  • UserRights/DenyAccessFromNetwork
  • UserRights/DenyLocalLogOn
  • UserRights/DenyRemoteDesktopServicesLogOn
  • UserRights/EnableDelegation
  • UserRights/GenerateSecurityAudits
  • UserRights/ImpersonateClient
  • UserRights/IncreaseSchedulingPriority
  • UserRights/LoadUnloadDeviceDrivers
  • UserRights/LockMemory
  • UserRights/ManageAuditingAndSecurityLog
  • UserRights/ManageVolume
  • UserRights/ModifyFirmwareEnvironment
  • UserRights/ModifyObjectLabel
  • UserRights/ProfileSingleProcess
  • UserRights/RemoteShutdown
  • UserRights/RestoreFilesAndDirectories
  • UserRights/TakeOwnership
  • WindowsDefenderSecurityCenter/DisableAccountProtectionUI
  • WindowsDefenderSecurityCenter/DisableDeviceSecurityUI
  • WindowsDefenderSecurityCenter/HideRansomwareDataRecovery
  • WindowsDefenderSecurityCenter/HideSecureBoot
  • WindowsDefenderSecurityCenter/HideTPMTroubleshooting

Added the following policies the were added in Windows 10, version 1709

  • DeviceLock/MinimumPasswordAge
  • Settings/AllowOnlineTips
  • System/DisableEnterpriseAuthProxy

Security/RequireDeviceEncryption - updated to show it is supported in desktop.

BitLocker CSP

Updated the description for AllowWarningForOtherDiskEncryption to describe changes added in Windows 10, version 1803.

EnterpriseModernAppManagement CSP

Added new node MaintainProcessorArchitectureOnUpdate in Windows 10, next major update.

DMClient CSP

Added ./User/Vendor/MSFT/DMClient/Provider/[ProviderID]/FirstSyncStatus node. Also added the following nodes in Windows 10, version 1803:

  • AADSendDeviceToken
  • BlockInStatusPage
  • AllowCollectLogsButton
  • CustomErrorText
  • SkipDeviceStatusPage
  • SkipUserStatusPage
Defender CSP

Added new node (OfflineScan) in Windows 10, version 1803.

UEFI CSP

Added a new CSP in Windows 10, version 1803.

Update CSP

Added the following nodes in Windows 10, version 1803:

  • Rollback
  • Rollback/FeatureUpdate
  • Rollback/QualityUpdateStatus
  • Rollback/FeatureUpdateStatus
### December 2017
New or updated topic Description
Configuration service provider reference

Added new section CSP DDF files download
### November 2017
New or updated topic Description
Policy CSP

Added the following policies for Windows 10, version 1709:

  • Authentication/AllowFidoDeviceSignon
  • Cellular/LetAppsAccessCellularData
  • Cellular/LetAppsAccessCellularData_ForceAllowTheseApps
  • Cellular/LetAppsAccessCellularData_ForceDenyTheseApps
  • Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps
  • Start/HidePeopleBar
  • Storage/EnhancedStorageDevices
  • Update/ManagePreviewBuilds
  • WirelessDisplay/AllowMdnsAdvertisement
  • WirelessDisplay/AllowMdnsDiscovery

Added missing policies from previous releases:

  • Connectivity/DisallowNetworkConnectivityActiveTest
  • Search/AllowWindowsIndexer
### October 2017
New or updated topic Description
Policy DDF file

Updated the DDF content for Windows 10 version 1709. Added a link to the download of Policy DDF for Windows 10, version 1709.

Policy CSP

Updated the following policies:

  • Defender/ControlledFolderAccessAllowedApplications - string separator is |.
  • Defender/ControlledFolderAccessProtectedFolders - string separator is |.
eUICCs CSP

Added new CSP in Windows 10, version 1709.

AssignedAccess CSP

Added SyncML examples for the new Configuration node.

DMClient CSP

Added new nodes to the DMClient CSP in Windows 10, version 1709. Updated the CSP and DDF topics.
### September 2017
New or updated topic Description
Policy CSP

Added the following new policies for Windows 10, version 1709:

  • Authentication/AllowAadPasswordReset
  • Handwriting/PanelDefaultModeDocked
  • Search/AllowCloudSearch
  • System/LimitEnhancedDiagnosticDataWindowsAnalytics

Added new settings to Update/BranchReadinessLevel policy in Windows 10 version 1709.

AssignedAccess CSP

Starting in Windows 10, version 1709, AssignedAccess CSP is also supported in Windows 10 Pro.

Microsoft Store for Business and Microsoft Store

Windows Store for Business name changed to Microsoft Store for Business. Windows Store name changed to Microsoft Store.

The [MS-MDE2]: Mobile Device Enrollment Protocol Version 2

The Windows 10 enrollment protocol was updated. The following elements were added to the RequestSecurityToken message:

  • UXInitiated - boolean value that indicates whether the enrollment is user initiated from the Settings page.
  • ExternalMgmtAgentHint - a string the agent uses to give hints the enrollment server may need.
  • DomainName - fully qualified domain name if the device is domain-joined.

For examples, see section 4.3.1 RequestSecurityToken of the MS-MDE2 protocol documentation.

EnterpriseAPN CSP

Added a SyncML example.

VPNv2 CSP

Added RegisterDNS setting in Windows 10, version 1709.

Enroll a Windows 10 device automatically using Group Policy

Added new topic to introduce a new Group Policy for automatic MDM enrollment.

MDM enrollment of Windows-based devices

New features in the Settings app:

  • User sees installation progress of critical policies during MDM enrollment.
  • User knows what policies, profiles, apps MDM has configured
  • IT helpdesk can get detailed MDM diagnostic information using client tools

For details, see Managing connections and Collecting diagnostic logs
### August 2017
New or updated topic Description
Enable ADMX-backed policies in MDM

Added new step-by-step guide to enable ADMX-backed policies.

Mobile device enrollment

Added the following statement:

  • Devices that are joined to an on-premises Active Directory can enroll into MDM via the Work access page in Settings. However, the enrollment can only target the user enrolled with user-specific policies. Device targeted policies will continue to impact all users of the device.
CM_CellularEntries CSP

Updated the description of the PuposeGroups node to add the GUID for applications. This node is required instead of optional.

EnterpriseDataProtection CSP

Updated the Settings/EDPEnforcementLevel values to the following:

  • 0 (default) – Off / No protection (decrypts previously protected data).
  • 1 – Silent mode (encrypt and audit only).
  • 2 – Allow override mode (encrypt, prompt and allow overrides, and audit).
  • 3 – Hides overrides (encrypt, prompt but hide overrides, and audit).
AppLocker CSP

Added two new SyncML examples (to disable the calendar app and to block usage of the map app) in Whitelist examples.

DeviceManageability CSP

Added the following settings in Windows 10, version 1709:

  • Provider/ProviderID/ConfigInfo
  • Provider/ProviderID/EnrollmentInfo
Office CSP

Added the following setting in Windows 10, version 1709:

  • Installation/CurrentStatus
BitLocker CSP Added information to the ADMX-backed policies. Changed the minimum personal identification number (PIN) length to 4 digits in SystemDrivesRequireStartupAuthentication and SystemDrivesMinimumPINLength in Windows 10, version 1709.
Firewall CSP Updated the CSP and DDF topics. Here are the changes:
  • Removed the two settings - FirewallRules/FirewallRuleName/FriendlyName and FirewallRules/FirewallRuleName/IcmpTypesAndCodes.
  • Changed some data types from integer to bool.
  • Updated the list of supported operations for some settings.
  • Added default values.
Policy DDF file Added another Policy DDF file download for the 8C release of Windows 10, version 1607, which added the following policies:
  • Browser/AllowMicrosoftCompatibilityList
  • Update/DisableDualScan
  • Update/FillEmptyContentUrls
Policy CSP

Added the following new policies for Windows 10, version 1709:

  • Browser/ProvisionFavorites
  • Browser/LockdownFavorites
  • ExploitGuard/ExploitProtectionSettings
  • Games/AllowAdvancedGamingServices
  • LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts
  • LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly
  • LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount
  • LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount
  • LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked
  • LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayLastSignedIn
  • LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayUsernameAtSignIn
  • LocalPoliciesSecurityOptions/Interactivelogon_DoNotRequireCTRLALTDEL
  • LocalPoliciesSecurityOptions/InteractiveLogon_MachineInactivityLimit
  • LocalPoliciesSecurityOptions/InteractiveLogon_MessageTextForUsersAttemptingToLogOn
  • LocalPoliciesSecurityOptions/InteractiveLogon_MessageTitleForUsersAttemptingToLogOn
  • LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests
  • LocalPoliciesSecurityOptions/RecoveryConsole_AllowAutomaticAdministrativeLogon
  • LocalPoliciesSecurityOptions/Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn
  • LocalPoliciesSecurityOptions/UserAccountControl_AllowUIAccessApplicationsToPromptForElevation
  • LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForAdministrators
  • LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers
  • LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated
  • LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations
  • LocalPoliciesSecurityOptions/UserAccountControl_RunAllAdministratorsInAdminApprovalMode
  • LocalPoliciesSecurityOptions/UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation
  • LocalPoliciesSecurityOptions/UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations
  • Privacy/EnableActivityFeed
  • Privacy/PublishUserActivities
  • Update/DisableDualScan
  • Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork

Changed the name of new policy to CredentialProviders/DisableAutomaticReDeploymentCredentials from CredentialProviders/EnableWindowsAutopilotResetCredentials.

Changed the names of the following policies:

  • Defender/GuardedFoldersAllowedApplications to Defender/ControlledFolderAccessAllowedApplications
  • Defender/GuardedFoldersList to Defender/ControlledFolderAccessProtectedFolders
  • Defender/EnableGuardMyFolders to Defender/EnableControlledFolderAccess

Added links to the additional ADMX-backed BitLocker policies.

There were issues reported with the previous release of the following policies. These issues were fixed in Window 10, version 1709:

  • Privacy/AllowAutoAcceptPairingAndPrivacyConsentPrompts
  • Start/HideAppList